@dharma-ai-labs/agent-fabric-skill-manager 0.1.3 → 0.2.0

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { type KeyObject } from 'node:crypto';
 import { type ProviderId } from '@dharma-ai-labs/agent-fabric-contracts';
 import { type OrganizationPolicy } from '@dharma-ai-labs/agent-fabric-policy';
 export interface SkillBundle {
-    schema: 'dharma.skill-bundle/v1';
+    schema: 'dharma.skill-bundle/v2';
     bundleId: string;
     organizationId: string;
     version: string;
@@ -21,7 +21,12 @@ export interface SkillBundle {
         }>;
     }>;
     riskClass: 'R0' | 'R1' | 'R2' | 'R3' | 'R4';
-    targetSelectors: Record<string, unknown>;
+    targetSelectors: {
+        organizationAgentIds: string[];
+        deviceIds: string[];
+        workspaceIds: string[];
+        providers: ProviderId[];
+    };
     activationPolicy: 'next_task' | 'next_session' | 'host_restart' | 'immediate_safe_reload';
     rollbackBundleId: string | null;
     evaluationReceiptId: string;
@@ -52,10 +57,46 @@ export interface InstallReceipt {
     receiptHash: string;
     signature: string;
 }
+export interface ActiveSkillBundleAuthorization {
+    bundleId: string;
+    activatedAt: string;
+    expiresAt: string | null;
+}
 declare function contentHash(path: string): Promise<string>;
 export declare function calculateBundleHash(bundle: Omit<SkillBundle, 'signature' | 'bundleHash'>): string;
 export declare function verifySkillBundle(bundle: SkillBundle, serverPublicKey: KeyObject, now?: Date): void;
-export declare function getActiveSkillBundleId(nativeSkillDirectory: string, workspaceId?: string): Promise<string | null>;
+export declare function getLegacySkillBundleIdForUpgrade(input: {
+    nativeSkillDirectory: string;
+    workspaceId: string;
+}): Promise<string | null>;
+export declare function getInstalledSkillBundleIdForRecovery(input: {
+    nativeSkillDirectory: string;
+    workspaceId: string;
+}): Promise<string | null>;
+export declare function getExpiredSkillBundleAuthorizationForReplacement(input: {
+    nativeSkillDirectory: string;
+    workspaceId: string;
+    provider: ProviderId;
+    organizationId: string;
+    organizationAgentId: string;
+    deviceId: string;
+    serverPublicKey: KeyObject;
+    devicePublicKey: KeyObject;
+    expectedReceiptHash: string;
+    now?: Date;
+}): Promise<ActiveSkillBundleAuthorization | null>;
+export declare function getActiveSkillBundleAuthorization(input: {
+    nativeSkillDirectory: string;
+    workspaceId: string;
+    provider: ProviderId;
+    organizationId: string;
+    organizationAgentId: string;
+    deviceId: string;
+    serverPublicKey: KeyObject;
+    devicePublicKey: KeyObject;
+    expectedReceiptHash: string;
+    now?: Date;
+}): Promise<ActiveSkillBundleAuthorization | null>;
 export declare function installSkillBundle(input: {
     bundle: SkillBundle;
     sourceDirectory: string;
@@ -64,10 +105,16 @@ export declare function installSkillBundle(input: {
     serverPublicKey: KeyObject;
     devicePrivateKey: KeyObject;
     deviceId: string;
+    organizationAgentId: string;
     workspaceId: string;
     provider: ProviderId;
     smokeCommandId?: string;
     organizationApprovalId?: string;
 }): Promise<InstallReceipt>;
+export declare function rollbackUnconfirmedSkillBundle(input: {
+    nativeSkillDirectory: string;
+    workspaceId: string;
+    receipt: InstallReceipt;
+}): Promise<void>;
 export { contentHash };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAoE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC3I,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAExG,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,gBAAgB,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,uBAAuB,CAAC;IAC1F,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACjG,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAUD,iBAAe,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBxD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,YAAY,CAAC,GAAG,MAAM,CAEjG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,OAAa,GAAG,IAAI,CAMzG;AA4HD,wBAAsB,sBAAsB,CAAC,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,0BAM9F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,SAAS,CAAC;IAC3B,gBAAgB,EAAE,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,OAAO,CAAC,cAAc,CAAC,CAmG1B;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAoE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC3I,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAExG,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5C,eAAe,EAAE;QACf,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,SAAS,EAAE,UAAU,EAAE,CAAC;KACzB,CAAC;IACF,gBAAgB,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,uBAAuB,CAAC;IAC1F,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACjG,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAUD,iBAAe,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBxD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,YAAY,CAAC,GAAG,MAAM,CAEjG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,OAAa,GAAG,IAAI,CAuBzG;AA4FD,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC5D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BzB;AAED,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BzB;AAED,wBAAsB,gDAAgD,CAAC,KAAK,EAAE;IAC5E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,SAAS,CAAC;IAC3B,eAAe,EAAE,SAAS,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CA0BjD;AAoKD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,SAAS,CAAC;IAC3B,eAAe,EAAE,SAAS,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAsBjD;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,SAAS,CAAC;IAC3B,gBAAgB,EAAE,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2I1B;AAED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/index.js

@@ -36,14 +36,43 @@ export function calculateBundleHash(bundle) {
     return sha256(canonicalize(bundle));
 }
 export function verifySkillBundle(bundle, serverPublicKey, now = new Date()) {
-    if (bundle.expiresAt && Date.parse(bundle.expiresAt) <= now.getTime())
-        throw new Error('Skill bundle has expired.');
+    if (bundle.schema !== 'dharma.skill-bundle/v2') {
+        throw new Error('Skill bundle schema is not authorized for installation or task execution.');
+    }
+    if (bundle.expiresAt) {
+        const expiresAt = Date.parse(bundle.expiresAt);
+        if (!Number.isFinite(expiresAt))
+            throw new Error('Skill bundle expiry is invalid.');
+        if (expiresAt <= now.getTime())
+            throw new Error('Skill bundle has expired.');
+    }
     const { signature, ...unsigned } = bundle;
     if (!verifyCanonicalObject(unsigned, signature, serverPublicKey))
         throw new Error('Skill bundle signature is invalid.');
     const { bundleHash, ...hashInput } = unsigned;
     if (bundleHash !== calculateBundleHash(hashInput))
         throw new Error('Skill bundle hash is invalid.');
+    const selectors = bundle.targetSelectors;
+    if (!selectors || typeof selectors !== 'object'
+        || !Array.isArray(selectors.organizationAgentIds) || !Array.isArray(selectors.deviceIds)
+        || !Array.isArray(selectors.workspaceIds) || !Array.isArray(selectors.providers)
+        || selectors.organizationAgentIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.deviceIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.workspaceIds.some((value) => typeof value !== 'string' || !value)
+        || selectors.providers.some((value) => !['codex', 'claude', 'agy'].includes(value))) {
+        throw new Error('Skill bundle target selectors are invalid.');
+    }
+}
+function assertTargetSelector(selector, value, label) {
+    if (selector.length > 0 && !selector.includes(value)) {
+        throw new Error(`Skill bundle is not authorized for this ${label}.`);
+    }
+}
+function assertBundleTargetsEndpoint(bundle, endpoint) {
+    assertTargetSelector(bundle.targetSelectors.organizationAgentIds, endpoint.organizationAgentId, 'repository agent');
+    assertTargetSelector(bundle.targetSelectors.deviceIds, endpoint.deviceId, 'device');
+    assertTargetSelector(bundle.targetSelectors.workspaceIds, endpoint.workspaceId, 'workspace');
+    assertTargetSelector(bundle.targetSelectors.providers, endpoint.provider, 'provider');
 }
 async function runSmoke(commandId, policy, cwd) {
     const command = resolveRegisteredCommand(policy, commandId);
@@ -60,15 +89,51 @@ async function runSmoke(commandId, policy, cwd) {
         });
     });
 }
-async function readActiveBundleId(root) {
+async function readActiveBundlePointer(root) {
+    let bundleId;
     try {
-        return (await readFile(resolve(root, 'ACTIVE_BUNDLE'), 'utf8')).trim() || null;
+        bundleId = (await readFile(resolve(root, 'ACTIVE_BUNDLE'), 'utf8')).trim();
     }
     catch (error) {
         if (error.code === 'ENOENT')
             return null;
         throw error;
     }
+    if (!bundleId)
+        return null;
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw new Error('Active bundle manifest is missing for the installed bundle pointer.');
+        }
+        throw error;
+    }
+    if (manifest.bundleId !== bundleId) {
+        throw new Error('Active bundle pointer does not match the installed release manifest.');
+    }
+    return bundleId;
+}
+function verifyInstallReceipt(receipt, devicePublicKey, expected, now) {
+    const { signature, ...signed } = receipt;
+    if (!verifyCanonicalObject(signed, signature, devicePublicKey))
+        throw new Error('Active bundle install receipt signature is invalid.');
+    const { receiptHash, ...hashInput } = signed;
+    if (receiptHash !== sha256(canonicalize(hashInput)))
+        throw new Error('Active bundle install receipt hash is invalid.');
+    if (receipt.status !== 'active')
+        throw new Error('Active bundle install receipt is not active.');
+    if (receipt.bundleId !== expected.bundleId || receipt.organizationId !== expected.organizationId
+        || receipt.deviceId !== expected.deviceId || receipt.workspaceId !== expected.workspaceId || receipt.provider !== expected.provider) {
+        throw new Error('Active bundle install receipt does not match the selected endpoint.');
+    }
+    const startedAt = Date.parse(receipt.startedAt);
+    const completedAt = Date.parse(receipt.completedAt);
+    if (!Number.isFinite(startedAt) || !Number.isFinite(completedAt) || completedAt < startedAt || completedAt > now.getTime() + 5_000) {
+        throw new Error('Active bundle install receipt has an invalid activation window.');
+    }
 }
 function workspaceManagedRoot(nativeSkillDirectory, workspaceId) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(workspaceId)) {
@@ -76,6 +141,101 @@ function workspaceManagedRoot(nativeSkillDirectory, workspaceId) {
     }
     return resolve(nativeSkillDirectory, '.dharma-managed', 'workspaces', workspaceId);
 }
+export async function getLegacySkillBundleIdForUpgrade(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(bundleId)) {
+        throw new Error('Legacy skill bundle identifier is invalid.');
+    }
+    let authorization;
+    let source = 'authorization';
+    try {
+        authorization = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        source = 'legacy_manifest';
+        authorization = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    if (authorization.bundleId !== bundleId)
+        return null;
+    if (source === 'authorization') {
+        if (authorization.schema !== 'dharma.skill-bundle/v1')
+            return null;
+    }
+    else if (authorization.schema !== undefined
+        || authorization.workspaceId !== input.workspaceId
+        || !Array.isArray(authorization.skillIds)
+        || !authorization.skillIds.every((skillId) => typeof skillId === 'string' && skillId.length > 0)) {
+        return null;
+    }
+    return bundleId;
+}
+export async function getInstalledSkillBundleIdForRecovery(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(bundleId)) {
+        throw new Error('Installed skill bundle identifier is invalid.');
+    }
+    let manifest;
+    let source = 'authorization';
+    try {
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        source = 'legacy-manifest';
+        manifest = JSON.parse(await readFile(resolve(root, 'active', 'BUNDLE.json'), 'utf8'));
+    }
+    const authorizedManifest = source === 'authorization'
+        && ['dharma.skill-bundle/v1', 'dharma.skill-bundle/v2'].includes(String(manifest.schema));
+    const legacyInstallManifest = source === 'legacy-manifest'
+        && manifest.schema === undefined
+        && manifest.workspaceId === input.workspaceId
+        && Array.isArray(manifest.skillIds)
+        && manifest.skillIds.every((skillId) => typeof skillId === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skillId));
+    if ((!authorizedManifest && !legacyInstallManifest) || manifest.bundleId !== bundleId) {
+        throw new Error('Installed skill recovery metadata is invalid.');
+    }
+    return bundleId;
+}
+export async function getExpiredSkillBundleAuthorizationForReplacement(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    const bundle = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    const receipt = JSON.parse(await readFile(resolve(root, 'active', 'INSTALL_RECEIPT.json'), 'utf8'));
+    const now = input.now ?? new Date();
+    const expiresAt = Date.parse(String(bundle.expiresAt || ''));
+    if (!Number.isFinite(expiresAt) || expiresAt > now.getTime()) {
+        throw new Error('Installed skill bundle is not an expired replacement candidate.');
+    }
+    if (bundle.bundleId !== bundleId)
+        throw new Error('Active bundle pointer does not match the signed release authorization.');
+    verifySkillBundle(bundle, input.serverPublicKey, new Date(expiresAt - 1));
+    assertBundleTargetsEndpoint(bundle, input);
+    verifyInstallReceipt(receipt, input.devicePublicKey, {
+        bundleId,
+        organizationId: input.organizationId,
+        deviceId: input.deviceId,
+        workspaceId: input.workspaceId,
+        provider: input.provider,
+    }, now);
+    if (receipt.receiptHash !== input.expectedReceiptHash) {
+        throw new Error('Active bundle receipt is not the current protected authorization.');
+    }
+    return { bundleId, activatedAt: receipt.completedAt, expiresAt: bundle.expiresAt ?? null };
+}
 async function pathExists(path) {
     try {
         await lstat(path);
@@ -156,16 +316,110 @@ async function activateNativeSkills(input) {
         await rm(transactionRoot, { recursive: true, force: true });
     }
 }
-export async function getActiveSkillBundleId(nativeSkillDirectory, workspaceId) {
-    return readActiveBundleId(workspaceId
-        ? workspaceManagedRoot(nativeSkillDirectory, workspaceId)
-        : resolve(nativeSkillDirectory, '.dharma-managed'));
+async function nativeSkillIdsOwnedByWorkspace(nativeSkillDirectory, workspaceId) {
+    let entries;
+    try {
+        entries = await readdir(nativeSkillDirectory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(entry.name))
+            continue;
+        try {
+            const marker = JSON.parse(await readFile(resolve(nativeSkillDirectory, entry.name, '.dharma-agent-fabric.json'), 'utf8'));
+            if (marker.workspaceId === workspaceId)
+                owned.push(entry.name);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return owned;
+}
+async function recoverInterruptedSkillRollbacks(nativeSkillDirectory, workspaceId) {
+    const managedRoot = workspaceManagedRoot(nativeSkillDirectory, workspaceId);
+    let entries;
+    try {
+        entries = await readdir(managedRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    for (const entry of entries.filter((candidate) => candidate.isDirectory() && candidate.name.startsWith('.rollback-'))) {
+        const transactionRoot = assertContained(managedRoot, resolve(managedRoot, entry.name));
+        const manifest = JSON.parse(await readFile(resolve(transactionRoot, 'ROLLBACK_RECOVERY.json'), 'utf8'));
+        if (manifest.schema !== 'dharma.skill-rollback-recovery/v1'
+            || manifest.workspaceId !== workspaceId
+            || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(manifest.currentBundleId)
+            || !Array.isArray(manifest.currentSkillIds)
+            || manifest.currentSkillIds.some((skillId) => typeof skillId !== 'string'
+                || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skillId))) {
+            throw new Error('Interrupted skill rollback recovery metadata is invalid.');
+        }
+        const releases = resolve(managedRoot, 'releases');
+        const currentRelease = assertContained(releases, resolve(releases, manifest.currentBundleId));
+        const active = resolve(managedRoot, 'active');
+        const backupActive = resolve(transactionRoot, 'backup-active');
+        if (await pathExists(backupActive)) {
+            await rm(active, { recursive: true, force: true });
+            await rename(backupActive, active);
+        }
+        else if (!await pathExists(active)) {
+            await cp(currentRelease, active, { recursive: true, errorOnExist: true, force: false });
+        }
+        await activateNativeSkills({
+            nativeSkillDirectory,
+            release: currentRelease,
+            bundleId: manifest.currentBundleId,
+            workspaceId,
+            skillIds: manifest.currentSkillIds,
+            removeSkillIds: await nativeSkillIdsOwnedByWorkspace(nativeSkillDirectory, workspaceId),
+        });
+        const pointerTemp = resolve(transactionRoot, 'ACTIVE_BUNDLE.recovery');
+        await writeFile(pointerTemp, `${manifest.currentBundleId}\n`, { mode: 0o600 });
+        await rename(pointerTemp, resolve(managedRoot, 'ACTIVE_BUNDLE'));
+        await rm(transactionRoot, { recursive: true, force: true });
+    }
+}
+export async function getActiveSkillBundleAuthorization(input) {
+    const root = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const bundleId = await readActiveBundlePointer(root);
+    if (!bundleId)
+        return null;
+    const bundle = JSON.parse(await readFile(resolve(root, 'active', 'AUTHORIZATION.json'), 'utf8'));
+    const receipt = JSON.parse(await readFile(resolve(root, 'active', 'INSTALL_RECEIPT.json'), 'utf8'));
+    const now = input.now ?? new Date();
+    if (bundle.bundleId !== bundleId)
+        throw new Error('Active bundle pointer does not match the signed release authorization.');
+    verifySkillBundle(bundle, input.serverPublicKey, now);
+    assertBundleTargetsEndpoint(bundle, input);
+    verifyInstallReceipt(receipt, input.devicePublicKey, {
+        bundleId,
+        organizationId: input.organizationId,
+        deviceId: input.deviceId,
+        workspaceId: input.workspaceId,
+        provider: input.provider,
+    }, now);
+    if (receipt.receiptHash !== input.expectedReceiptHash) {
+        throw new Error('Active bundle receipt is not the current protected authorization.');
+    }
+    return { bundleId, activatedAt: receipt.completedAt, expiresAt: bundle.expiresAt ?? null };
 }
 export async function installSkillBundle(input) {
     const startedAt = new Date().toISOString();
     verifySkillBundle(input.bundle, input.serverPublicKey);
     if (input.bundle.organizationId !== input.policy.organizationId)
         throw new Error('Bundle organization does not match policy.');
+    assertBundleTargetsEndpoint(input.bundle, input);
     if (input.bundle.operation === 'clear' && input.bundle.skills.length !== 0)
         throw new Error('Clear bundles cannot contain skills.');
     if (input.bundle.operation === 'install' && input.bundle.skills.length === 0)
@@ -176,11 +430,12 @@ export async function installSkillBundle(input) {
     if (!input.policy.skills.automaticInstall)
         throw new Error('Automatic skill installation is disabled by policy.');
     const managedRoot = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
     const releases = resolve(managedRoot, 'releases');
     const release = assertContained(releases, resolve(releases, input.bundle.bundleId));
     const active = resolve(managedRoot, 'active');
     const rollback = resolve(managedRoot, 'rollback');
-    const previousBundleId = await readActiveBundleId(managedRoot);
+    const previousBundleId = await readActiveBundlePointer(managedRoot);
     await mkdir(releases, { recursive: true, mode: 0o700 });
     await rm(release, { recursive: true, force: true });
     await mkdir(release, { recursive: true, mode: 0o700 });
@@ -197,6 +452,7 @@ export async function installSkillBundle(input) {
     }
     const skillIds = input.bundle.skills.map((skill) => skill.skillId);
     await writeFile(resolve(release, 'BUNDLE.json'), `${JSON.stringify({ bundleId: input.bundle.bundleId, workspaceId: input.workspaceId, skillIds })}\n`, { mode: 0o600 });
+    await writeFile(resolve(release, 'AUTHORIZATION.json'), `${JSON.stringify(input.bundle)}\n`, { mode: 0o600 });
     const previousRelease = previousBundleId ? resolve(releases, previousBundleId) : null;
     const previousSkillIds = previousRelease ? await releaseSkillIds(previousRelease) : [];
     await rm(rollback, { recursive: true, force: true });
@@ -217,39 +473,47 @@ export async function installSkillBundle(input) {
         removeSkillIds: previousSkillIds,
     });
     let status = 'active';
+    const restorePreviousBundle = async () => {
+        await rm(active, { recursive: true, force: true });
+        let restored = 'failed';
+        try {
+            await rename(rollback, active);
+            restored = 'rolled_back';
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        await activateNativeSkills({
+            nativeSkillDirectory: input.nativeSkillDirectory,
+            release: previousRelease || release,
+            bundleId: previousBundleId || input.bundle.bundleId,
+            workspaceId: input.workspaceId,
+            skillIds: previousBundleId ? previousSkillIds : [],
+            removeSkillIds: skillIds,
+        });
+        return restored;
+    };
     if (input.smokeCommandId) {
         const check = await runSmoke(input.smokeCommandId, input.policy, active);
         checks.push({ name: `smoke:${input.smokeCommandId}`, ...check });
         if (check.status === 'fail') {
-            await rm(active, { recursive: true, force: true });
-            try {
-                await rename(rollback, active);
-                status = 'rolled_back';
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-                status = 'failed';
-            }
-            await activateNativeSkills({
-                nativeSkillDirectory: input.nativeSkillDirectory,
-                release: previousRelease || release,
-                bundleId: previousBundleId || input.bundle.bundleId,
-                workspaceId: input.workspaceId,
-                skillIds: previousBundleId ? previousSkillIds : [],
-                removeSkillIds: skillIds,
-            });
+            status = await restorePreviousBundle();
         }
     }
     if (status === 'active') {
-        await rm(rollback, { recursive: true, force: true });
-        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${input.bundle.bundleId}\n`, { mode: 0o600 });
-    }
-    else if (previousBundleId) {
-        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
-    }
-    else {
-        await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+        try {
+            verifySkillBundle(input.bundle, input.serverPublicKey);
+            checks.push({ name: 'authorization:activation-window', status: 'pass', details: input.bundle.expiresAt || 'no-expiry' });
+        }
+        catch (error) {
+            checks.push({
+                name: 'authorization:activation-window',
+                status: 'fail',
+                details: error instanceof Error ? error.message : String(error),
+            });
+            status = await restorePreviousBundle();
+        }
     }
     const receiptBase = {
         schema: 'dharma.install-receipt/v1',
@@ -269,7 +533,148 @@ export async function installSkillBundle(input) {
     };
     const receiptHash = sha256(canonicalize(receiptBase));
     const signature = signCanonicalObject({ ...receiptBase, receiptHash }, input.devicePrivateKey);
-    return { ...receiptBase, receiptHash, signature };
+    const receipt = { ...receiptBase, receiptHash, signature };
+    if (status === 'active') {
+        try {
+            await writeFile(resolve(release, 'INSTALL_RECEIPT.json'), `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+            await writeFile(resolve(active, 'INSTALL_RECEIPT.json'), `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+            await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${input.bundle.bundleId}\n`, { mode: 0o600 });
+        }
+        catch (error) {
+            const recoveryErrors = [];
+            try {
+                await restorePreviousBundle();
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+            try {
+                if (previousBundleId) {
+                    await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
+                }
+                else {
+                    await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+                }
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+            if (recoveryErrors.length) {
+                throw new AggregateError([error, ...recoveryErrors], 'Skill receipt persistence failed and local recovery was incomplete.');
+            }
+            throw error;
+        }
+    }
+    else if (previousBundleId) {
+        await writeFile(resolve(managedRoot, 'ACTIVE_BUNDLE'), `${previousBundleId}\n`, { mode: 0o600 });
+    }
+    else {
+        await rm(resolve(managedRoot, 'ACTIVE_BUNDLE'), { force: true });
+    }
+    return receipt;
+}
+export async function rollbackUnconfirmedSkillBundle(input) {
+    if (input.receipt.status !== 'active')
+        return;
+    const managedRoot = workspaceManagedRoot(input.nativeSkillDirectory, input.workspaceId);
+    await recoverInterruptedSkillRollbacks(input.nativeSkillDirectory, input.workspaceId);
+    const activeBundleId = await readActiveBundlePointer(managedRoot);
+    if (activeBundleId !== input.receipt.bundleId) {
+        throw new Error('Refusing to roll back an installation that is no longer the active local bundle.');
+    }
+    const releases = resolve(managedRoot, 'releases');
+    const active = resolve(managedRoot, 'active');
+    const currentRelease = assertContained(releases, resolve(releases, input.receipt.bundleId));
+    const currentSkillIds = await releaseSkillIds(currentRelease);
+    const previousBundleId = input.receipt.previousBundleId;
+    const previousRelease = previousBundleId
+        ? assertContained(releases, resolve(releases, previousBundleId))
+        : null;
+    const previousSkillIds = previousRelease ? await releaseSkillIds(previousRelease) : [];
+    const transactionRoot = assertContained(managedRoot, resolve(managedRoot, `.rollback-${randomUUID()}`));
+    const stagedActive = resolve(transactionRoot, 'staged-active');
+    const backupActive = resolve(transactionRoot, 'backup-active');
+    const pointer = resolve(managedRoot, 'ACTIVE_BUNDLE');
+    const pointerTemp = resolve(transactionRoot, 'ACTIVE_BUNDLE.next');
+    let nativeChanged = false;
+    let activeMoved = false;
+    let stagedMoved = false;
+    let preserveRecovery = false;
+    await mkdir(transactionRoot, { recursive: true, mode: 0o700 });
+    await writeFile(resolve(transactionRoot, 'ROLLBACK_RECOVERY.json'), `${JSON.stringify({
+        schema: 'dharma.skill-rollback-recovery/v1',
+        workspaceId: input.workspaceId,
+        currentBundleId: input.receipt.bundleId,
+        currentSkillIds,
+    })}\n`, { mode: 0o600 });
+    if (previousRelease) {
+        await cp(previousRelease, stagedActive, { recursive: true, errorOnExist: true, force: false });
+    }
+    try {
+        await activateNativeSkills({
+            nativeSkillDirectory: input.nativeSkillDirectory,
+            release: previousRelease || currentRelease,
+            bundleId: previousBundleId || input.receipt.bundleId,
+            workspaceId: input.workspaceId,
+            skillIds: previousSkillIds,
+            removeSkillIds: currentSkillIds,
+        });
+        nativeChanged = true;
+        await rename(active, backupActive);
+        activeMoved = true;
+        if (previousRelease) {
+            await rename(stagedActive, active);
+            stagedMoved = true;
+            await writeFile(pointerTemp, `${previousBundleId}\n`, { mode: 0o600 });
+            await rename(pointerTemp, pointer);
+        }
+        else {
+            await rm(pointer, { force: true });
+        }
+    }
+    catch (error) {
+        const recoveryErrors = [];
+        if (activeMoved) {
+            try {
+                if (stagedMoved)
+                    await rm(active, { recursive: true, force: true });
+                await rename(backupActive, active);
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+        }
+        if (nativeChanged) {
+            try {
+                await activateNativeSkills({
+                    nativeSkillDirectory: input.nativeSkillDirectory,
+                    release: currentRelease,
+                    bundleId: input.receipt.bundleId,
+                    workspaceId: input.workspaceId,
+                    skillIds: currentSkillIds,
+                    removeSkillIds: previousSkillIds,
+                });
+            }
+            catch (recoveryError) {
+                recoveryErrors.push(recoveryError);
+            }
+        }
+        try {
+            await writeFile(pointer, `${input.receipt.bundleId}\n`, { mode: 0o600 });
+        }
+        catch (recoveryError) {
+            recoveryErrors.push(recoveryError);
+        }
+        if (recoveryErrors.length) {
+            preserveRecovery = true;
+            throw new AggregateError([error, ...recoveryErrors], 'Skill rollback failed and the active installation could not be fully restored.');
+        }
+        throw error;
+    }
+    finally {
+        if (!preserveRecovery)
+            await rm(transactionRoot, { recursive: true, force: true });
+    }
 }
 export { contentHash };
 //# sourceMappingURL=index.js.map