akm-cli 0.9.7 → 0.9.8-beta.2

package/dist/tasks/backends/launchd.js

@@ -25,6 +25,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import launchdTemplate from "../../assets/backends/launchd-template.xml" with { type: "text" };
+import { hasErrnoCode } from "../../core/common.js";
 import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
@@ -851,22 +852,6 @@ export function parseLaunchdLoadedLabels(output) {
     }
     return labels;
 }
-function countCharacter(value, needle) {
-    let count = 0;
-    for (const character of value)
-        if (character === needle)
-            count += 1;
-    return count;
-}
-function hasUnsafeLaunchdControlCharacter(output) {
-    for (let index = 0; index < output.length; index += 1) {
-        const code = output.charCodeAt(index);
-        if (code <= 8 || code === 11 || code === 12 || (code >= 14 && code <= 31) || (code >= 127 && code <= 159)) {
-            return true;
-        }
-    }
-    return false;
-}
 function readDisabledLabels(exec) {
     try {
         const result = exec.run(["launchctl", "print-disabled", `gui/${exec.uid()}`]);
@@ -933,8 +918,13 @@ function defaultLaunchdFs() {
             try {
                 return fs.readdirSync(dir);
             }
-            catch {
-                return [];
+            catch (error) {
+                // Genuinely absent is an empty listing; anything else (e.g. EACCES) is
+                // not "no plists" — surfacing it as such could make inspectBindings
+                // think there is nothing to reconcile.
+                if (hasErrnoCode(error, "ENOENT"))
+                    return [];
+                throw new ConfigError(`Unable to read LaunchAgents directory at "${dir}".`, "INVALID_CONFIG_FILE");
             }
         },
         exists(file) {

package/dist/tasks/resolve-akm-bin.js

@@ -152,7 +152,22 @@ function samePath(left, right) {
     };
     return normalize(left) === normalize(right);
 }
+// #901: the global root can't change within a process lifetime, and every
+// `resolveAkmInvocation()` call in a scheduler-sync process re-derives the
+// same `nodePath` — so this spawns `npm root --global` at most once per
+// process instead of once per call. Keyed by nodePath (rather than a bare
+// once-only flag) so a differently-invoked probe later in the same process
+// still gets its own answer instead of a stale one.
+let cachedNpmGlobalRoot;
 function resolveNpmGlobalRoot(nodePath, env) {
+    if (cachedNpmGlobalRoot && cachedNpmGlobalRoot.nodePath === nodePath) {
+        return cachedNpmGlobalRoot.value;
+    }
+    const value = resolveNpmGlobalRootUncached(nodePath, env);
+    cachedNpmGlobalRoot = { nodePath, value };
+    return value;
+}
+function resolveNpmGlobalRootUncached(nodePath, env) {
     const npmCli = resolveAssociatedNpmCli(nodePath);
     if (!npmCli)
         return undefined;

package/dist/tasks/run/task-history.js

@@ -14,20 +14,15 @@
  *
  * D8 result-vocabulary re-code (why, and the WRITE side's exact shape): see
  * docs/architecture/decisions/0005-task-result-vocabulary-and-legacy-read-mapping.md.
- * The READ side's mapping rule is a PERMANENT invariant kept here, not moved
- * — a maintainer touching `taskHistoryRowToResult` needs it right here, and
- * row B-51 (docs/plans/specs/p4-deletions-closeout.md) makes deleting it a
- * review-blocking violation: it reads rows written by every previous
- * release, forever.
- *
- *   A legacy row (no `targetVocab` marker — written before D8) maps:
- *   `"prompt"` -> `{kind:"command", engine}`, `"command"` -> `{kind:"shell"}`,
- *   `"workflow"` unchanged, anything else (including the new vocabulary's own
- *   "shell"/"script"/"prompt" written WITHOUT a marker, which no production
- *   writer ever does) -> `"unknown"`. The P0-pinned null fallbacks survive:
- *   workflow `ref` falls back to `""`, the command/prompt arm's `engine`
- *   falls back to `null`. A row carrying `targetVocab: 2` reads `target_kind`
- *   directly in the current vocabulary — no mapping needed.
+ * The READ side used to carry a permanent legacy-vocabulary mapping here
+ * (row B-51 of docs/plans/specs/p4-deletions-closeout.md called deleting it
+ * "review-blocking") — SUPERSEDED: `task_history` is DB-owned data, so the
+ * remap is now a one-time schema migration
+ * (`025-task-history-vocabulary-backfill` in src/core/state/migrations.ts)
+ * instead of a read-side shim run forever. Every row this function sees now
+ * carries the current vocabulary's `target_kind` strings; the P0-pinned null
+ * fallbacks still apply (workflow `ref` falls back to `""`, the command
+ * arm's `engine` falls back to `null`).
  *
  * A DAG leaf with respect to the rest of src/tasks/run/**: this module
  * imports TaskRunResult/TaskRunStatus's TYPE from ./task-result but no VALUE
@@ -37,6 +32,7 @@
  */
 import { rethrowIfTestIsolationError } from "../../core/errors.js";
 import { withStateDb } from "../../core/state-db.js";
+import { warn } from "../../core/warn.js";
 import { decodeTaskHistoryMetadata, finalizeTaskHistoryAttempt, getTaskHistory, getTaskHistoryRuns, queryTaskHistory, upsertTaskHistory, } from "../../storage/repositories/task-history-repository.js";
 /** Append (or finalize a reserved attempt into) one task_history row. */
 export function appendHistory(result, historyReserved = false) {
@@ -67,7 +63,11 @@ export function appendHistory(result, historyReserved = false) {
     }
     catch (error) {
         rethrowIfTestIsolationError(error);
-        // History recording is fully best-effort and must not alter CLI output.
+        // History recording must not alter the task's own result/exit status —
+        // the task already ran and its outcome is independent of whether we can
+        // persist a history row. But silence would make a failed write
+        // indistinguishable from the task never having run, so warn.
+        warn(`task history: failed to record history for task ${result.id}: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
 export function readTaskHistory(options = {}) {
@@ -111,32 +111,22 @@ function decodeTaskHistoryRows(rows) {
  * Convert a `TaskHistoryRow` from state.db back to a `TaskRunResult` shape
  * that callers of `readTaskHistory()` expect.
  *
- * D8 read boundary (spec §5.3): branches on the decoded metadata's
- * `targetVocab` marker — see the module header's table.
+ * Reads `target_kind` directly in the current (post-D8) vocabulary — the
+ * `025-task-history-vocabulary-backfill` state migration rewrites every
+ * legacy-vocabulary row before this ever runs against it.
  */
 function taskHistoryRowToResult(row) {
     const meta = decodeTaskHistoryMetadata(row.metadata_json);
-    const marked = meta.targetVocab === 2;
     const target = (() => {
         switch (row.target_kind) {
             case "workflow":
-                // PRESERVED for both vintages (incl. the null-ref fallback).
                 return { kind: "workflow", ref: row.target_ref ?? "" };
             case "command":
-                // NEW vocabulary: a prepared command (agent/LLM) result.
-                // LEGACY vocabulary: the native shell/script arm's shared string.
-                return marked ? { kind: "command", engine: meta.engine ?? null } : { kind: "shell" };
+                return { kind: "command", engine: meta.engine ?? null };
             case "shell":
-                // Only the NEW vocabulary ever writes this string; an unmarked
-                // "shell" row is unreachable from any production writer.
-                return marked ? { kind: "shell" } : { kind: "unknown" };
+                return { kind: "shell" };
             case "script":
-                // Only the NEW vocabulary ever writes this string; an unmarked
-                // "script" row is unreachable from any production writer.
-                return marked ? { kind: "script" } : { kind: "unknown" };
-            case "prompt":
-                // Only LEGACY rows (pre-P1b) ever wrote this string.
-                return marked ? { kind: "unknown" } : { kind: "command", engine: meta.engine ?? null };
+                return { kind: "script" };
             default:
                 return { kind: "unknown" };
         }

package/dist/tasks/scheduler-sync.js

@@ -6,6 +6,7 @@ import { createHash } from "node:crypto";
 import path from "node:path";
 import { loadAdapterExecutionSource } from "../commands/command/execution-source-loader.js";
 import { makeBundleRef } from "../core/asset/asset-ref.js";
+import { compareCodePoints, toPosix } from "../core/common.js";
 import { UsageError } from "../core/errors.js";
 import { canonicalizeWorkflowName, WORKFLOW_EXTENSIONS } from "../core/recognition-util.js";
 import { captureGuardedDirectoryManifest, captureGuardedExecutionSource, GuardedExecutionSourceCollector, } from "../execution/guarded-source.js";
@@ -742,12 +743,6 @@ function freezeOperation(operation) {
 function sameInvocation(left, right) {
     return left.length === right.length && left.every((value, index) => value === right[index]);
 }
-function compareCodePoints(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function toPosix(value) {
-    return value.replaceAll("\\", "/");
-}
 // Retain the concrete error in this module's public dependency graph so callers
 // can continue to identify ownership failures without importing an adapter.
 export { WorkflowSourceRejectionError };

package/dist/tasks/source/bounded-document.js

@@ -47,6 +47,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { types as utilTypes } from "node:util";
 import { isAlias, isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
+import { wellFormedUnicode } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
 import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
@@ -67,20 +68,6 @@ export function own(value, key) {
 export function utf8Bytes(value) {
     return new TextEncoder().encode(value).byteLength;
 }
-export function wellFormedUnicode(value) {
-    for (let index = 0; index < value.length; index += 1) {
-        const code = value.charCodeAt(index);
-        if (code >= 0xd800 && code <= 0xdbff) {
-            const next = value.charCodeAt(index + 1);
-            if (!(next >= 0xdc00 && next <= 0xdfff))
-                return false;
-            index += 1;
-        }
-        else if (code >= 0xdc00 && code <= 0xdfff)
-            return false;
-    }
-    return true;
-}
 /** The one per-field error funnel both grammars render through, distinguished only by `ctx.sourceLabel` (D2-N4). */
 export function sourceError(ctx, fieldPath, detail) {
     const dotted = fieldPath.length === 0

package/dist/tasks/source/task-to-v3.js

@@ -112,6 +112,12 @@ function base(input) {
         ...(input.containmentRoot ? { containmentRoot: input.containmentRoot } : {}),
     };
 }
+/**
+ * #902: the one blocker with an unambiguous remedy. The sibling shell-safety
+ * reasons need a case-by-case judgement and stay reason-only.
+ */
+const ARGV_ARRAY_BLOCK_DETAIL = "Manual conversion required: an array `command:` has no safe v3 `run:` string. Rewrite it by hand as " +
+    "`run:` (string) plus `shell:` — see docs/migration/v0.9.1-to-v0.9.2.md for the full v2 to v4 field mapping.";
 function blocked(input, reason, detail) {
     return Object.freeze({ status: "blocked", ...base(input), reason, ...(detail ? { detail } : {}) });
 }
@@ -389,8 +395,10 @@ export function planLegacyTaskDataToV3(input, data) {
     catch (cause) {
         return blocked(input, "invalid-v2-task", cause instanceof Error ? cause.message : String(cause));
     }
-    if (isReason(migrated))
-        return blocked(input, migrated);
+    if (isReason(migrated)) {
+        const detail = migrated === "argv-array-has-no-portable-shell-string" ? ARGV_ARRAY_BLOCK_DETAIL : undefined;
+        return blocked(input, migrated, detail);
+    }
     const after = Buffer.from(stringifyYaml(migrated), "utf8");
     try {
         parseTaskV3Yaml({

package/dist/workflows/exec/child-workflow.js

@@ -284,7 +284,7 @@ async function driveChildRun(input, childRow) {
  * before step 6 (publication) produces `child_workflow_publish_failed`.
  */
 export async function driveChildWorkflowUnit(input) {
-    const { request, target, ctx } = input;
+    const { request, ctx } = input;
     const precheck = precheckAndDeriveInvocationKey(input);
     if (!precheck.ok) {
         return precheck.outcome;

package/dist/workflows/exec/native-executor.js

@@ -708,7 +708,7 @@ async function prepareAttemptWorktree(input) {
     }
     return { ok: true, request: { ...input.request, cwd: created.path }, worktreePath: created.path };
 }
-async function reserveJournaledDispatch(input, request, worktreePath, startedAt) {
+async function reserveJournaledDispatch(input, worktreePath, startedAt) {
     const { plan, workUnit, ctx, attemptId, inputHash } = input;
     let durableAttempt;
     await enqueueUnitWrite(async () => {
@@ -799,7 +799,7 @@ async function dispatchJournaledAttempt(input) {
     const startedAt = new Date().toISOString();
     let durableAttempt;
     try {
-        durableAttempt = await reserveJournaledDispatch(input, request, worktreePath, startedAt);
+        durableAttempt = await reserveJournaledDispatch(input, worktreePath, startedAt);
     }
     catch (err) {
         // A failed dispatch-row insert means NOTHING dispatched (the row is the

package/dist/workflows/exec/step-work.js

@@ -20,7 +20,7 @@ import { UsageError } from "../../core/errors.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
 import { canonicalInputJson, validateInputs } from "../../execution/input-contract.js";
 import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
-import { canonicalJson as canonicalJsonString } from "../ir/plan-hash.js";
+import { canonicalJson } from "../ir/plan-hash.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
 import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { completeWorkflowStep, isTruncatedEvidence, } from "../runtime/runs.js";
@@ -463,7 +463,7 @@ function buildExecContextEnv(args) {
 function computeUnitInputHash(ctx, item) {
     return createHash("sha256")
         .update("akm.workflow.unit\0v7\0")
-        .update(canonicalJsonString({
+        .update(canonicalJson({
         hashVersion: 7,
         role: "unit",
         stepId: ctx.plan.stepId,
@@ -855,20 +855,8 @@ export function unitOutcomeFromRow(unitId, row, hasSchema) {
         ...(row.tokens !== null ? { tokens: row.tokens } : {}),
     };
 }
-/** Stable stringify (sorted object keys, recursively) so equal values vote together. */
-export function canonicalJson(value) {
-    return JSON.stringify(sortKeys(value));
-}
-function sortKeys(value) {
-    if (Array.isArray(value))
-        return value.map(sortKeys);
-    if (value && typeof value === "object") {
-        return Object.fromEntries(Object.entries(value)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => [k, sortKeys(v)]));
-    }
-    return value;
-}
+/** Re-exported so existing importers (`tests/workflows/fuzz/*`) keep resolving; canonical impl lives in `../ir/plan-hash`. */
+export { canonicalJson };
 // ── Gate-feedback recovery (PURE) ────────────────────────────────────────────
 //
 // A gate rejection is journaled as `<stepId>.gate:l<loop>` with result_json
@@ -1431,7 +1419,7 @@ export async function finalizeExecutedStep(input) {
                     // fields are unchanged).
                     inputHash: createHash("sha256")
                         .update("akm.workflow.gate\0v7\0")
-                        .update(canonicalJsonString({
+                        .update(canonicalJson({
                         hashVersion: 7,
                         dispatch: gateTarget,
                         invocation: null,

package/dist/workflows/exec/worktree.js

@@ -71,7 +71,22 @@ import { isProcessAlive, isWithinAsync, safeRealpathAsync } from "../../core/com
 import { serializeByKey } from "../../core/concurrent.js";
 import { runManagedSubprocess } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
-const GIT_TIMEOUT_MS = 30_000;
+/**
+ * Timeout for every `git worktree add|prune|remove|status` call this module
+ * makes. Was 30s; raised to 120s after #891 confirmed a real product gap:
+ * these calls run under {@link withRepoWorktreeLock}, a per-process,
+ * per-repository queue, so a machine also busy with OTHER git-heavy work
+ * (other akm runs, other agents' worktrees, a loaded CI runner) can genuinely
+ * push one `git worktree remove` past 30s without anything being stuck —
+ * plain CPU/fork/IO contention. At 30s that showed up as `{ removed: false,
+ * error: "... timed out after 30000ms" }` on a perfectly healthy op: a clean
+ * worktree left retained, or a create failing a unit outright, purely because
+ * the box was busy. 120s matches the same trade already made for
+ * {@link GIT_PUSH_TIMEOUT_MS} (`core/write-source.ts`,
+ * `sources/providers/git-stash.ts`) for the same class of administrative git
+ * call under load; a call that is truly hung (not just slow) is still caught.
+ */
+const GIT_TIMEOUT_MS = 120_000;
 /** Directory under `os.tmpdir()` that owns every run's worktree roots. */
 export const WORKTREES_DIR_NAME = "akm-worktrees";
 /**
@@ -89,12 +104,10 @@ function gitExitError(args, code, stderr, stdout) {
     return `git ${args.join(" ")} exited ${code}${detail ? `: ${detail}` : ""}`;
 }
 /**
- * Run one git command asynchronously; `ok` = exit 0. Never throws (spawn
- * errors and the 30 s timeout → ok: false). Async so a git lock wait parks a
- * promise instead of blocking the event loop; repo-mutating callers must hold
- * {@link withRepoWorktreeLock}.
+ * Run one git command asynchronously via the real `git` binary; `ok` = exit
+ * 0. Never throws (spawn errors and the timeout → ok: false).
  */
-async function git(cwd, args) {
+async function realGitExecutor(cwd, args) {
     const result = await runManagedSubprocess(["git", "-C", cwd, ...args], {
         capture: true,
         timeoutMs: GIT_TIMEOUT_MS,
@@ -114,6 +127,27 @@ async function git(cwd, args) {
     }
     return { ok: true, stdout: result.stdout };
 }
+let gitExecutor = realGitExecutor;
+/**
+ * TEST-ONLY seam (#891): swap the executor every repo-mutating git call in
+ * this module goes through. Lets a test prove those calls genuinely
+ * interleave with other event-loop work — the property the old "count
+ * setInterval ticks during real git calls" test asserted before it was
+ * deleted for timing on the real scheduler instead of on behavior — using a
+ * fake, deterministically-timed async git in place of the real subprocess.
+ * Call with `undefined` to restore the real spawn-based executor.
+ */
+export function setGitExecutorForTesting(executor) {
+    gitExecutor = executor ?? realGitExecutor;
+}
+/**
+ * Run one git command asynchronously; `ok` = exit 0. Never throws. Async so a
+ * git lock wait parks a promise instead of blocking the event loop;
+ * repo-mutating callers must hold {@link withRepoWorktreeLock}.
+ */
+async function git(cwd, args) {
+    return gitExecutor(cwd, args);
+}
 /**
  * Synchronous git for the two read-only probes that run before any unit is in
  * flight ({@link isGitAvailable}, {@link assertGitWorkTree}). They take no

package/dist/workflows/freeze/task-bindings.js

@@ -20,15 +20,13 @@
  * full design history, including why re-binding cannot reuse the
  * shape-driven normalizer (a code-review finding).
  */
+import { isRecord } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { validateInputs } from "../../execution/input-contract.js";
 import { parseReference } from "../program/expressions.js";
 function inputBindingInvalid(message) {
     return new UsageError(message, "INPUT_BINDING_INVALID");
 }
-function isPlainObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function unknownBindingNameError(stepId, targetRef, name, declaredNames) {
     return inputBindingInvalid(`Workflow step ${stepId} targets ${targetRef} with.${name}, which is not a declared input. ` +
         `Declared inputs: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}.`);
@@ -152,7 +150,7 @@ function finalizeBindings(stepId, targetRef, contract, byName) {
  * reinterpreted as a literal.
  */
 function normalizeOneEntry(stepId, targetRef, name, value, schema, earlierStepIds, declaredParamNames) {
-    if (!isPlainObject(value) || !Object.hasOwn(value, "from")) {
+    if (!isRecord(value) || !Object.hasOwn(value, "from")) {
         return Object.freeze({ kind: "literal", name, value });
     }
     const keys = Object.keys(value);

package/dist/workflows/ir/compile.js

@@ -25,6 +25,7 @@
  * Returns accumulated `WorkflowError`s rather than throwing. Pure and
  * deterministic: the same document always compiles to the same plan.
  */
+import { compareCodePoints } from "../../core/common.js";
 import { formatReference, parseReference } from "../program/expressions.js";
 import { projectExecCore } from "../program/schema.js";
 import { sourceStepInstructions, sourceStepProgramUnit, sourceStepRef } from "../source-ir/program.js";
@@ -114,9 +115,6 @@ function sortedOutputs(outputs) {
     }
     return sorted;
 }
-function compareCodePoints(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
 function compileStep(step, sequenceIndex, defaults, resolved) {
     const gate = {
         kind: "gate",
@@ -269,14 +267,12 @@ function checkOutputReference(name, text, check) {
  * (human + JSON output, via `core/adapter/adapters/akm-lint.ts#
  * workflowCompileWarnings`) and as `warn()` lines at `workflow run`.
  *
- *   A. A unit/map step with NO step-level `output:` schema carries its units'
- *      raw results as an untyped artifact — permitted, but worth flagging.
- *   B. A `params.<name>` reference (in `map.over`/`route.input`) to an
+ *   A. A `params.<name>` reference (in `map.over`/`route.input`) to an
  *      UNDECLARED param, but ONLY when the document declares a `params:`
  *      block — a likely typo. Prose can no longer carry param references at
  *      all (it is never scanned), so this warning's surface shrinks to the
  *      two whole-value fields that can legally contain one.
- *   C. `gate.max_loops` above 1 on an `exec` step. The engine judges such a
+ *   B. `gate.max_loops` above 1 on an `exec` step. The engine judges such a
  *      step but never loops it (`exec/step-work.ts#effectiveGateMaxLoops`):
  *      a frozen argv cannot read the judge's feedback, so a second loop would
  *      only re-run the identical command — and its side effects. The declared
@@ -299,13 +295,6 @@ export function collectWorkflowWarnings(input) {
                         `can still fail the step.`,
                 });
             }
-            if ((step.map || step.route === undefined) && step.output === undefined) {
-                warnings.push({
-                    line: step.source.start,
-                    message: `Step "${step.id}" declares no \`output:\` schema — its unit results are carried as an untyped ` +
-                        `artifact (permitted). Add an \`output:\` JSON Schema to type and validate the step artifact.`,
-                });
-            }
             if (declaredParams) {
                 const declaredList = [...declaredParams].join(", ");
                 const scan = (text, label) => {

package/dist/workflows/ir/schema-v4.js

@@ -10,6 +10,7 @@
  */
 import { createHash } from "node:crypto";
 import path from "node:path";
+import { compareCodePoints } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { decodeFrozenExecutableIdentity } from "../../execution/executable-identity.js";
 import { INPUT_NAME_PATTERN } from "../../execution/input-contract.js";
@@ -38,7 +39,7 @@ export const WORKFLOW_IR_V5_VERSION = 5;
  * freeze-time `COMPOSITION_INVALID` gates live in
  * `src/workflows/freeze/targets/child-workflow.ts` (Lane B).
  */
-export function decodeWorkflowPlanV4(input, hooks = {}, depth = 0, budget = { embeddedBytes: 0 }) {
+export function decodeWorkflowPlanV4(input, depth = 0, budget = { embeddedBytes: 0 }) {
     const raw = record(input, "plan");
     if (raw.irVersion !== WORKFLOW_IR_V5_VERSION)
         fail("irVersion must be 5");
@@ -51,7 +52,7 @@ export function decodeWorkflowPlanV4(input, hooks = {}, depth = 0, budget = { em
         planExtraKeys: ["sourceReadSet", "outputs"],
         unitExtraKeys: ["frozenTarget", "environment"],
         gateExtraKeys: ["frozenJudge"],
-    }, hooks);
+    });
     const rawSteps = raw.steps;
     const stepIds = new Set(rawSteps.map((rawStep) => rawStep.stepId));
     const requiredSources = [];
@@ -232,7 +233,7 @@ function decodeChildWorkflowTarget(target, unit, depth, budget) {
         fail(`unit ${unit.id} child workflow contentHash does not match its frozen dispatch`);
     }
     const childDepth = depth + 1;
-    const frozenPlan = decodeWorkflowPlanV4(target.frozenPlan, {}, childDepth, budget);
+    const frozenPlan = decodeWorkflowPlanV4(target.frozenPlan, childDepth, budget);
     const embeddedPlanJson = canonicalJsonLocal(frozenPlan);
     const actualPlanHash = sha256(embeddedPlanJson);
     if (actualPlanHash !== planHash) {
@@ -711,9 +712,6 @@ function digest(value, label) {
 function sha256(value) {
     return createHash("sha256").update(value).digest("hex");
 }
-function compareCodePoints(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
 function canonicalJsonLocal(value) {
     const sort = (entry) => {
         if (Array.isArray(entry))

package/dist/workflows/ir/schema.js

@@ -1,7 +1,7 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { isContainedRelativePath } from "../../core/common.js";
+import { isContainedRelativePath, isRecord } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { parseReference } from "../program/expressions.js";
 import { PROGRAM_PARAM_NAME_PATTERN, PROGRAM_RETRY_REASONS, PROGRAM_STEP_ID_PATTERN } from "../program/schema.js";
@@ -13,7 +13,7 @@ export { WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_TIMEOUT_MS };
 const MAX_LIST_ITEMS = 1024;
 const MAX_STRING_LENGTH = 1_000_000;
 /** Validate the current durable execution graph. */
-export function validateWorkflowPlanStructure(input, options, hooks = {}) {
+export function validateWorkflowPlanStructure(input, options) {
     if (!isRecord(input) || input.irVersion !== options.expectedVersion) {
         fail(`irVersion must be ${options.expectedVersion}`);
     }
@@ -351,9 +351,6 @@ function assertString(value, label) {
     if (typeof value !== "string" || value.length === 0 || value.length > MAX_STRING_LENGTH)
         fail(`${label} must be a non-empty bounded string`);
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function fail(message) {
     throw new UsageError(`Invalid frozen workflow plan: ${message}.`);
 }