akm-cli 0.9.17-alpha.3 → 0.9.17-alpha.5

package/dist/tasks/prepare/prepare-support.js

@@ -1,24 +1,14 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * File-private helpers prepareTaskV3Execution depends on, moved body-intact
- * out of the pre-P1b src/tasks/runtime-v3.ts (spec
- * docs/plans/specs/p1b-model-extraction.md §4.1, Lane B / D4 module map).
- * None of these was exported at head either; only the subset prepare.ts's
- * moved function body calls is exported here.
- */
-import path from "node:path";
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { COMPOSITION_INVALID_MULTI_JOB_HINT, ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
 import { isPortableExecutionAgentSelector } from "../../execution/source.js";
-import { requireAuthorizedExecutionPlan } from "../../integrations/agent/execution-cascade.js";
-import { lowerResolvedExecutionRequest } from "../../integrations/agent/execution-lowering.js";
+import { buildExecution } from "../../integrations/agent/execution.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
+import { checkWorkflowPlan, compileWorkflowSource } from "../../workflows/compile.js";
 import { detectSecretShapedParams } from "../../workflows/exec/param-secrets.js";
-import { compileWorkflowPlan } from "../../workflows/ir/compile.js";
-import { compileWorkflowSource } from "../../workflows/source-ir/compile.js";
 import { isInferredSecretName } from "../log-redaction.js";
 import { SCHEDULED_TASK_CONTEXT_KEYS } from "../scheduler-invocation.js";
 function own(value, key) {
@@ -118,14 +108,14 @@ export function defaultTaskShell(platform) {
     return platform === "win32" ? "powershell" : "sh";
 }
 export function validatePreparedCommand(invocation, context) {
-    const request = requireAuthorizedExecutionPlan(invocation.plan);
+    const { request } = invocation;
     if (!request.engine.name) {
         throw new ConfigError(`Task ${JSON.stringify(context.taskRef)} has no resolved execution engine. Configure defaults.engine or akm.engine before running it.`, "INVALID_CONFIG_FILE");
     }
     // Lowering is pure. Running it before the durable-attempt boundary proves
     // the selected target is transport-projectable; dispatch repeats the same
     // deterministic projection from this frozen request/config snapshot.
-    lowerResolvedExecutionRequest(request, invocation.config);
+    buildExecution(request, invocation.runner);
     return invocation;
 }
 export function validateWorkflowRuntimeSource(file, workspaceRoot, readFile) {
@@ -141,7 +131,7 @@ export function validateWorkflowRuntimeSource(file, workspaceRoot, readFile) {
         const code = isMultiJob ? "COMPOSITION_INVALID" : "WORKFLOW_SOURCE_INVALID";
         throw new UsageError(`Task workflow target is not projectable: ${detail}`, code, isMultiJob ? COMPOSITION_INVALID_MULTI_JOB_HINT : undefined);
     }
-    const planned = compileWorkflowPlan(compiled.ir, path.basename(file, path.extname(file)));
+    const planned = checkWorkflowPlan(compiled.plan);
     if (!planned.ok) {
         // Same mapping applied for consistency; `compiled.ir` is already
         // guaranteed exactly one job here, so this arm always resolves to

package/dist/tasks/prepare/prepare.js

@@ -54,7 +54,6 @@ export async function prepareTaskV3Execution(document, context) {
         const invocation = validatePreparedCommand(await (context.prepareCommand ?? prepareCommandInvocation)({
             action,
             config: context.config,
-            invocationKind: "task",
             current: currentExecutionValues(document, context, commandEnvironment),
             ...(context.commandSourceLoader ? { sourceLoader: context.commandSourceLoader } : {}),
         }), context);
@@ -71,7 +70,6 @@ export async function prepareTaskV3Execution(document, context) {
         const invocation = validatePreparedCommand(await (context.prepareCommand ?? prepareCommandInvocation)({
             action: { ref: qualified },
             config: context.config,
-            invocationKind: "task",
             current: currentExecutionValues(document, context, commandEnvironment),
             ...(context.commandSourceLoader ? { sourceLoader: context.commandSourceLoader } : {}),
         }), context);

package/dist/tasks/resolve-akm-bin.js

@@ -10,17 +10,16 @@
  * Resolution order:
  *
  *   1. `process.execPath` alone for a Bun standalone executable.
- *   2. Absolute Node plus the public `dist/akm` package launcher — eligible
- *      when it is the active npm global install, or when this process
- *      cannot write to the directory containing it (a read-only mount, e.g.
- *      an image-baked install, gives the same "won't change out from under
- *      the scheduler" guarantee npm-global ownership does).
- *   3. Absolute runtime plus the source/build CLI entry, classified as a
- *      checkout that requires explicit `--rebind` for scheduler writes.
+ *   2. Absolute Node plus the public `dist/akm` package launcher.
+ *   3. Absolute runtime plus the source/build CLI entry of a checkout.
+ *
+ * `via` names which one was used. `checkout` — a package launcher inside a
+ * git work tree, or a source/build entry — runs whatever the checkout holds
+ * when the scheduler fires; `task sync` says so once when it writes one.
  *
  * Returns the argv array the scheduler should execute (e.g.
- * `["/usr/local/bin/node", "/repo/dist/cli-node.mjs"]`). The caller appends
- * subcommand args (`"task", "run", "<id>"`).
+ * `["/usr/local/bin/node", "/usr/lib/node_modules/akm-cli/dist/akm"]`). The
+ * caller appends subcommand args (`"task", "run", "<id>"`).
  */
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
@@ -28,6 +27,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { ConfigError } from "../core/errors.js";
 import { mainPath as runtimeMainPath } from "../runtime.js";
+/** A source entry or local build run by a runtime: `src/cli.ts`, `dist/cli.js`, `dist/cli-node.mjs`. */
+const CHECKOUT_ENTRY = /(?:^|[\\/])src[\\/]cli\.ts$|(?:^|[\\/])dist[\\/](?:cli\.js|cli-node\.mjs)$/i;
 /** True only for Bun's virtual main path inside a compiled standalone executable. */
 export function isBunStandaloneMain(mainPath = runtimeMainPath) {
     return (mainPath?.startsWith("/$bunfs/") === true || (mainPath !== undefined && /^[A-Za-z]:[\\/]~BUN[\\/]/i.test(mainPath)));
@@ -37,44 +38,27 @@ export function resolveAkmInvocation(options = {}) {
     const runtime = options.runtime ?? (process.versions.bun ? "bun" : "node");
     const execPath = options.execPath ?? process.execPath;
     const mainPath = options.mainPath ?? runtimeMainPath;
-    const isStandaloneMain = isBunStandaloneMain(mainPath);
-    if (runtime === "bun" && isStandaloneMain && execPath) {
-        return { argv: [absoluteInvocationPath(execPath)], via: "standalone", kind: "standalone", eligible: true };
+    if (runtime === "bun" && isBunStandaloneMain(mainPath) && execPath) {
+        return { argv: [absoluteInvocationPath(execPath)], via: "standalone" };
     }
     const launcherPath = options.launcherPath ?? env.AKM_LAUNCHER_PATH?.trim();
     const nodePath = options.nodePath ?? env.AKM_LAUNCHER_NODE?.trim() ?? (runtime === "node" ? execPath : undefined);
     if (launcherPath && nodePath && isPublicPackageLauncher(launcherPath)) {
-        const checkout = isCheckoutLauncher(launcherPath);
-        let npmGlobalRoot;
-        if (!checkout) {
-            try {
-                npmGlobalRoot = (options.resolveNpmGlobalRoot ?? ((node) => resolveNpmGlobalRoot(node, env)))(nodePath);
-            }
-            catch {
-                // An unprovable package installation is intentionally ineligible.
-            }
-        }
-        const npmGlobal = !checkout && packageBelongsToNpmGlobalRoot(launcherPath, npmGlobalRoot);
-        const readOnlyInstall = !checkout && !npmGlobal && !(options.isPathWritable ?? isPathWritable)(path.dirname(launcherPath));
-        const kind = checkout ? "checkout" : npmGlobal ? "npm" : "package-local";
         return {
             argv: [absoluteInvocationPath(nodePath), absoluteInvocationPath(launcherPath)],
-            via: kind,
-            kind,
-            eligible: npmGlobal || readOnlyInstall,
+            via: isCheckoutLauncher(launcherPath) ? "checkout" : "npm",
         };
     }
     const checkoutEntry = resolveCheckoutEntry(options.cliEntryUrl ?? import.meta.url, runtime, mainPath);
     if (checkoutEntry && execPath) {
-        return {
-            argv: [absoluteInvocationPath(execPath), absoluteInvocationPath(checkoutEntry)],
-            via: "checkout",
-            kind: "checkout",
-            eligible: false,
-        };
+        return { argv: [absoluteInvocationPath(execPath), absoluteInvocationPath(checkoutEntry)], via: "checkout" };
     }
     throw new ConfigError("Cannot resolve absolute path to the akm binary for scheduler registration.", "INVALID_CONFIG_FILE", "Run the npm-global launcher or a standalone akm executable.");
 }
+/** Whether an installed launcher argv runs akm out of a source checkout. */
+export function isCheckoutInvocation(argv) {
+    return argv.some((part) => CHECKOUT_ENTRY.test(part) || (isPublicPackageLauncher(part) && isCheckoutLauncher(part)));
+}
 function resolveCheckoutEntry(moduleUrl, runtime, mainPath) {
     try {
         const modulePath = fileURLToPath(moduleUrl);
@@ -111,6 +95,7 @@ function isPublicPackageLauncher(file) {
         path.basename(path.dirname(file)).toLowerCase() === "dist" &&
         fs.existsSync(file));
 }
+/** A package launcher whose package root is a git work tree (`npm link`, a local clone). */
 function isCheckoutLauncher(file) {
     let launcher = path.resolve(file);
     try {
@@ -122,52 +107,8 @@ function isCheckoutLauncher(file) {
     const packageRoot = path.dirname(path.dirname(launcher));
     return fs.existsSync(path.join(packageRoot, ".git"));
 }
-/** Whether this process can write to `dir` — false also covers a read-only mount. */
-function isPathWritable(dir) {
-    try {
-        fs.accessSync(dir, fs.constants.W_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function packageBelongsToNpmGlobalRoot(launcherPath, npmGlobalRoot) {
-    if (!npmGlobalRoot)
-        return false;
-    try {
-        const packageRoot = path.dirname(path.dirname(fs.realpathSync(launcherPath)));
-        const globalRoot = fs.realpathSync(npmGlobalRoot);
-        const metadata = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
-        return metadata.name === "akm-cli" && samePath(path.dirname(packageRoot), globalRoot);
-    }
-    catch {
-        return false;
-    }
-}
-function samePath(left, right) {
-    const normalize = (value) => {
-        const resolved = path.resolve(value);
-        return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-    };
-    return normalize(left) === normalize(right);
-}
-// #901: the global root can't change within a process lifetime, and every
-// `resolveAkmInvocation()` call in a scheduler-sync process re-derives the
-// same `nodePath` — so this spawns `npm root --global` at most once per
-// process instead of once per call. Keyed by nodePath (rather than a bare
-// once-only flag) so a differently-invoked probe later in the same process
-// still gets its own answer instead of a stale one.
-let cachedNpmGlobalRoot;
+/** `npm root --global` for the npm that ships with `nodePath`; `akm upgrade` uses it to detect a global install. */
 export function resolveNpmGlobalRoot(nodePath, env) {
-    if (cachedNpmGlobalRoot && cachedNpmGlobalRoot.nodePath === nodePath) {
-        return cachedNpmGlobalRoot.value;
-    }
-    const value = resolveNpmGlobalRootUncached(nodePath, env);
-    cachedNpmGlobalRoot = { nodePath, value };
-    return value;
-}
-function resolveNpmGlobalRootUncached(nodePath, env) {
     const npmCli = resolveAssociatedNpmCli(nodePath);
     if (!npmCli)
         return undefined;

package/dist/tasks/run/attempt-lifecycle.js

@@ -105,7 +105,6 @@ const SAFE_TASK_ATTEMPT_ERROR_CODES = new Set([
     "STASH_DIR_UNREADABLE",
     "LLM_NOT_CONFIGURED",
     "INVALID_CONFIG_FILE",
-    "UNSUPPORTED_CONFIG_VERSION",
     "TEST_ISOLATION_MISSING",
     "INVALID_FLAG_VALUE",
     "MISSING_REQUIRED_ARGUMENT",

package/dist/tasks/scheduler-binding.js

@@ -2,12 +2,12 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Secret-free input to every native scheduler backend.
+ * Secret-free input to every native scheduler backend, and the backend
+ * contract itself.
  *
- * The binding deliberately contains only stable source identity, trigger
- * identity, and the public CLI tail. Source content, action inputs,
- * environment values, resolved requests, and credentials must never cross
- * this boundary or be persisted by an OS scheduler.
+ * A binding carries only stable source identity, trigger identity, and the
+ * public CLI tail. Source content, action inputs, environment values, and
+ * credentials never cross this boundary or reach an OS scheduler.
  */
 import { createHash } from "node:crypto";
 import { bundleRefToString, parseBundleRef } from "../core/asset/asset-ref.js";
@@ -20,20 +20,8 @@ export function compileTaskSchedulerBindings(input) {
     const bundle = parseBundleRef(ref).bundle;
     if (!bundle)
         throw new Error("invariant: qualified scheduler task ref lost its bundle");
-    // P2b Lane B (B-N3): the invocation is compiled PER schedule entry now —
-    // each entry's own `inputs` produces its own trailing flag tail, so it can
-    // no longer be hoisted as one binding shared by every entry.
     return Object.freeze(input.schedules.map((schedule) => {
         const bindingId = schedule.ordinal === 0 ? id : digestBindingId("task", ref, schedule.ordinal);
-        const invocation = Object.freeze([
-            "task",
-            "run",
-            id,
-            "--bundle",
-            bundle,
-            "--scheduled",
-            ...schedulerInputFlagTail(schedule.inputs),
-        ]);
         return freezeBinding({
             id: bindingId,
             nativeId: schedulerNativeBindingId(bindingId),
@@ -42,39 +30,21 @@ export function compileTaskSchedulerBindings(input) {
             source: schedule.source,
             ordinal: schedule.ordinal,
             enabled: true,
-            invocation,
+            invocation: ["task", "run", id, "--bundle", bundle, "--scheduled", ...schedulerInputFlagTail(schedule.inputs)],
         });
     }));
 }
 /**
  * The canonically-sorted `--<name> <value>` flag tail for one schedule
- * entry's `inputs` (spec §1.7 B-N3). Empty/absent `inputs` yields an empty
- * tail — the fixed six-token invocation, byte-identical to every schedule
- * entry before P2b (B-03).
- *
- * Code-review finding (scheduler-binding.ts:536): a value whose exact text
- * begins with `-` (a negative number, or a string that just happens to
- * start with a dash) is indistinguishable from a NEW flag in the two-token
- * `--<name> <value>` form — `isValidSchedulerInputFlagTail`
- * (scheduler-invocation.ts) refuses it outright, and even a looser parser
- * would still be wrong for a non-numeric dash-leading string: the real `akm
- * task run` flag parser (`parseTaskInputFlags`, tasks-cli.ts) only
- * special-cases a dash-DIGIT lead, so it would silently treat `--scope
- * -urgent` as the boolean flag `--scope` followed by an orphaned,
- * dropped `-urgent` token. The inline `--<name>=<value>` form has no such
- * ambiguity on EITHER side — `isValidSchedulerInputFlagTail` accepts it
- * unconditionally, and `parseTaskInputFlags`'s own inline-`=` branch splits
- * on the first `=` without ever inspecting the value's leading character —
- * so it is used whenever the value's exact text would otherwise be
- * ambiguous. Every other value keeps the existing two-token form
- * byte-identical to before this fix (B-03/B-45).
+ * entry's `inputs`. A value whose text starts with `-` uses the inline
+ * `--<name>=<value>` form, the only spelling `parseTaskInputFlags` cannot
+ * mistake for a flag.
  */
 function schedulerInputFlagTail(inputs) {
     if (!inputs)
         return [];
-    const names = Object.keys(inputs).sort();
     const tail = [];
-    for (const name of names) {
+    for (const name of Object.keys(inputs).sort()) {
         const text = schedulerInputFlagValueText(inputs[name]);
         if (text.startsWith("-"))
             tail.push(`--${name}=${text}`);
@@ -83,14 +53,6 @@ function schedulerInputFlagTail(inputs) {
     }
     return tail;
 }
-/**
- * One input value's argv text. A scalar is its exact text — `String(value)`
- * for a number/boolean (a `true` boolean is `"true"`, never a bare flag, so
- * the tail round-trips through one parser), the string itself for a string.
- * An object/array value is its `canonicalInputJson` text, which
- * `materializeInputFlags`'s JSON-shorthand path already coerces back through
- * the declaration.
- */
 function schedulerInputFlagValueText(value) {
     if (typeof value === "string")
         return value;
@@ -100,7 +62,6 @@ function schedulerInputFlagValueText(value) {
 }
 export function compileWorkflowSchedulerBindings(input) {
     const ref = assertQualifiedRef(input.qualifiedRef, "workflow");
-    const invocation = Object.freeze(["workflow", "run", ref]);
     return Object.freeze(input.schedules.map((schedule) => {
         const bindingId = digestBindingId("workflow", ref, schedule.ordinal);
         return freezeBinding({
@@ -111,23 +72,14 @@ export function compileWorkflowSchedulerBindings(input) {
             source: schedule.source,
             ordinal: schedule.ordinal,
             enabled: true,
-            invocation,
-            ...(input.executionEvidenceDigest !== undefined
-                ? { executionEvidenceDigest: assertSchedulerExecutionEvidenceDigest(input.executionEvidenceDigest) }
-                : {}),
+            invocation: ["workflow", "run", ref],
         });
     }));
 }
-export function assertSchedulerExecutionEvidenceDigest(value) {
-    if (!/^[a-f0-9]{64}$/u.test(value)) {
-        throw new UsageError("Scheduler workflow execution evidence must be a lowercase SHA-256 digest.", "INVALID_FLAG_VALUE");
-    }
-    return value;
-}
 /**
  * Map a logical binding id to the flat portable token persisted by native
- * schedulers. Existing flat ids are byte-for-byte stable; only standalone
- * component-relative ids need an encoded native spelling.
+ * schedulers. Flat ids are byte-for-byte stable; only nested standalone
+ * component ids need an encoded native spelling.
  */
 export function schedulerNativeBindingId(id) {
     if (!id.includes("/"))
@@ -138,183 +90,17 @@ export function schedulerNativeBindingId(id) {
         .slice(0, 32);
     return `task-${digest}`;
 }
-/** Portable collision key for scheduler namespaces with Windows semantics. */
-export function schedulerNativeArtifactKey(nativeId) {
-    return nativeId.toLowerCase().replace(/\.+$/u, "");
-}
-export function schedulerNativeArtifactsForKey(artifacts, nativeId) {
-    const key = schedulerNativeArtifactKey(nativeId);
-    return artifacts.filter((artifact) => schedulerNativeArtifactKey(artifact.nativeId) === key);
-}
-export function assertSchedulerNativeArtifactCardinality(artifacts, nativeId, expectedCount) {
-    const matches = schedulerNativeArtifactsForKey(artifacts, nativeId);
-    if (matches.length !== expectedCount) {
-        const expectedState = expectedCount === 0 ? "absence" : "one present owner";
-        throw new UsageError(`Native scheduler artifact ${JSON.stringify(nativeId)} changed: normalized cardinality ${matches.length} violates the expected ${expectedState} before mutation.`, "RESOURCE_ALREADY_EXISTS");
-    }
-    return matches[0];
-}
-/** Return a logical owner only when the public invocation proves the mapping. */
-export function schedulerLogicalBindingOwner(nativeId, invocation) {
-    return schedulerNativeArtifactOwner(nativeId, invocation)?.logicalId;
-}
-export function schedulerNativeArtifactOwner(nativeId, invocation) {
-    if (invocation[0] === "workflow" && invocation[1] === "run" && invocation.length === 3) {
-        const ref = invocation[2];
-        if (ref && workflowRefDigestsToNativeId(ref, nativeId)) {
-            return { logicalId: nativeId, logicalKind: "workflow" };
-        }
-        return undefined;
-    }
-    const taskId = invocation[0] === "task" && invocation[1] === "run" ? invocation[2] : undefined;
-    if (!taskId)
-        return undefined;
-    return {
-        logicalId: schedulerNativeBindingId(taskId) === nativeId ? taskId : nativeId,
-        logicalKind: "task",
-    };
-}
-export function assertSchedulerNativeArtifactOwner(nativeId, intended, invocation) {
-    const intendedNativeId = intended.nativeId ?? schedulerNativeBindingId(intended.id);
-    if (nativeId === intendedNativeId && invocation && sameInvocation(invocation, intended.invocation))
-        return;
-    const description = invocation ? JSON.stringify(invocation) : "an unproven or malformed invocation";
-    throw new UsageError(`Native scheduler artifact ${JSON.stringify(nativeId)} belongs to ${description}, not the exact ${intended.logicalSource.kind} owner ${JSON.stringify(intended.logicalSource.ref)} with binding ${JSON.stringify(intended.id)}.`, "RESOURCE_ALREADY_EXISTS");
-}
-/** Recover binding identity without treating the native hash as source ownership. */
-export function schedulerLogicalBindingId(nativeId, invocation) {
-    return schedulerLogicalBindingOwner(nativeId, invocation) ?? nativeId;
-}
 export function schedulerBindingNativeId(binding) {
     return binding.nativeId ?? schedulerNativeBindingId(binding.id);
 }
-export function assertSchedulerRemovalArtifact(nativeId, expected, invocation, fingerprint) {
-    const normalized = normalizeRemovalExpectation(expected);
-    assertSchedulerExpectationIdentity(normalized);
-    const fingerprintMatches = normalized.fingerprint === undefined || normalized.fingerprint === fingerprint;
-    if (nativeId === normalized.nativeId &&
-        invocation !== undefined &&
-        sameInvocation(invocation, normalized.invocation) &&
-        fingerprintMatches) {
-        return;
-    }
-    throw new UsageError(`Native scheduler artifact ${JSON.stringify(nativeId)} changed owner or fingerprint; refusing to remove an unverified ${normalized.logicalSource.kind} owner ${JSON.stringify(normalized.logicalSource.ref)}.`, "RESOURCE_ALREADY_EXISTS");
-}
-export function assertSchedulerExpectationIdentity(expected, binding) {
-    const identity = canonicalSchedulerIdentity(expected.logicalSource, expected.ordinal, expected.invocation);
-    if (identity.bindingId !== expected.bindingId ||
-        identity.nativeId !== expected.nativeId ||
-        !sameInvocation(identity.invocation, expected.invocation) ||
-        (binding !== undefined &&
-            (binding.id !== expected.bindingId ||
-                schedulerBindingNativeId(binding) !== expected.nativeId ||
-                binding.ordinal !== expected.ordinal ||
-                binding.logicalSource.kind !== expected.logicalSource.kind ||
-                binding.logicalSource.ref !== expected.logicalSource.ref ||
-                !sameInvocation(binding.invocation, expected.invocation)))) {
-        throw new UsageError("Scheduler mutation expectation has a forged or inconsistent binding identity.", "INVALID_FLAG_VALUE");
-    }
-    if (expected.state === "absent" && expected.fingerprint !== undefined) {
-        throw new UsageError("An absent scheduler expectation cannot carry prior artifact state.", "INVALID_FLAG_VALUE");
-    }
-}
-export function assertSchedulerMutationArtifact(artifact, expected) {
-    assertSchedulerExpectationIdentity(expected);
-    if (expected.state === "absent") {
-        if (artifact === undefined)
-            return;
-    }
-    else if (artifact !== undefined &&
-        artifact.nativeId === expected.nativeId &&
-        artifact.bindingId === expected.bindingId &&
-        artifact.invocation !== undefined &&
-        expected.fingerprint !== undefined &&
-        artifact.fingerprint === expected.fingerprint) {
-        return;
-    }
-    throw new UsageError(`Native scheduler artifact ${JSON.stringify(expected.nativeId)} changed from its frozen ${expected.state} state; refusing mutation.`, "RESOURCE_ALREADY_EXISTS");
-}
-export function assertSchedulerRollbackArtifact(artifact, expected) {
-    const matches = expected.allowed.some((state) => {
-        if (state.state === "absent")
-            return artifact === undefined;
-        if (!artifact || artifact.nativeId !== expected.nativeId)
-            return false;
-        if (artifact.fingerprint !== state.fingerprint || artifact.bindingId !== state.bindingId)
-            return false;
-        return state.invocation === undefined
-            ? artifact.invocation === undefined
-            : artifact.invocation !== undefined && sameInvocation(artifact.invocation, state.invocation);
-    });
-    if (matches)
-        return;
-    throw new UsageError(`Native scheduler artifact ${JSON.stringify(expected.nativeId)} changed after the transaction began; refusing rollback over a concurrent owner or fingerprint.`, "RESOURCE_ALREADY_EXISTS");
-}
 /**
- * Validate a rollback target from one complete native inventory. Rollback
- * guards may allow either the transaction-written state or the prior state,
- * but neither state permits two portable-key-equivalent artifacts.
+ * Recover the logical id of an installed row from its native spelling and
+ * public invocation: an ordinal-zero task row is its task id (possibly a
+ * nested one behind a digest spelling); every other row is its native id.
  */
-export function assertSchedulerRollbackArtifactCardinality(artifacts, expected) {
-    const matches = schedulerNativeArtifactsForKey(artifacts, expected.nativeId);
-    if (matches.length > 1) {
-        throw new UsageError(`Native scheduler artifact ${JSON.stringify(expected.nativeId)} changed after the transaction began: normalized rollback cardinality ${matches.length} exceeds one.`, "RESOURCE_ALREADY_EXISTS");
-    }
-    const artifact = matches[0];
-    assertSchedulerRollbackArtifact(artifact, expected);
-    return artifact;
-}
-export function canonicalSchedulerIdentity(logicalSource, ordinal, invocation) {
-    const parsed = parseBundleRef(logicalSource.ref);
-    if (!parsed.bundle || parsed.fragment !== undefined || bundleRefToString(parsed) !== logicalSource.ref) {
-        throw new UsageError("Scheduler expectation requires one canonical fully-qualified source.", "INVALID_FLAG_VALUE");
-    }
-    if (!Number.isSafeInteger(ordinal) || ordinal < 0) {
-        throw new UsageError("Scheduler expectation ordinal must be a non-negative integer.", "INVALID_FLAG_VALUE");
-    }
-    if (logicalSource.kind === "workflow") {
-        const canonicalInvocation = ["workflow", "run", logicalSource.ref];
-        if (!sameInvocation(invocation, canonicalInvocation)) {
-            throw new UsageError("Workflow scheduler expectation invocation does not match its qualified source.", "INVALID_FLAG_VALUE");
-        }
-        const bindingId = digestBindingId("workflow", logicalSource.ref, ordinal);
-        return Object.freeze({ bindingId, nativeId: bindingId, invocation: Object.freeze(canonicalInvocation) });
-    }
+export function schedulerLogicalBindingId(nativeId, invocation) {
     const taskId = invocation[0] === "task" && invocation[1] === "run" ? invocation[2] : undefined;
-    if (!taskId || normaliseTaskConceptId(taskId) !== taskId) {
-        throw new UsageError("Task scheduler expectation has an invalid public task id.", "INVALID_FLAG_VALUE");
-    }
-    const canonicalInvocation = ["task", "run", taskId, "--bundle", parsed.bundle, "--scheduled"];
-    if (!sameInvocation(invocation, canonicalInvocation)) {
-        throw new UsageError(`Task scheduler expectation invocation does not match its qualified source: expected ${JSON.stringify(canonicalInvocation)}, got ${JSON.stringify(invocation)}.`, "INVALID_FLAG_VALUE");
-    }
-    if (parsed.conceptId !== taskId && parsed.conceptId !== `tasks/${taskId}`) {
-        throw new UsageError("Task scheduler expectation id does not match its qualified source.", "INVALID_FLAG_VALUE");
-    }
-    const bindingId = ordinal === 0 ? taskId : digestBindingId("task", logicalSource.ref, ordinal);
-    return Object.freeze({
-        bindingId,
-        nativeId: schedulerNativeBindingId(bindingId),
-        invocation: Object.freeze(canonicalInvocation),
-    });
-}
-/** Recover the authored schedule ordinal from the exact source/binding identity. */
-export function schedulerBindingOrdinal(bindingId, logicalSource, invocation) {
-    if (logicalSource.kind === "task" && bindingId === invocation[2])
-        return 0;
-    for (let ordinal = 0; ordinal < 4096; ordinal += 1) {
-        if (digestBindingId(logicalSource.kind, logicalSource.ref, ordinal) === bindingId)
-            return ordinal;
-    }
-    return undefined;
-}
-/** Whether some schedule ordinal on `ref` would digest to `nativeId` (mirrors schedulerBindingOrdinal). */
-function workflowRefDigestsToNativeId(ref, nativeId) {
-    for (let ordinal = 0; ordinal < 4096; ordinal += 1) {
-        if (digestBindingId("workflow", ref, ordinal) === nativeId)
-            return true;
-    }
-    return false;
+    return taskId !== undefined && schedulerNativeBindingId(taskId) === nativeId ? taskId : nativeId;
 }
 function digestBindingId(kind, ref, ordinal) {
     const prefix = kind === "workflow" ? "wf" : "task";
@@ -338,9 +124,3 @@ function freezeBinding(binding) {
         invocation: Object.freeze([...binding.invocation]),
     });
 }
-function sameInvocation(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function normalizeRemovalExpectation(expected) {
-    return { ...expected, state: "present" };
-}