@dharma-ai-labs/agent-fabric-skill-manager 0.1.2 → 0.2.0

package/dist/index.js

@@ -36,14 +36,43 @@ export function calculateBundleHash(bundle) {
     return sha256(canonicalize(bundle));
 }
 export function verifySkillBundle(bundle, serverPublicKey, now = new Date()) {
-    if (bundle.expiresAt && Date.parse(bundle.expiresAt) <= now.getTime())
-        throw new Error('Skill bundle has expired.');
+    if (bundle.schema !== 'dharma.skill-bundle/v2') {
+        throw new Error('Skill bundle schema is not authorized for installation or task execution.');
+    }
+    if (bundle.expiresAt) {
+        const expiresAt = Date.parse(bundle.expiresAt);
+        if (!Number.isFinite(expiresAt))
+            throw new Error('Skill bundle expiry is invalid.');
+        if (expiresAt <= now.getTime())
+            throw new Error('Skill bundle has expired.');
+    }
     const { signature, ...unsigned } = bundle;
     if (!verifyCanonicalObject(unsigned, signature, serverPublicKey))
         throw new Error('Skill bundle signature is invalid.');
     const { bundleHash, ...hashInput } = unsigned;
     if (bundleHash !== calculateBundleHash(hashInput))
         throw new Error('Skill bundle hash is invalid.');
+    const selectors = bundle.targetSelectors;
+    if (!selectors || typeof selectors !== 'object'
+        || !Array.isArray(selectors.organizationAgentIds) || !Array.isArray(selectors.deviceIds)
+        || !Array.isArray(selectors.workspaceIds) || !Array.isArray(selectors.providers)
+        || selectors.organizationAgentIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.deviceIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.workspaceIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.providers.some((value) => !['codex', 'claude', 'agy'].includes(value))) {
+        throw new Error('Skill bundle target selectors are invalid.');
+    }
+}
+function assertTargetSelector(selector, value, label) {
+    if (selector.length > 0 && !selector.includes(value)) {
+        throw new Error(`Skill bundle is not authorized for this ${label}.`);
+    }
+}
+function assertBundleTargetsEndpoint(bundle, endpoint) {
+    assertTargetSelector(bundle.targetSelectors.organizationAgentIds, endpoint.organizationAgentId, 'repository agent');
+    assertTargetSelector(bundle.targetSelectors.deviceIds, endpoint.deviceId, 'device');
+    assertTargetSelector(bundle.targetSelectors.workspaceIds, endpoint.workspaceId, 'workspace');
+    assertTargetSelector(bundle.targetSelectors.providers, endpoint.provider, 'provider');
 }
 async function runSmoke(commandId, policy, cwd) {
     const command = resolveRegisteredCommand(policy, commandId);
@@ -60,15 +89,152 @@ async function runSmoke(commandId, policy, cwd) {
         });
     });
 }
-async function readActiveBundleId(root) {
+async function readActiveBundlePointer(root) {
+    let bundleId;
     try {
-        return (await readFile(resolve(root, 'ACTIVE_BUNDLE'), 'utf8')).trim() || null;
+        bundleId = (await readFile(resolve(root, 'ACTIVE_BUNDLE'), 'utf8')).trim();
     }
     catch (error) {
         if (error.code === 'ENOENT')
             return null;
         throw error;
     }
+    if (!bundleId)
+        return null;
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw new Error('Active bundle manifest is missing for the installed bundle pointer.');
+        }
+        throw error;
+    }
+    if (manifest.bundleId !== bundleId) {
+        throw new Error('Active bundle pointer does not match the installed release manifest.');
+    }
+    return bundleId;
+}
+function verifyInstallReceipt(receipt, devicePublicKey, expected, now) {
+    const { signature, ...signed } = receipt;
+    if (!verifyCanonicalObject(signed, signature, devicePublicKey))
+        throw new Error('Active bundle install receipt signature is invalid.');
+    const { receiptHash, ...hashInput } = signed;
+    if (receiptHash !== sha256(canonicalize(hashInput)))
+        throw new Error('Active bundle install receipt hash is invalid.');
+    if (receipt.status !== 'active')
+        throw new Error('Active bundle install receipt is not active.');
+    if (receipt.bundleId !== expected.bundleId || receipt.organizationId !== expected.organizationId
+        || receipt.deviceId !== expected.deviceId || receipt.workspaceId !== expected.workspaceId || receipt.provider !== expected.provider) {
+        throw new Error('Active bundle install receipt does not match the selected endpoint.');
+    }
+    const startedAt = Date.parse(receipt.startedAt);
+    const completedAt = Date.parse(receipt.completedAt);
+    if (!Number.isFinite(startedAt) || !Number.isFinite(completedAt) || completedAt < startedAt || completedAt > now.getTime() + 5_000) {
+        throw new Error('Active bundle install receipt has an invalid activation window.');
+    }
+}
+function workspaceManagedRoot(nativeSkillDirectory, workspaceId) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(workspaceId)) {
+        throw new Error('Workspace ID is invalid for managed skill state.');
+    }
+    return resolve(nativeSkillDirectory, '.dharma-managed', 'workspaces', workspaceId);
+}
+export async function getLegacySkillBundleIdForUpgrade(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(bundleId)) {
+        throw new Error('Legacy skill bundle identifier is invalid.');
+    }
+    let authorization;
+    let source = 'authorization';
+    try {
+        authorization = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        source = 'legacy_manifest';
+        authorization = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    if (authorization.bundleId !== bundleId)
+        return null;
+    if (source === 'authorization') {
+        if (authorization.schema !== 'dharma.skill-bundle/v1')
+            return null;
+    }
+    else if (authorization.schema !== undefined
+        || authorization.workspaceId !== input.workspaceId
+        || !Array.isArray(authorization.skillIds)
+        || !authorization.skillIds.every((skillId) => typeof skillId === 'string' && skillId.length > 0)) {
+        return null;
+    }
+    return bundleId;
+}
+export async function getInstalledSkillBundleIdForRecovery(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(bundleId)) {
+        throw new Error('Installed skill bundle identifier is invalid.');
+    }
+    let manifest;
+    let source = 'authorization';
+    try {
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        source = 'legacy-manifest';
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    const authorizedManifest = source === 'authorization'
+        && ['dharma.skill-bundle/v1', 'dharma.skill-bundle/v2'].includes(String(manifest.schema));
+    const legacyInstallManifest = source === 'legacy-manifest'
+        && manifest.schema === undefined
+        && manifest.workspaceId === input.workspaceId
+        && Array.isArray(manifest.skillIds)
+        && manifest.skillIds.every((skillId) => typeof skillId === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skillId));
+    if ((!authorizedManifest && !legacyInstallManifest) || manifest.bundleId !== bundleId) {
+        throw new Error('Installed skill recovery metadata is invalid.');
+    }
+    return bundleId;
+}
+export async function getExpiredSkillBundleAuthorizationForReplacement(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    const bundle = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    const receipt = JSON.parse(await readFile(resolve(root, 'active', 'INSTALL_RECEIPT.json'), 'utf8'));
+    const now = input.now ?? new Date();
+    const expiresAt = Date.parse(String(bundle.expiresAt || ''));
+    if (!Number.isFinite(expiresAt) || expiresAt > now.getTime()) {
+        throw new Error('Installed skill bundle is not an expired replacement candidate.');
+    }
+    if (bundle.bundleId !== bundleId)
+        throw new Error('Active bundle pointer does not match the signed release authorization.');
+    verifySkillBundle(bundle, input.serverPublicKey, new Date(expiresAt - 1));
+    assertBundleTargetsEndpoint(bundle, input);
+    verifyInstallReceipt(receipt, input.devicePublicKey, {
+        bundleId,
+        organizationId: input.organizationId,
+        deviceId: input.deviceId,
+        workspaceId: input.workspaceId,
+        provider: input.provider,
+    }, now);
+    if (receipt.receiptHash !== input.expectedReceiptHash) {
+        throw new Error('Active bundle receipt is not the current protected authorization.');
+    }
+    return { bundleId, activatedAt: receipt.completedAt, expiresAt: bundle.expiresAt ?? null };
 }
 async function pathExists(path) {
     try {
@@ -101,6 +267,10 @@ async function activateNativeSkills(input) {
             const marker = resolve(target, '.dharma-agent-fabric.json');
             if (!await pathExists(marker))
                 throw new Error(`Refusing to replace unmanaged provider skill: ${skillId}`);
+            const ownership = JSON.parse(await readFile(marker, 'utf8'));
+            if (typeof ownership.workspaceId === 'string' && ownership.workspaceId !== input.workspaceId) {
+                throw new Error(`Refusing to replace a provider skill managed by another workspace: ${skillId}`);
+            }
         }
     }
     const transactionRoot = assertContained(input.nativeSkillDirectory, resolve(input.nativeSkillDirectory, `.dharma-activation-${randomUUID()}`));
@@ -115,7 +285,7 @@ async function activateNativeSkills(input) {
             const source = assertContained(input.release, resolve(input.release, skillId));
             const staged = assertContained(stagedRoot, resolve(stagedRoot, skillId));
             await cp(source, staged, { recursive: true, errorOnExist: true, force: false });
-            await writeFile(resolve(staged, '.dharma-agent-fabric.json'), `${JSON.stringify({ bundleId: input.bundleId, skillId })}\n`, { mode: 0o600 });
+            await writeFile(resolve(staged, '.dharma-agent-fabric.json'), `${JSON.stringify({ bundleId: input.bundleId, skillId, workspaceId: input.workspaceId })}\n`, { mode: 0o600 });
         }
         for (const skillId of affectedSkillIds) {
             const target = assertContained(input.nativeSkillDirectory, resolve(input.nativeSkillDirectory, skillId));
@@ -146,14 +316,110 @@ async function activateNativeSkills(input) {
         await rm(transactionRoot, { recursive: true, force: true });
     }
 }
-export async function getActiveSkillBundleId(nativeSkillDirectory) {
-    return readActiveBundleId(resolve(nativeSkillDirectory, '.dharma-managed'));
+async function nativeSkillIdsOwnedByWorkspace(nativeSkillDirectory, workspaceId) {
+    let entries;
+    try {
+        entries = await readdir(nativeSkillDirectory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(entry.name))
+            continue;
+        try {
+            const marker = JSON.parse(await readFile(resolve(nativeSkillDirectory, entry.name, '.dharma-agent-fabric.json'), 'utf8'));
+            if (marker.workspaceId === workspaceId)
+                owned.push(entry.name);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return owned;
+}
+async function recoverInterruptedSkillRollbacks(nativeSkillDirectory, workspaceId) {
+    const managedRoot = workspaceManagedRoot(nativeSkillDirectory, workspaceId);
+    let entries;
+    try {
+        entries = await readdir(managedRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    for (const entry of entries.filter((candidate) => candidate.isDirectory() && candidate.name.startsWith('.rollback-'))) {
+        const transactionRoot = assertContained(managedRoot, resolve(managedRoot, entry.name));
+        const manifest = JSON.parse(await readFile(resolve(transactionRoot, 'ROLLBACK_RECOVERY.json'), 'utf8'));
+        if (manifest.schema !== 'dharma.skill-rollback-recovery/v1'
+            || manifest.workspaceId !== workspaceId
+            || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(manifest.currentBundleId)
+            || !Array.isArray(manifest.currentSkillIds)
+            || manifest.currentSkillIds.some((skillId) => typeof skillId !== 'string'
+                || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skillId))) {
+            throw new Error('Interrupted skill rollback recovery metadata is invalid.');
+        }
+        const releases = resolve(managedRoot, 'releases');
+        const currentRelease = assertContained(releases, resolve(releases, manifest.currentBundleId));
+        const active = resolve(managedRoot, 'active');
+        const backupActive = resolve(transactionRoot, 'backup-active');
+        if (await pathExists(backupActive)) {
+            await rm(active, { recursive: true, force: true });
+            await rename(backupActive, active);
+        }
+        else if (!await pathExists(active)) {
+            await cp(currentRelease, active, { recursive: true, errorOnExist: true, force: false });
+        }
+        await activateNativeSkills({
+            nativeSkillDirectory,
+            release: currentRelease,
+            bundleId: manifest.currentBundleId,
+            workspaceId,
+            skillIds: manifest.currentSkillIds,
+            removeSkillIds: await nativeSkillIdsOwnedByWorkspace(nativeSkillDirectory, workspaceId),
+        });
+        const pointerTemp = resolve(transactionRoot, 'ACTIVE_BUNDLE.recovery');
+        await writeFile(pointerTemp, `${manifest.currentBundleId}\n`, { mode: 0o600 });
+        await rename(pointerTemp, resolve(managedRoot, 'ACTIVE_BUNDLE'));
+        await rm(transactionRoot, { recursive: true, force: true });
+    }
+}
+export async function getActiveSkillBundleAuthorization(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    const bundle = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    const receipt = JSON.parse(await readFile(resolve(root, 'active', 'INSTALL_RECEIPT.json'), 'utf8'));
+    const now = input.now ?? new Date();
+    if (bundle.bundleId !== bundleId)
+        throw new Error('Active bundle pointer does not match the signed release authorization.');
+    verifySkillBundle(bundle, input.serverPublicKey, now);
+    assertBundleTargetsEndpoint(bundle, input);
+    verifyInstallReceipt(receipt, input.devicePublicKey, {
+        bundleId,
+        organizationId: input.organizationId,
+        deviceId: input.deviceId,
+        workspaceId: input.workspaceId,
+        provider: input.provider,
+    }, now);
+    if (receipt.receiptHash !== input.expectedReceiptHash) {
+        throw new Error('Active bundle receipt is not the current protected authorization.');
+    }
+    return { bundleId, activatedAt: receipt.completedAt, expiresAt: bundle.expiresAt ?? null };
 }
 export async function installSkillBundle(input) {
     const startedAt = new Date().toISOString();
     verifySkillBundle(input.bundle, input.serverPublicKey);
     if (input.bundle.organizationId !== input.policy.organizationId)
         throw new Error('Bundle organization does not match policy.');
+    assertBundleTargetsEndpoint(input.bundle, input);
     if (input.bundle.operation === 'clear' && input.bundle.skills.length !== 0)
         throw new Error('Clear bundles cannot contain skills.');
     if (input.bundle.operation === 'install' && input.bundle.skills.length === 0)
@@ -163,12 +429,13 @@ export async function installSkillBundle(input) {
     }
     if (!input.policy.skills.automaticInstall)
         throw new Error('Automatic skill installation is disabled by policy.');
-    const managedRoot = resolve(input.nativeSkillDirectory, '.dharma-managed');
+    const managedRoot = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
     const releases = resolve(managedRoot, 'releases');
     const release = assertContained(releases, resolve(releases, input.bundle.bundleId));
     const active = resolve(managedRoot, 'active');
     const rollback = resolve(managedRoot, 'rollback');
-    const previousBundleId = await readActiveBundleId(managedRoot);
+    const previousBundleId = await readActiveBundlePointer(managedRoot);
     await mkdir(releases, { recursive: true, mode: 0o700 });
     await rm(release, { recursive: true, force: true });
     await mkdir(release, { recursive: true, mode: 0o700 });
@@ -184,7 +451,8 @@ export async function installSkillBundle(input) {
         checks.push({ name: `content:${skill.skillId}`, status: 'pass', details: actualHash });
     }
     const skillIds = input.bundle.skills.map((skill) => skill.skillId);
-    await writeFile(resolve(release, 'BUNDLE.json'), `${JSON.stringify({ bundleId: input.bundle.bundleId, skillIds })}\n`, { mode: 0o600 });
+    await writeFile(resolve(release, 'BUNDLE.json'), `${JSON.stringify({ bundleId: input.bundle.bundleId, workspaceId: input.workspaceId, skillIds })}\n`, { mode: 0o600 });
+    await writeFile(resolve(release, 'AUTHORIZATION.json'), `${JSON.stringify(input.bundle)}\n`, { mode: 0o600 });
     const previousRelease = previousBundleId ? resolve(releases, previousBundleId) : null;
     const previousSkillIds = previousRelease ? await releaseSkillIds(previousRelease) : [];
     await rm(rollback, { recursive: true, force: true });
@@ -200,42 +468,52 @@ export async function installSkillBundle(input) {
         nativeSkillDirectory: input.nativeSkillDirectory,
         release,
         bundleId: input.bundle.bundleId,
+        workspaceId: input.workspaceId,
         skillIds,
         removeSkillIds: previousSkillIds,
     });
     let status = 'active';
+    const restorePreviousBundle = async () => {
+        await rm(active, { recursive: true, force: true });
+        let restored = 'failed';
+        try {
+            await rename(rollback, active);
+            restored = 'rolled_back';
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        await activateNativeSkills({
+            nativeSkillDirectory: input.nativeSkillDirectory,
+            release: previousRelease || release,
+            bundleId: previousBundleId || input.bundle.bundleId,
+            workspaceId: input.workspaceId,
+            skillIds: previousBundleId ? previousSkillIds : [],
+            removeSkillIds: skillIds,
+        });
+        return restored;
+    };
     if (input.smokeCommandId) {
         const check = await runSmoke(input.smokeCommandId, input.policy, active);
         checks.push({ name: `smoke:${input.smokeCommandId}`, ...check });
         if (check.status === 'fail') {
-            await rm(active, { recursive: true, force: true });
-            try {
-                await rename(rollback, active);
-                status = 'rolled_back';
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-                status = 'failed';
-            }
-            await activateNativeSkills({
-                nativeSkillDirectory: input.nativeSkillDirectory,
-                release: previousRelease || release,
-                bundleId: previousBundleId || input.bundle.bundleId,
-                skillIds: previousBundleId ? previousSkillIds : [],
-                removeSkillIds: skillIds,
-            });
+            status = await restorePreviousBundle();
         }
     }
     if (status === 'active') {
-        await rm(rollback, { recursive: true, force: true });
-        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${input.bundle.bundleId}\n`, { mode: 0o600 });
-    }
-    else if (previousBundleId) {
-        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
-    }
-    else {
-        await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+        try {
+            verifySkillBundle(input.bundle, input.serverPublicKey);
+            checks.push({ name: 'authorization:activation-window', status: 'pass', details: input.bundle.expiresAt || 'no-expiry' });
+        }
+        catch (error) {
+            checks.push({
+                name: 'authorization:activation-window',
+                status: 'fail',
+                details: error instanceof Error ? error.message : String(error),
+            });
+            status = await restorePreviousBundle();
+        }
     }
     const receiptBase = {
         schema: 'dharma.install-receipt/v1',
@@ -255,7 +533,148 @@ export async function installSkillBundle(input) {
     };
     const receiptHash = sha256(canonicalize(receiptBase));
     const signature = signCanonicalObject({ ...receiptBase, receiptHash }, input.devicePrivateKey);
-    return { ...receiptBase, receiptHash, signature };
+    const receipt = { ...receiptBase, receiptHash, signature };
+    if (status === 'active') {
+        try {
+            await writeFile(resolve(release, 'INSTALL_RECEIPT.json'), `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+            await writeFile(resolve(active, 'INSTALL_RECEIPT.json'), `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+            await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${input.bundle.bundleId}\n`, { mode: 0o600 });
+        }
+        catch (error) {
+            const recoveryErrors = [];
+            try {
+                await restorePreviousBundle();
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+            try {
+                if (previousBundleId) {
+                    await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
+                }
+                else {
+                    await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+                }
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+            if (recoveryErrors.length) {
+                throw new AggregateError([error, ...recoveryErrors], 'Skill receipt persistence failed and local recovery was incomplete.');
+            }
+            throw error;
+        }
+    }
+    else if (previousBundleId) {
+        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
+    }
+    else {
+        await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+    }
+    return receipt;
+}
+export async function rollbackUnconfirmedSkillBundle(input) {
+    if (input.receipt.status !== 'active')
+        return;
+    const managedRoot = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const activeBundleId = await readActiveBundlePointer(managedRoot);
+    if (activeBundleId !== input.receipt.bundleId) {
+        throw new Error('Refusing to roll back an installation that is no longer the active local bundle.');
+    }
+    const releases = resolve(managedRoot, 'releases');
+    const active = resolve(managedRoot, 'active');
+    const currentRelease = assertContained(releases, resolve(releases, input.receipt.bundleId));
+    const currentSkillIds = await releaseSkillIds(currentRelease);
+    const previousBundleId = input.receipt.previousBundleId;
+    const previousRelease = previousBundleId
+        ? assertContained(releases, resolve(releases, previousBundleId))
+        : null;
+    const previousSkillIds = previousRelease ? await releaseSkillIds(previousRelease) : [];
+    const transactionRoot = assertContained(managedRoot, resolve(managedRoot, `.rollback-${randomUUID()}`));
+    const stagedActive = resolve(transactionRoot, 'staged-active');
+    const backupActive = resolve(transactionRoot, 'backup-active');
+    const pointer = resolve(managedRoot, 'ACTIVE_BUNDLE');
+    const pointerTemp = resolve(transactionRoot, 'ACTIVE_BUNDLE.next');
+    let nativeChanged = false;
+    let activeMoved = false;
+    let stagedMoved = false;
+    let preserveRecovery = false;
+    await mkdir(transactionRoot, { recursive: true, mode: 0o700 });
+    await writeFile(resolve(transactionRoot, 'ROLLBACK_RECOVERY.json'), `${JSON.stringify({
+        schema: 'dharma.skill-rollback-recovery/v1',
+        workspaceId: input.workspaceId,
+        currentBundleId: input.receipt.bundleId,
+        currentSkillIds,
+    })}\n`, { mode: 0o600 });
+    if (previousRelease) {
+        await cp(previousRelease, stagedActive, { recursive: true, errorOnExist: true, force: false });
+    }
+    try {
+        await activateNativeSkills({
+            nativeSkillDirectory: input.nativeSkillDirectory,
+            release: previousRelease || currentRelease,
+            bundleId: previousBundleId || input.receipt.bundleId,
+            workspaceId: input.workspaceId,
+            skillIds: previousSkillIds,
+            removeSkillIds: currentSkillIds,
+        });
+        nativeChanged = true;
+        await rename(active, backupActive);
+        activeMoved = true;
+        if (previousRelease) {
+            await rename(stagedActive, active);
+            stagedMoved = true;
+            await writeFile(pointerTemp, `${previousBundleId}\n`, { mode: 0o600 });
+            await rename(pointerTemp, pointer);
+        }
+        else {
+            await rm(pointer, { force: true });
+        }
+    }
+    catch (error) {
+        const recoveryErrors = [];
+        if (activeMoved) {
+            try {
+                if (stagedMoved)
+                    await rm(active, { recursive: true, force: true });
+                await rename(backupActive, active);
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+        }
+        if (nativeChanged) {
+            try {
+                await activateNativeSkills({
+                    nativeSkillDirectory: input.nativeSkillDirectory,
+                    release: currentRelease,
+                    bundleId: input.receipt.bundleId,
+                    workspaceId: input.workspaceId,
+                    skillIds: currentSkillIds,
+                    removeSkillIds: previousSkillIds,
+                });
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+        }
+        try {
+            await writeFile(pointer, `${input.receipt.bundleId}\n`, { mode: 0o600 });
+        }
+        catch (recoveryError) {
+            recoveryErrors.push(recoveryError);
+        }
+        if (recoveryErrors.length) {
+            preserveRecovery = true;
+            throw new AggregateError([error, ...recoveryErrors], 'Skill rollback failed and the active installation could not be fully restored.');
+        }
+        throw error;
+    }
+    finally {
+        if (!preserveRecovery)
+            await rm(transactionRoot, { recursive: true, force: true });
+    }
 }
 export { contentHash };
 //# sourceMappingURL=index.js.map