akm-cli 0.9.15 → 0.9.16-alpha.2

package/dist/setup/setup.js

@@ -205,8 +205,8 @@ export function rebaseSetupChanges(original, desired, latest, pathParts = []) {
     }
     return result;
 }
-async function saveSetupConfig(original, desired, precommit) {
-    const result = await mutateConfigWithPrecommit((latest) => rebaseSetupChanges(original, desired, latest), precommit);
+async function saveSetupConfig(original, desired, precommit, options) {
+    const result = await mutateConfigWithPrecommit((latest) => rebaseSetupChanges(original, desired, latest), precommit, options);
     return { config: result.config, precommit: result.precommit };
 }
 /** Registry-managed bundles are not editable through setup's source picker. */
@@ -572,7 +572,7 @@ export async function runSetupWizard(opts) {
     const { config: savedConfig } = await saveSetupConfig(current, finalConfig, async () => {
         if (!opts?.noInit)
             await akmInit({ dir: stashDir, setDefault: true, persistConfig: false });
-    });
+    }, { persistTopLevelKeys: ["semanticSearchMode"] });
     // After config persistence, the task step reviews the plan and asks one
     // explicit confirmation before changing task files or scheduler state.
     // Non-interactive setup paths never reach this interactive-only step.

package/dist/setup/steps/tasks.js

@@ -8,9 +8,11 @@ import path from "node:path";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 import * as p from "../../cli/clack.js";
 import { akmTasksSync } from "../../commands/tasks/tasks.js";
-import { loadConfig } from "../../core/config/config.js";
+import { makeBundleRef } from "../../core/asset/asset-ref.js";
+import { loadConfig, mutateConfig } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
 import { commitWriteTargetBoundary, deleteAssetFromSource, prepareWriteTargetForMutation, resolveWriteTarget, writeAssetToSource, } from "../../core/write-source.js";
+import { schedulerActivationSourceId, schedulerActivations } from "../../tasks/activation-config.js";
 import { backendNameForPlatform } from "../../tasks/backends/index.js";
 import { listEmbeddedTasks } from "../../tasks/embedded.js";
 import { parseSchedule } from "../../tasks/schedule.js";
@@ -71,34 +73,13 @@ export function detectServerDefault() {
 function normaliseTaskIdForMatch(raw) {
     return raw.trim().replace(/\.(yml|md)$/, "");
 }
-/**
- * Toggle a task source v4 file's enabled state via a full parse/render
- * round-trip (setup's own edits are infrequent and not comment-preservation-
- * sensitive, unlike `commands/tasks/tasks.ts`'s `setEnabledInYaml` line
- * splice). Broadcasts `enabled` across every `schedule[]` entry — the
- * closest v4 equivalent of v3's single document-level flag. `src` no longer
- * accepts a task v3 file at all (P4 §3.2) — `listSetupTaskDefinitions` below
- * already fails closed on one before this function is ever reached, so
- * there is no legacy `akm.enabled` shape left to handle here.
- */
-function setTaskEnabledInYaml(yaml, enabled) {
-    const document = yamlParse(yaml);
-    const schedule = document.schedule;
-    if (typeof schedule === "string") {
-        document.schedule = [{ cron: schedule, enabled }];
-    }
-    else if (Array.isArray(schedule) && schedule.length > 0) {
-        document.schedule = schedule.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? { ...entry, enabled } : entry);
-    }
-    else {
-        throw new UsageError("Task source v4 must declare a schedule before setup can change enabled state.");
-    }
-    return yamlStringify(document);
-}
 export function listSetupTaskDefinitions() {
     const config = loadConfig();
     const target = resolveWriteTarget(config, config.defaultBundle, { requireWritable: false });
     const taskDir = path.join(target.source.path, "tasks");
+    const enabledRefs = new Set(schedulerActivations(config)
+        .filter((activation) => activation.kind === "task")
+        .map((activation) => activation.ref));
     if (!fs.existsSync(taskDir))
         return [];
     const tasks = [];
@@ -121,10 +102,7 @@ export function listSetupTaskDefinitions() {
                 id,
                 schedule: schedules[0],
                 schedules: Object.freeze(schedules),
-                // task source v4 has no document-level enabled (P4-N6) — a task is
-                // considered enabled for review purposes when at least one of its
-                // schedule bindings will actually fire.
-                enabled: document.schedule.some((entry) => entry.enabled),
+                enabled: enabledRefs.has(makeBundleRef(target.source.name, `tasks/${id}`)),
                 ...(document.description !== undefined ? { description: document.description } : {}),
             });
         }
@@ -147,11 +125,11 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
         const original = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : undefined;
         let yaml;
         if (original !== undefined) {
-            yaml = setTaskEnabledInYaml(original, plan.enabled);
+            yaml = original;
         }
         else {
             const document = yamlParse(plan.task.yaml);
-            document.schedule = plan.enabled ? plan.schedule : [{ cron: plan.schedule, enabled: false }];
+            document.schedule = plan.schedule;
             yaml = yamlStringify(document);
         }
         const parsed = parseTaskSource({ yaml, filePath, workspaceRoot: target.source.path });
@@ -161,8 +139,6 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
         return { filePath, original, yaml, ref: { type: "task", name: plan.task.id } };
     });
     const changed = prepared.filter((entry) => entry.original !== entry.yaml);
-    if (changed.length === 0)
-        return 0;
     const attempted = [];
     try {
         for (const entry of changed) {
@@ -199,6 +175,23 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
         }
         throw error;
     }
+    const selected = new Set(tasks.filter((plan) => plan.enabled).map((plan) => makeBundleRef(target.source.name, `tasks/${plan.task.id}`)));
+    const managed = new Set(tasks.map((plan) => makeBundleRef(target.source.name, `tasks/${plan.task.id}`)));
+    mutateConfig((current) => {
+        const existing = schedulerActivations(current);
+        const next = existing.filter((activation) => activation.kind !== "task" || !managed.has(activation.ref));
+        const sourceId = schedulerActivationSourceId(current, target.source.name);
+        if (selected.size > 0 && !sourceId) {
+            throw new UsageError(`Cannot activate setup tasks from disabled bundle ${JSON.stringify(target.source.name)}.`);
+        }
+        for (const ref of selected) {
+            next.push({ kind: "task", ref, sourceId: sourceId });
+        }
+        next.sort((left, right) => left.ref.localeCompare(right.ref) || left.kind.localeCompare(right.kind));
+        if (JSON.stringify(existing) === JSON.stringify(next))
+            return current;
+        return { ...current, scheduler: { ...current.scheduler, enabled: next } };
+    });
     return changed.length;
 }
 const DEFAULT_SCHEDULED_TASKS_DEPS = {
@@ -212,9 +205,9 @@ export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, op
         return;
     }
     // ALL templates are offered, including ships-disabled ones (e.g. the
-    // manual-recovery catchup task): an unselected template is still PREPARED
-    // with `enabled: false`, so its YAML exists for `akm task run <id>` while
-    // nothing lands in the scheduler uncommented. Filtering on `task.enabled`
+    // manual-recovery catchup task): an unselected template is still PREPARED,
+    // so its YAML exists for `akm task run <id>` while its ref remains absent
+    // from local scheduler activation. Filtering on `task.enabled`
     // here would make ships-disabled templates invisible and unpreparable.
     const embedded = listEmbeddedTasks();
     if (embedded.length === 0)

package/dist/sources/providers/git-install.js

@@ -8,7 +8,7 @@ import path from "node:path";
 import { isWithin } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { getRegistryCacheDir } from "../../core/paths.js";
-import { parseRegistryRef, resolveRegistryArtifact, validateGitRef, validateGitUrl } from "../../registry/resolve.js";
+import { gitCredentialEnvironment, parseRegistryRef, resolveRegistryArtifact, validateGitRef, validateGitUrl, } from "../../registry/resolve.js";
 import { applyAkmIncludeConfig, buildInstallCacheDir, detectStashRoot, isDirectory } from "./provider-utils.js";
 /**
  * Shared subprocess wrapper for `git` invocations. Disables git's interactive
@@ -22,13 +22,16 @@ export function runGit(args, options) {
     });
 }
 /** Fetch and classify the current branch against its upstream without changing the worktree. */
-export function inspectGitUpstream(repoDir) {
+export function inspectGitUpstream(repoDir, credential) {
     const remotes = runGit(["-C", repoDir, "remote"]);
     if (remotes.status !== 0)
         throw new UsageError(`Cannot inspect Git remotes at ${repoDir}: ${remotes.stderr.trim()}`);
     if (!remotes.stdout.trim())
         return { hasRemote: false, ahead: 0, behind: 0 };
-    const fetch = runGit(["-C", repoDir, "fetch", "--prune"], { timeout: 120_000 });
+    const fetch = runGit(["-C", repoDir, "fetch", "--prune"], {
+        timeout: 120_000,
+        env: gitCredentialEnvironment(credential),
+    });
     if (fetch.status !== 0)
         throw new UsageError(`Cannot refresh Git target at ${repoDir}: ${fetch.stderr.trim()}`);
     const upstream = runGit(["-C", repoDir, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
@@ -160,10 +163,10 @@ async function doSyncGit(parsed, options) {
     validateGitUrl(parsed.url);
     if (parsed.requestedRef)
         validateGitRef(parsed.requestedRef);
-    const resolved = await resolveRegistryArtifact(parsed);
+    const resolved = await resolveRegistryArtifact(parsed, { gitCredential: options?.credential });
     const syncedAt = (options?.now ?? new Date()).toISOString();
     if (options?.writable && options.writableRoot) {
-        return syncExistingWritableCheckout(parsed, resolved, options.writableRoot, syncedAt, options.writableRequiredRoots);
+        return syncExistingWritableCheckout(parsed, resolved, options.writableRoot, syncedAt, options.writableRequiredRoots, options.credential);
     }
     const cacheRootDir = options?.cacheRootDir ?? getRegistryCacheDir();
     const cacheDir = buildInstallCacheDir(cacheRootDir, parsed.source, parsed.id, options?.writable ? "writable" : resolved.resolvedRevision);
@@ -178,7 +181,7 @@ async function doSyncGit(parsed, options) {
             if (installRoot !== provisionalBundleRoot) {
                 throw new UsageError("Writable Git installs do not support akm.include (package.json) filtered snapshots.");
             }
-            return syncExistingWritableCheckout(parsed, resolved, detectStashRoot(installRoot), syncedAt, options.writableRequiredRoots);
+            return syncExistingWritableCheckout(parsed, resolved, detectStashRoot(installRoot), syncedAt, options.writableRequiredRoots, options.credential);
         }
         try {
             if (options?.force) {
@@ -228,7 +231,10 @@ async function doSyncGit(parsed, options) {
             cloneArgs.push("--branch", parsed.requestedRef);
         }
         cloneArgs.push(parsed.url, cloneDir);
-        const cloneResult = runGit(cloneArgs, { timeout: 120_000 });
+        const cloneResult = runGit(cloneArgs, {
+            timeout: 120_000,
+            env: gitCredentialEnvironment(options?.credential),
+        });
         if (cloneResult.status !== 0) {
             throw new Error(classifyCloneFailure(parsed.url, cloneResult.stderr, cloneResult.error));
         }
@@ -292,7 +298,7 @@ async function doSyncGit(parsed, options) {
         syncedAt,
     };
 }
-export function syncExistingWritableCheckout(parsed, resolved, contentRoot, syncedAt, requiredRoots = []) {
+export function syncExistingWritableCheckout(parsed, resolved, contentRoot, syncedAt, requiredRoots = [], credential) {
     const root = path.resolve(contentRoot);
     const repoResult = runGit(["-C", root, "rev-parse", "--show-toplevel"]);
     if (repoResult.status !== 0 || !repoResult.stdout.trim()) {
@@ -324,7 +330,7 @@ export function syncExistingWritableCheckout(parsed, resolved, contentRoot, sync
     fetchArgs.push("origin");
     if (parsed.requestedRef)
         fetchArgs.push(parsed.requestedRef);
-    const fetch = runGit(fetchArgs, { timeout: 120_000 });
+    const fetch = runGit(fetchArgs, { timeout: 120_000, env: gitCredentialEnvironment(credential) });
     if (fetch.status !== 0) {
         throw new UsageError(`Writable Git install at ${root} could not fetch its expected origin; local work was preserved. ${fetch.stderr.trim()}`);
     }
@@ -403,7 +409,7 @@ export function syncExistingWritableCheckout(parsed, resolved, contentRoot, sync
         syncedAt,
     };
 }
-export function cloneRepo(cloneUrl, ref, destDir, writable = false) {
+export function cloneRepo(cloneUrl, ref, destDir, writable = false, credential) {
     // Stage the clone into a sibling temp dir so that a failed clone never
     // destroys a previously-valid destDir (e.g. when the remote is temporarily
     // unreachable and we have a valid cached copy).
@@ -414,7 +420,7 @@ export function cloneRepo(cloneUrl, ref, destDir, writable = false) {
     if (ref)
         args.push("--branch", ref);
     args.push(cloneUrl, tmpDir);
-    const result = runGit(args, { timeout: 120_000 });
+    const result = runGit(args, { timeout: 120_000, env: gitCredentialEnvironment(credential) });
     if (result.status !== 0) {
         // Clean up the (possibly partial) temp dir but leave destDir untouched.
         fs.rmSync(tmpDir, { recursive: true, force: true });

package/dist/sources/providers/git-provider.js

@@ -6,6 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { akmAdapter } from "../../core/adapter/adapters/akm-adapter.js";
 import { stashDirNames } from "../../core/asset/asset-placement.js";
+import { resolveSecret } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { getRegistryIndexCacheDir } from "../../core/paths.js";
 import { validateGitUrl } from "../../registry/resolve.js";
@@ -41,7 +42,12 @@ export class GitSourceProvider {
         return this.#path;
     }
     async sync(options) {
-        await syncMirroredRepo(this.#config, { force: options?.force });
+        await syncMirroredRepo(this.#config, {
+            force: options?.force,
+            ...(this.#config.credential
+                ? { credential: resolveSecret(this.#config.credential, options?.secrets?.resolveSecret) }
+                : {}),
+        });
     }
 }
 /** Resolve the on-disk content directory for a configured git source. */
@@ -81,10 +87,10 @@ export async function ensureGitMirror(repo, cachePaths, options) {
             fs.mkdirSync(cachePaths.rootDir, { recursive: true });
             if (writable && fs.existsSync(path.join(cachePaths.repoDir, ".git"))) {
                 // Writable repo already cloned — pull instead of re-clone to preserve local changes
-                pullRepo(cachePaths.repoDir);
+                pullRepo(cachePaths.repoDir, options?.credential);
             }
             else {
-                cloneRepo(repo.cloneUrl, repo.ref, cachePaths.repoDir, writable);
+                cloneRepo(repo.cloneUrl, repo.ref, cachePaths.repoDir, writable, options?.credential);
             }
             // Touch index file to track freshness
             fs.writeFileSync(cachePaths.indexPath, "[]", { encoding: "utf8", mode: 0o600 });
@@ -106,6 +112,7 @@ export async function syncMirroredRepo(config, options) {
         requireRepoDir: true,
         writable: options?.writable ?? config.writable === true,
         force: options?.force,
+        credential: options?.credential,
     });
     const syncedAt = (options?.now ?? new Date()).toISOString();
     const contentDir = cachePaths.repoDir;
@@ -121,12 +128,12 @@ export async function syncMirroredRepo(config, options) {
         syncedAt,
     };
 }
-function pullRepo(repoDir) {
+function pullRepo(repoDir, credential) {
     const status = runGit(["-C", repoDir, "status", "--porcelain"]);
     if (status.status !== 0 || status.stdout.trim()) {
         throw new UsageError(`Writable Git source at ${repoDir} has uncommitted changes; refusing to update it.`);
     }
-    const relation = inspectGitUpstream(repoDir);
+    const relation = inspectGitUpstream(repoDir, credential);
     if (relation.behind > 0 && relation.upstream) {
         if (relation.ahead > 0) {
             throw new UsageError(`Writable Git source at ${repoDir} has unpushed commits; refusing to update it.`);

package/dist/sources/providers/git-stash.js

@@ -120,30 +120,44 @@ export function saveGitStash(name, message, writableOverride, options) {
     let managedContentRoot;
     if (name) {
         const config = loadConfig();
-        const stash = findGitStashByTarget(getSources(config), name);
+        const stash = findSyncStashByTarget(getSources(config), name);
         // NotFoundError (exit 1), not UsageError (exit 2): the argument is
         // well-formed, the bundle just isn't configured.
         if (!stash)
-            throw new NotFoundError(`No git bundle found with name "${name}"`, "SOURCE_NOT_FOUND");
-        if (stash.type !== "git") {
-            throw new UsageError(`Stash "${name}" is not a git stash (type: ${stash.type})`);
+            throw new NotFoundError(`No git-backed bundle found with name "${name}"`, "SOURCE_NOT_FOUND");
+        if (stash.enabled === false) {
+            throw new UsageError(`Bundle "${name}" is disabled and cannot be synced.`, "INVALID_FLAG_VALUE");
         }
-        const lockedRoot = lockContentRootFor(stash.name, stash.type);
-        if (lockedRoot) {
-            const topLevel = runGit(["-C", lockedRoot, "rev-parse", "--show-toplevel"]);
+        if (stash.type === "filesystem") {
+            if (!stash.path)
+                throw new UsageError(`Filesystem bundle "${name}" has no path configured.`);
+            const contentRoot = path.resolve(stash.path);
+            const topLevel = runGit(["-C", contentRoot, "rev-parse", "--show-toplevel"]);
             if (topLevel.status !== 0 || !topLevel.stdout.trim()) {
-                throw new UsageError(`Managed Git stash "${name}" is not a checkout at ${lockedRoot}`);
+                throw new UsageError(`Filesystem bundle "${name}" is not a Git working tree at ${contentRoot}.`);
             }
             repoDir = path.resolve(topLevel.stdout.trim());
-            managedContentRoot = path.resolve(lockedRoot);
+            managedContentRoot = contentRoot;
+            writable = stash.writable !== false;
         }
         else {
-            if (!stash.url)
-                throw new UsageError(`Stash "${name}" has no URL configured`);
-            const repo = parseGitRepoUrl(stash.url);
-            repoDir = getCachePaths(repo.canonicalUrl).repoDir;
+            const lockedRoot = lockContentRootFor(stash.name, stash.type);
+            if (lockedRoot) {
+                const topLevel = runGit(["-C", lockedRoot, "rev-parse", "--show-toplevel"]);
+                if (topLevel.status !== 0 || !topLevel.stdout.trim()) {
+                    throw new UsageError(`Managed Git stash "${name}" is not a checkout at ${lockedRoot}`);
+                }
+                repoDir = path.resolve(topLevel.stdout.trim());
+                managedContentRoot = path.resolve(lockedRoot);
+            }
+            else {
+                if (!stash.url)
+                    throw new UsageError(`Stash "${name}" has no URL configured`);
+                const repo = parseGitRepoUrl(stash.url);
+                repoDir = getCachePaths(repo.canonicalUrl).repoDir;
+            }
+            writable = stash.writable === true;
         }
-        writable = stash.writable === true;
     }
     else {
         // Honour an explicit primary-stash dir override (keeps the improve gate and
@@ -554,8 +568,16 @@ function createExactPathCommit(repoDir, options) {
         fs.rmSync(`${temporaryIndex}.lock`, { force: true });
     }
 }
-function findGitStashByTarget(stashes, target) {
-    return stashes.find((stash) => matchesGitStashTarget(stash, target));
+function findSyncStashByTarget(stashes, target) {
+    return stashes.find((stash) => {
+        if (stash.type === "git")
+            return matchesGitStashTarget(stash, target);
+        if (stash.type !== "filesystem")
+            return false;
+        if (stash.name === target || stash.path === target)
+            return true;
+        return stash.path !== undefined && path.resolve(stash.path) === path.resolve(target);
+    });
 }
 function matchesGitStashTarget(stash, target) {
     if (stash.type !== "git")

package/dist/sources/snapshot-fetchers/website-ingest.js

@@ -324,7 +324,7 @@ async function scrapeWebsiteToStash(startUrl, stashDir, options) {
 export async function fetchWebsiteMarkdownSnapshot(rawUrl, options) {
     const normalizedUrl = validateWebsiteInputUrl(rawUrl, { allowPrivateHosts: options?.allowPrivateHosts });
     const parsedUrl = new URL(normalizedUrl);
-    const allowPrivateHosts = await resolveAllowPrivateStartHost(parsedUrl, options?.allowPrivateHosts);
+    const allowPrivateHosts = await resolveAllowPrivateStartHost(parsedUrl, options?.allowPrivateHosts, options?.resolveHostname);
     const stashDir = resolveFetcherStashDir(options?.stashDir);
     const context = {
         stashDir: stashDir ?? "",
@@ -524,11 +524,11 @@ async function assertStartUrlAllowedByRobots(robots, start, rawStartUrl) {
  * before it ever reaches a guard, so this never extends trust to a host the
  * fetched content merely points at.
  */
-async function resolveAllowPrivateStartHost(start, requested) {
+async function resolveAllowPrivateStartHost(start, requested, resolveHostname) {
     if (requested)
         return true;
     try {
-        await assertResolvedHostAllowed(start.hostname);
+        await assertResolvedHostAllowed(start.hostname, { resolveHostname });
         return false;
     }
     catch {

package/dist/storage/repositories/index-vec-repository.js

@@ -106,6 +106,106 @@ export function isVecFastPathComplete(db) {
         return false;
     }
 }
+/**
+ * Reconcile sqlite-vec's derived mirror from the durable BLOB embeddings.
+ *
+ * This never calls an embedding provider and never mutates the BLOB table.
+ * The readiness flag is lowered before the first mutation and is promoted only
+ * after a bidirectional aggregate check proves both ID sets match exactly.
+ */
+export function repairVecFastPath(db, embeddingDim) {
+    let repaired = 0;
+    let removedOrphans = 0;
+    let rejected = 0;
+    setVecFastPathReady(db, false);
+    if (!isVecAvailable(db) || !hasVecTable(db)) {
+        return { available: false, repaired, removedOrphans, rejected, complete: false };
+    }
+    if (!Number.isInteger(embeddingDim) || embeddingDim <= 0) {
+        return {
+            available: true,
+            repaired,
+            removedOrphans,
+            rejected,
+            complete: false,
+            error: `Invalid embedding dimension ${embeddingDim}.`,
+        };
+    }
+    try {
+        while (true) {
+            const orphanIds = db
+                .prepare(`
+          SELECT id FROM entries_vec
+          EXCEPT
+          SELECT id FROM embeddings
+          ORDER BY id
+          LIMIT ?
+        `)
+                .all(SQLITE_CHUNK_SIZE);
+            if (orphanIds.length === 0)
+                break;
+            db.transaction(() => {
+                const remove = db.prepare("DELETE FROM entries_vec WHERE id = ?");
+                for (const { id } of orphanIds) {
+                    remove.run(id);
+                    removedOrphans++;
+                }
+            })();
+        }
+        let afterId = -1;
+        while (true) {
+            const missingIds = db
+                .prepare(`
+          SELECT id FROM (
+            SELECT id FROM embeddings
+            EXCEPT
+            SELECT id FROM entries_vec
+          ) AS missing
+          WHERE id > ?
+          ORDER BY id
+          LIMIT ?
+        `)
+                .all(afterId, SQLITE_CHUNK_SIZE);
+            if (missingIds.length === 0)
+                break;
+            afterId = missingIds[missingIds.length - 1].id;
+            const placeholders = missingIds.map(() => "?").join(",");
+            const rows = db
+                .prepare(`SELECT id, embedding FROM embeddings WHERE id IN (${placeholders}) ORDER BY id`)
+                .all(...missingIds.map(({ id }) => id));
+            db.transaction(() => {
+                const insert = db.prepare("INSERT INTO entries_vec (id, embedding) VALUES (?, ?)");
+                for (const row of rows) {
+                    if (row.embedding.byteLength !== embeddingDim * 4) {
+                        rejected++;
+                        continue;
+                    }
+                    try {
+                        insert.run(row.id, Buffer.from(row.embedding));
+                        repaired++;
+                    }
+                    catch {
+                        rejected++;
+                    }
+                }
+            })();
+        }
+        const complete = rejected === 0 && isVecFastPathComplete(db);
+        setVecFastPathReady(db, complete);
+        return { available: true, repaired, removedOrphans, rejected, complete };
+    }
+    catch (error) {
+        setVecFastPathReady(db, false);
+        return {
+            available: true,
+            repaired,
+            removedOrphans,
+            rejected,
+            complete: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
 const vecTablePresent = new WeakMap();
 /**
  * Whether `entries_vec` exists on this connection, memoized per handle.

package/dist/tasks/activation-config.js

@@ -0,0 +1,90 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { bundleRefToString, parseBundleRef } from "../core/asset/asset-ref.js";
+import { deriveBundleId } from "../core/bundle-id.js";
+import { resolveStashDir } from "../core/common.js";
+import { mutateConfig } from "../core/config/config.js";
+import { bundleSourceId, filesystemBundleSourceId, isBundleEnabled } from "../core/config/config-sources.js";
+import { UsageError } from "../core/errors.js";
+export function canonicalSchedulerActivationRef(ref) {
+    const parsed = parseBundleRef(ref);
+    if (!parsed.bundle || parsed.fragment !== undefined || bundleRefToString(parsed) !== ref) {
+        throw new UsageError(`Scheduler activation requires a canonical fully-qualified ref, got ${JSON.stringify(ref)}.`, "INVALID_FLAG_VALUE");
+    }
+    return ref;
+}
+export function schedulerActivations(config) {
+    return Object.freeze((config.scheduler?.enabled ?? []).map((activation) => Object.freeze({
+        kind: activation.kind,
+        ref: canonicalSchedulerActivationRef(activation.ref),
+        sourceId: activation.sourceId,
+    })));
+}
+export function isSchedulerRefEnabled(config, kind, ref) {
+    const canonicalRef = canonicalSchedulerActivationRef(ref);
+    const bundle = parseBundleRef(canonicalRef).bundle;
+    const currentSourceId = schedulerActivationSourceId(config, bundle);
+    if (!currentSourceId)
+        return false;
+    return schedulerActivations(config).some((activation) => activation.kind === kind && activation.ref === canonicalRef && activation.sourceId === currentSourceId);
+}
+/** Grants that still name the same active source installation they approved. */
+export function activeSchedulerActivations(config) {
+    return schedulerActivations(config).filter((activation) => {
+        const bundle = parseBundleRef(activation.ref).bundle;
+        return activation.sourceId === schedulerActivationSourceId(config, bundle);
+    });
+}
+/** Pure lifecycle helper used when a bundle is removed or replaced. */
+export function revokeSchedulerActivationsForBundle(config, bundleId) {
+    const enabled = schedulerActivations(config).filter((activation) => parseBundleRef(activation.ref).bundle !== bundleId);
+    if (enabled.length === (config.scheduler?.enabled ?? []).length)
+        return config;
+    return { ...config, scheduler: { ...config.scheduler, enabled } };
+}
+export function setSchedulerRefEnabled(kind, ref, enabled) {
+    let canonicalRef = ref;
+    const result = mutateConfig((current) => {
+        canonicalRef = canonicalSchedulerActivationRef(ref);
+        const existing = schedulerActivations(current);
+        const bundle = parseBundleRef(canonicalRef).bundle;
+        const sourceId = enabled ? schedulerActivationSourceId(current, bundle) : undefined;
+        if (enabled && !sourceId) {
+            throw new UsageError(`Cannot enable scheduled execution from inactive or unconfigured bundle ${JSON.stringify(bundle)}.`, "INVALID_FLAG_VALUE");
+        }
+        const present = existing.some((activation) => activation.kind === kind && activation.ref === canonicalRef && (!enabled || activation.sourceId === sourceId));
+        if (present === enabled)
+            return current;
+        const next = enabled
+            ? [
+                ...existing.filter((activation) => activation.kind !== kind || activation.ref !== canonicalRef),
+                { kind, ref: canonicalRef, sourceId: sourceId },
+            ]
+            : existing.filter((activation) => activation.kind !== kind || activation.ref !== canonicalRef);
+        next.sort((left, right) => left.ref.localeCompare(right.ref) || left.kind.localeCompare(right.kind));
+        return {
+            ...current,
+            scheduler: {
+                ...current.scheduler,
+                enabled: next,
+            },
+        };
+    });
+    return { config: result.config, changed: result.written, ref: canonicalRef };
+}
+/** Current active source identity for a configured or environment-only bundle. */
+export function schedulerActivationSourceId(config, bundleId) {
+    if (isBundleEnabled(config, bundleId))
+        return bundleSourceId(config, bundleId);
+    if (config.bundles?.[bundleId] !== undefined || !process.env.AKM_BUNDLE_DIR?.trim())
+        return undefined;
+    try {
+        const root = resolveStashDir();
+        const implicitId = deriveBundleId(undefined, root, new Set(Object.keys(config.bundles ?? {})));
+        return implicitId === bundleId ? filesystemBundleSourceId(root) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/tasks/backends/cron.js

@@ -41,6 +41,7 @@ import { nodeFs, throwIfNotOk } from "./exec-utils.js";
 const BEGIN = (id) => `# akm:task ${assertCronValue(id)} BEGIN`;
 const END = (id) => `# akm:task ${assertCronValue(id)} END`;
 const DISABLED_PREFIX = "# akm:disabled ";
+const SOURCE_ENABLED_PREFIX = "# akm:source-enabled ";
 const BLOCK_RE = /^# akm:task ([\w.@:_-]+) BEGIN$/;
 const BLOCK_END_RE = /^# akm:task ([\w.@:_-]+) END$/;
 export const PORTABLE_CRON_LINE_LIMIT = 1000;
@@ -216,6 +217,7 @@ function inspectCronState(crontab, fallbackContextPath) {
             continue;
         const ref = {
             id: schedulerLogicalBindingId(id, parsed.invocation),
+            enabled: !cronIsDisabled(body),
             signature: fingerprint,
             ...(parsed.target !== undefined ? { target: parsed.target } : {}),
             binding: parsed.binding,
@@ -438,9 +440,16 @@ function normalizeSignature(body) {
     return body
         .split(/\r?\n/)
         .map((l) => l.trim())
+        .filter((l) => !stripDisabledPrefix(l).startsWith(SOURCE_ENABLED_PREFIX))
         .filter((l) => l.length > 0)
         .join("\n");
 }
+function stripDisabledPrefix(line) {
+    return line.startsWith(DISABLED_PREFIX) ? line.slice(DISABLED_PREFIX.length) : line;
+}
+function cronIsDisabled(body) {
+    return body.trimStart().startsWith(DISABLED_PREFIX);
+}
 export function upsertBlock(existing, id, block) {
     const trimmed = existing.replace(/\s+$/g, "");
     const removed = removeBlock(trimmed, id);

package/dist/tasks/backends/launchd.js

@@ -557,6 +557,7 @@ function inspectStableLaunchdNamespace(seedIds, context) {
             continue;
         installed.push(withInstalledInvocation({
             id: schedulerLogicalBindingId(entry.nativeId, parsed.invocation),
+            enabled: entry.enabled && entry.loaded,
             ...(entry.loaded ? { signature: entry.artifact.fingerprint } : {}),
             ...(parsed.target !== undefined ? { target: parsed.target } : {}),
             binding: parsed.binding,

package/dist/tasks/backends/schtasks.js

@@ -257,8 +257,10 @@ function inspectSchtasksState(exec, folder, taskName) {
         const parsed = extractSchtasksInvocation(query.stdout);
         if (!parsed)
             continue;
+        const enabled = taskXmlEnabled(query.stdout);
         const ref = {
             id: schedulerLogicalBindingId(nativeId, parsed.invocation),
+            ...(enabled !== undefined ? { enabled } : {}),
             ...(artifact.fingerprint !== undefined ? { signature: artifact.fingerprint } : {}),
             ...(parsed.target !== undefined ? { target: parsed.target } : {}),
             binding: parsed.binding,