@nowcrew/daemon 0.6.88-beta.5 → 0.6.88-beta.7

package/dist/project-skills/projection-set-switch.js

@@ -0,0 +1,419 @@
+import { lstat, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { durableAtomicPrivateWrite, durableDirectorySync, durablePrivateUnlink, } from "../atomic-private-write.js";
+import { commitPreparedProjectSkillManifestUpdate, parseProjectSkillManifestUpdateRecord, preparedProjectSkillManifestUpdateFromRecord, projectSkillManifestUpdateRecord, publishPreparedProjectSkillManifestUpdate, rollbackPreparedProjectSkillManifestUpdate, } from "./projection-state.js";
+export const PROJECTION_ROOT_MARKER_NAME = ".nowcrew-project-skills-root.json";
+const JOURNAL_NAME = "project-skills-switch.json";
+const MAX_JOURNAL_BYTES = 768 * 1024;
+const MAX_ROOT_MARKER_BYTES = 16 * 1024;
+const NONCE = /^[A-Za-z0-9-]{1,128}$/u;
+const PHASES = new Set([
+    "prepared",
+    "codex:backup_moved",
+    "codex:activated",
+    "claude:backup_moved",
+    "claude:activated",
+    "committed",
+    "rolling_back",
+    "rollback_failed",
+]);
+const errorCode = (error) => error.code;
+export const projectionPathExists = async (path, statPath = lstat) => {
+    try {
+        await statPath(path);
+        return true;
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+};
+const exists = projectionPathExists;
+const sameIdentity = (left, right) => left.dev === right.dev
+    && left.ino === right.ino
+    && left.birthtimeNs === right.birthtimeNs;
+const directoryIdentity = async (path) => {
+    try {
+        const info = await lstat(path, { bigint: true });
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("projection_switch_path_unmanaged");
+        return Object.freeze({
+            dev: String(info.dev),
+            ino: String(info.ino),
+            birthtimeNs: String(info.birthtimeNs),
+        });
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return null;
+        throw error;
+    }
+};
+export const projectionSwitchJournalPath = (agentRoot) => join(agentRoot, ".crew", JOURNAL_NAME);
+export const projectionTargets = (agentRoot, nonce) => Object.freeze([
+    Object.freeze({
+        runtime: "codex",
+        target: join(agentRoot, ".agents", "skills"),
+        staging: join(agentRoot, ".agents", `.skills-next-${nonce}`),
+        backup: join(agentRoot, ".agents", `.skills-previous-${nonce}`),
+        discard: join(agentRoot, ".agents", `.skills-discard-${nonce}`),
+    }),
+    Object.freeze({
+        runtime: "claude",
+        target: join(agentRoot, ".crew", "claude-skills", ".claude", "skills"),
+        staging: join(agentRoot, ".crew", "claude-skills", ".claude", `.skills-next-${nonce}`),
+        backup: join(agentRoot, ".crew", "claude-skills", ".claude", `.skills-previous-${nonce}`),
+        discard: join(agentRoot, ".crew", "claude-skills", ".claude", `.skills-discard-${nonce}`),
+    }),
+]);
+const rootMarker = (target, nonce) => Object.freeze({
+    managedBy: "nowcrew-project-skills-root",
+    version: 1,
+    nonce,
+    runtime: target.runtime,
+    target: target.target,
+});
+const readRootMarker = async (root) => {
+    const markerPath = join(root, PROJECTION_ROOT_MARKER_NAME);
+    try {
+        const info = await lstat(markerPath);
+        if (!info.isFile() || info.isSymbolicLink() || Number(info.size) > MAX_ROOT_MARKER_BYTES)
+            return null;
+        const candidate = JSON.parse(await readFile(markerPath, "utf8"));
+        return candidate.managedBy === "nowcrew-project-skills-root"
+            && candidate.version === 1
+            && NONCE.test(candidate.nonce ?? "")
+            && (candidate.runtime === "codex" || candidate.runtime === "claude")
+            && typeof candidate.target === "string"
+            ? candidate
+            : null;
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT" || error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+};
+const markerMatches = (marker, target, nonce) => marker !== null
+    && marker.runtime === target.runtime
+    && marker.target === target.target
+    && (nonce === undefined || marker.nonce === nonce);
+const assertOwnedRoot = async (root, target, nonce) => {
+    const info = await directoryIdentity(root);
+    if (info === null || !markerMatches(await readRootMarker(root), target, nonce)) {
+        throw new Error("projection_switch_path_unmanaged");
+    }
+};
+export const markProjectionStaging = async (target, nonce) => {
+    await writeFile(join(target.staging, PROJECTION_ROOT_MARKER_NAME), JSON.stringify(rootMarker(target, nonce)), {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+    });
+};
+export const isManagedProjectionRoot = async (root, target) => markerMatches(await readRootMarker(root), target);
+export const cleanupProjectionStaging = async (target, nonce, syncDirectory = durableDirectorySync) => {
+    if (!await exists(target.staging))
+        return;
+    await assertOwnedRoot(target.staging, target, nonce);
+    await rm(target.staging, { recursive: true, force: true });
+    await syncDirectory(dirname(target.target));
+};
+const exactJournalTargets = (agentRoot, nonce, candidates) => {
+    const expected = projectionTargets(agentRoot, nonce);
+    return candidates.length === expected.length && expected.every((target, index) => {
+        const candidate = candidates[index];
+        return candidate?.runtime === target.runtime
+            && candidate.target === target.target
+            && candidate.staging === target.staging
+            && candidate.backup === target.backup
+            && candidate.discard === target.discard
+            && typeof candidate.hadPrevious === "boolean"
+            && (candidate.previousIdentity === null
+                || (typeof candidate.previousIdentity?.dev === "string"
+                    && typeof candidate.previousIdentity.ino === "string"
+                    && typeof candidate.previousIdentity.birthtimeNs === "string"))
+            && typeof candidate.activatedIdentity?.dev === "string"
+            && typeof candidate.activatedIdentity.ino === "string"
+            && typeof candidate.activatedIdentity.birthtimeNs === "string";
+    });
+};
+const parseJournal = (raw, agentRoot) => {
+    const candidate = JSON.parse(raw);
+    if (candidate.managedBy !== "nowcrew-project-skills-switch"
+        || candidate.version !== 1
+        || !NONCE.test(candidate.nonce ?? "")
+        || !PHASES.has(candidate.phase)
+        || !Array.isArray(candidate.targets)
+        || !exactJournalTargets(agentRoot, candidate.nonce, candidate.targets)
+        || Object.keys(candidate).some((key) => ![
+            "managedBy", "version", "nonce", "phase", "targets", "manifestUpdate",
+        ].includes(key))) {
+        throw new Error("projection_switch_journal_invalid");
+    }
+    const manifestUpdate = candidate.manifestUpdate === undefined
+        ? undefined
+        : parseProjectSkillManifestUpdateRecord(candidate.manifestUpdate);
+    return Object.freeze({
+        managedBy: "nowcrew-project-skills-switch",
+        version: 1,
+        nonce: candidate.nonce,
+        phase: candidate.phase,
+        targets: candidate.targets,
+        ...(manifestUpdate === undefined ? {} : { manifestUpdate }),
+    });
+};
+const readJournal = async (agentRoot) => {
+    const path = projectionSwitchJournalPath(agentRoot);
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return null;
+        throw error;
+    }
+    if (!info.isFile() || info.isSymbolicLink() || Number(info.size) > MAX_JOURNAL_BYTES) {
+        throw new Error("projection_switch_journal_invalid");
+    }
+    return parseJournal(await readFile(path, "utf8"), agentRoot);
+};
+const writeJournal = async (agentRoot, journal) => durableAtomicPrivateWrite(projectionSwitchJournalPath(agentRoot), `${JSON.stringify(journal)}\n`);
+const withPhase = (journal, phase) => Object.freeze({ ...journal, phase });
+const unlinkExactJournal = async (agentRoot, nonce) => {
+    const current = await readJournal(agentRoot);
+    if (current === null)
+        return;
+    if (current.nonce !== nonce)
+        throw new Error("projection_switch_journal_invalid");
+    await durablePrivateUnlink(projectionSwitchJournalPath(agentRoot));
+};
+const assertPrevious = async (path, expected) => {
+    const actual = await directoryIdentity(path);
+    if (actual === null || !sameIdentity(actual, expected))
+        throw new Error("projection_switch_backup_unmanaged");
+};
+const assertActivated = async (path, target, nonce) => {
+    await assertOwnedRoot(path, target, nonce);
+    await assertPrevious(path, target.activatedIdentity);
+};
+const cleanupDiscard = async (target, journal, syncDirectory) => {
+    const discardIdentity = await directoryIdentity(target.discard);
+    if (discardIdentity === null)
+        return;
+    if (target.previousIdentity !== null && sameIdentity(discardIdentity, target.previousIdentity)) {
+        await rm(target.discard, { recursive: true, force: true });
+        await syncDirectory(dirname(target.target));
+        return;
+    }
+    await assertActivated(target.discard, target, journal.nonce);
+    await rm(target.discard, { recursive: true, force: true });
+    await syncDirectory(dirname(target.target));
+};
+const finalizeCommitted = async (agentRoot, journal, syncDirectory, manifestOperations, unlinkJournal = unlinkExactJournal) => {
+    for (const target of journal.targets)
+        await assertActivated(target.target, target, journal.nonce);
+    const manifestUpdate = journal.manifestUpdate === undefined
+        ? null
+        : preparedProjectSkillManifestUpdateFromRecord(agentRoot, journal.manifestUpdate);
+    if (manifestUpdate !== null)
+        await manifestOperations.publish(manifestUpdate);
+    for (const target of journal.targets) {
+        if (target.hadPrevious && await exists(target.backup)) {
+            if (target.previousIdentity === null)
+                throw new Error("projection_switch_backup_unmanaged");
+            await assertPrevious(target.backup, target.previousIdentity);
+            if (await exists(target.discard))
+                throw new Error("projection_switch_path_unmanaged");
+            await rename(target.backup, target.discard);
+            await syncDirectory(dirname(target.target));
+            await assertPrevious(target.discard, target.previousIdentity);
+        }
+        if (await exists(target.discard)) {
+            if (target.previousIdentity === null)
+                throw new Error("projection_switch_backup_unmanaged");
+            await assertPrevious(target.discard, target.previousIdentity);
+            await rm(target.discard, { recursive: true, force: true });
+            await syncDirectory(dirname(target.target));
+        }
+        await cleanupProjectionStaging(target, journal.nonce, syncDirectory);
+    }
+    for (const target of journal.targets)
+        await syncDirectory(dirname(target.target));
+    if (manifestUpdate !== null)
+        await manifestOperations.commit(manifestUpdate);
+    await unlinkJournal(agentRoot, journal.nonce);
+};
+const rollback = async (agentRoot, journal, syncDirectory, manifestOperations) => {
+    let currentJournal = withPhase(journal, "rolling_back");
+    await writeJournal(agentRoot, currentJournal);
+    try {
+        for (const target of [...currentJournal.targets].reverse()) {
+            const currentIdentity = await directoryIdentity(target.target);
+            const currentIsPrevious = currentIdentity !== null
+                && target.previousIdentity !== null
+                && sameIdentity(currentIdentity, target.previousIdentity);
+            if (!currentIsPrevious && currentIdentity !== null) {
+                await assertActivated(target.target, target, currentJournal.nonce);
+                if (await exists(target.discard))
+                    throw new Error("projection_switch_path_unmanaged");
+                await rename(target.target, target.discard);
+                await syncDirectory(dirname(target.target));
+                await assertActivated(target.discard, target, currentJournal.nonce);
+            }
+            const afterActivationRemoved = await directoryIdentity(target.target);
+            if (target.hadPrevious) {
+                if (target.previousIdentity === null)
+                    throw new Error("projection_switch_backup_unmanaged");
+                if (afterActivationRemoved === null) {
+                    await assertPrevious(target.backup, target.previousIdentity);
+                    await rename(target.backup, target.target);
+                    await syncDirectory(dirname(target.target));
+                    await assertPrevious(target.target, target.previousIdentity);
+                }
+                else if (!sameIdentity(afterActivationRemoved, target.previousIdentity)) {
+                    throw new Error("projection_switch_path_unmanaged");
+                }
+            }
+            else if (afterActivationRemoved !== null) {
+                throw new Error("projection_switch_path_unmanaged");
+            }
+            await cleanupDiscard(target, currentJournal, syncDirectory);
+            await cleanupProjectionStaging(target, currentJournal.nonce, syncDirectory);
+        }
+        if (currentJournal.manifestUpdate !== undefined) {
+            await manifestOperations.rollback(preparedProjectSkillManifestUpdateFromRecord(agentRoot, currentJournal.manifestUpdate));
+        }
+        for (const target of currentJournal.targets)
+            await syncDirectory(dirname(target.target));
+        await unlinkExactJournal(agentRoot, currentJournal.nonce);
+    }
+    catch (error) {
+        currentJournal = withPhase(currentJournal, "rollback_failed");
+        await writeJournal(agentRoot, currentJournal);
+        throw error;
+    }
+};
+export const recoverProjectionSwitch = async (agentRoot, syncDirectory = durableDirectorySync, manifestOperations = {}) => {
+    const operations = {
+        publish: manifestOperations.publish ?? publishPreparedProjectSkillManifestUpdate,
+        commit: manifestOperations.commit ?? commitPreparedProjectSkillManifestUpdate,
+        rollback: manifestOperations.rollback ?? rollbackPreparedProjectSkillManifestUpdate,
+    };
+    const journal = await readJournal(agentRoot);
+    if (journal === null)
+        return;
+    if (journal.phase === "committed") {
+        await finalizeCommitted(agentRoot, journal, syncDirectory, operations);
+        return;
+    }
+    await rollback(agentRoot, journal, syncDirectory, operations);
+};
+/**
+ * Switches the Codex/Claude roots as one recoverable projection set while the Agent coordinator lock is held.
+ * This is not a mythical two-directory filesystem transaction: each root is individually published by rename,
+ * so a mixed pair may exist inside the locked switch interval. Every bounded, path-exact journal phase fsyncs its
+ * temporary contents before rename and its parent directory afterward. Each target-parent mutation is also fsynced:
+ * activations before the durable commit phase, and restoration/cleanup plus a final parent barrier before journal
+ * deletion. A v2 state publication is bound into the same journal: recovery rolls every pre-commit phase back to
+ * the recorded prior roots and manifest, while a durable committed phase can only finish the next pair's cleanup.
+ * No launch using this coordinator observes a successfully returned mixed set. Activated roots require both their
+ * nonce marker and their recorded filesystem identity before rollback cleanup.
+ */
+export const switchProjectionSet = async (agentRoot, targets, nonce, fault, syncDirectory = durableDirectorySync, publication) => {
+    const manifestOperations = {
+        publish: publication?.operations?.publish ?? publishPreparedProjectSkillManifestUpdate,
+        commit: publication?.operations?.commit ?? commitPreparedProjectSkillManifestUpdate,
+        rollback: publication?.operations?.rollback ?? rollbackPreparedProjectSkillManifestUpdate,
+    };
+    const journalTargets = [];
+    try {
+        if (!NONCE.test(nonce) || targets.length !== 2)
+            throw new Error("projection_switch_journal_invalid");
+        const expected = projectionTargets(agentRoot, nonce);
+        if (targets.some((target, index) => JSON.stringify(target) !== JSON.stringify(expected[index]))) {
+            throw new Error("projection_switch_journal_invalid");
+        }
+        for (const target of targets) {
+            await assertOwnedRoot(target.staging, target, nonce);
+            if (await exists(target.backup) || await exists(target.discard)) {
+                throw new Error("projection_switch_path_unmanaged");
+            }
+            const previousIdentity = await directoryIdentity(target.target);
+            const activatedIdentity = await directoryIdentity(target.staging);
+            if (activatedIdentity === null)
+                throw new Error("projection_switch_path_unmanaged");
+            journalTargets.push(Object.freeze({
+                ...target,
+                hadPrevious: previousIdentity !== null,
+                previousIdentity,
+                activatedIdentity,
+            }));
+        }
+    }
+    catch (error) {
+        if (publication !== undefined)
+            await manifestOperations.rollback(publication.update);
+        throw error;
+    }
+    let journal = Object.freeze({
+        managedBy: "nowcrew-project-skills-switch",
+        version: 1,
+        nonce,
+        phase: "prepared",
+        targets: Object.freeze(journalTargets),
+        ...(publication === undefined
+            ? {}
+            : { manifestUpdate: projectSkillManifestUpdateRecord(publication.update) }),
+    });
+    try {
+        await writeJournal(agentRoot, journal);
+    }
+    catch (error) {
+        if (publication !== undefined)
+            await manifestOperations.rollback(publication.update);
+        throw error;
+    }
+    let committedDurable = false;
+    try {
+        await fault?.(journal.phase);
+        for (const target of journal.targets) {
+            if (target.hadPrevious) {
+                await rename(target.target, target.backup);
+                await syncDirectory(dirname(target.target));
+                await assertPrevious(target.backup, target.previousIdentity);
+            }
+            journal = withPhase(journal, `${target.runtime}:backup_moved`);
+            await writeJournal(agentRoot, journal);
+            await fault?.(journal.phase);
+            await rename(target.staging, target.target);
+            await syncDirectory(dirname(target.target));
+            await assertActivated(target.target, target, nonce);
+            journal = withPhase(journal, `${target.runtime}:activated`);
+            await writeJournal(agentRoot, journal);
+            await fault?.(journal.phase);
+        }
+        if (publication !== undefined) {
+            await manifestOperations.publish(publication.update);
+            await publication.verify();
+            await publication.afterPublishedBeforeCommit?.();
+        }
+        const committedJournal = withPhase(journal, "committed");
+        await writeJournal(agentRoot, committedJournal);
+        journal = committedJournal;
+        committedDurable = true;
+        await fault?.(journal.phase);
+        await finalizeCommitted(agentRoot, journal, syncDirectory, manifestOperations, publication?.unlinkJournal);
+    }
+    catch (error) {
+        if (committedDurable)
+            throw error;
+        const persisted = await readJournal(agentRoot);
+        if (persisted?.phase === "committed")
+            throw error;
+        await rollback(agentRoot, persisted ?? journal, syncDirectory, manifestOperations);
+        throw error;
+    }
+};

package/dist/project-skills/projection-state-domain.js

@@ -0,0 +1,170 @@
+import { createHash } from "node:crypto";
+import { posix, win32 } from "node:path";
+import { z } from "zod";
+import { compareProjectSkillRefs, isProjectId, isProjectSkillName, MAX_AGENT_PROJECT_SKILL_BINDINGS, MAX_PROJECT_ID_LENGTH, MAX_PROJECT_SKILL_NAME_LENGTH, } from "./types.js";
+const MANAGED_BY = "nowcrew-project-skills-v2";
+const MAX_SOURCE_PATH_BYTES = 16 * 1024;
+const MAX_GENERATION = 2_147_483_647;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const CANONICAL_ROOT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+export class ProjectSkillProjectionStateError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "ProjectSkillProjectionStateError";
+    }
+}
+const corrupt = () => {
+    throw new ProjectSkillProjectionStateError("skill_projection_state_corrupt");
+};
+const unmanaged = () => {
+    throw new ProjectSkillProjectionStateError("skill_projection_state_unmanaged");
+};
+const immutableBinding = (binding) => Object.freeze({
+    projectId: binding.projectId,
+    skillName: binding.skillName,
+});
+const canonicalBindings = (bindings) => {
+    if (bindings.length > MAX_AGENT_PROJECT_SKILL_BINDINGS)
+        return corrupt();
+    const seen = new Set();
+    const canonical = bindings.map((binding) => {
+        if (!isProjectId(binding.projectId) || !isProjectSkillName(binding.skillName))
+            return corrupt();
+        const key = `${binding.projectId}\0${binding.skillName}`;
+        if (seen.has(key))
+            return corrupt();
+        seen.add(key);
+        return immutableBinding(binding);
+    }).sort(compareProjectSkillRefs);
+    return Object.freeze(canonical);
+};
+const digest = (value) => `sha256:${createHash("sha256").update(JSON.stringify(value), "utf8").digest("hex")}`;
+export function computeProjectSkillBindingDigest(bindings) {
+    return digest(canonicalBindings(bindings));
+}
+const normalizeWindowsPath = (sourcePath) => {
+    let value = sourcePath.replaceAll("/", "\\");
+    if (/^\\\\\?\\UNC\\/iu.test(value))
+        value = `\\\\${value.slice(8)}`;
+    else if (/^\\\\\?\\[A-Za-z]:\\/u.test(value))
+        value = value.slice(4);
+    if (!win32.isAbsolute(value))
+        return corrupt();
+    return win32.normalize(value).toLowerCase();
+};
+const normalizeSourcePath = (sourcePath, platform) => {
+    if (sourcePath.includes("\0") || Buffer.byteLength(sourcePath, "utf8") > MAX_SOURCE_PATH_BYTES) {
+        return corrupt();
+    }
+    if (platform === "win32")
+        return normalizeWindowsPath(sourcePath);
+    if (!posix.isAbsolute(sourcePath))
+        return corrupt();
+    return posix.normalize(sourcePath);
+};
+export function normalizeProjectSkillResolutionRecords(records, platform = process.platform) {
+    if (records.length > MAX_AGENT_PROJECT_SKILL_BINDINGS)
+        return corrupt();
+    const seen = new Set();
+    const normalized = records.map((record) => {
+        if (!isProjectId(record.projectId) || !isProjectSkillName(record.skillName))
+            return corrupt();
+        const key = `${record.projectId}\0${record.skillName}`;
+        if (seen.has(key))
+            return corrupt();
+        seen.add(key);
+        if (record.mode === "missing") {
+            if (record.sourcePath !== null)
+                return corrupt();
+            return Object.freeze({
+                projectId: record.projectId,
+                skillName: record.skillName,
+                sourcePath: null,
+                mode: "missing",
+            });
+        }
+        if (record.mode !== "resolved" || record.sourcePath === null)
+            return corrupt();
+        return Object.freeze({
+            projectId: record.projectId,
+            skillName: record.skillName,
+            sourcePath: normalizeSourcePath(record.sourcePath, platform),
+            mode: "resolved",
+        });
+    }).sort(compareProjectSkillRefs);
+    return Object.freeze(normalized);
+}
+export function computeProjectSkillResolutionDigest(records, platform = process.platform) {
+    return digest(normalizeProjectSkillResolutionRecords(records, platform));
+}
+const sameBinding = (left, right) => left.projectId === right.projectId && left.skillName === right.skillName;
+export function createAppliedProjectSkillManifest(input) {
+    if (!Number.isInteger(input.generation) || input.generation < 0 || input.generation > MAX_GENERATION) {
+        return corrupt();
+    }
+    const bindings = canonicalBindings(input.bindings);
+    const resolutions = normalizeProjectSkillResolutionRecords(input.resolutions, input.platform);
+    if (bindings.length !== resolutions.length
+        || bindings.some((binding, index) => !sameBinding(binding, resolutions[index]))
+        || !CANONICAL_ROOT_ID.test(input.rootId)) {
+        return corrupt();
+    }
+    return Object.freeze({
+        managedBy: MANAGED_BY,
+        generation: input.generation,
+        bindings,
+        bindingDigest: digest(bindings),
+        resolutionDigest: digest(resolutions),
+        rootId: input.rootId,
+    });
+}
+const ProjectSkillRefSchema = z.object({
+    projectId: z.string().min(1).max(MAX_PROJECT_ID_LENGTH),
+    skillName: z.string().min(1).max(MAX_PROJECT_SKILL_NAME_LENGTH),
+}).strict();
+const LegacyAppliedManifestSchema = z.object({
+    managedBy: z.literal(MANAGED_BY),
+    generation: z.number().int().min(0).max(MAX_GENERATION),
+    bindings: z.array(ProjectSkillRefSchema).max(MAX_AGENT_PROJECT_SKILL_BINDINGS),
+    bindingDigest: z.string().regex(DIGEST),
+    resolutionDigest: z.string().regex(DIGEST),
+}).strict();
+const AppliedManifestSchema = z.union([
+    LegacyAppliedManifestSchema.extend({
+        rootId: z.string().regex(CANONICAL_ROOT_ID),
+    }).strict(),
+    LegacyAppliedManifestSchema,
+]);
+/** Strict local-store boundary parser; not re-exported from the public projection-state facade. */
+export const parseAppliedProjectSkillManifest = (candidate) => {
+    if (candidate && typeof candidate === "object" && "managedBy" in candidate
+        && candidate.managedBy !== MANAGED_BY) {
+        return unmanaged();
+    }
+    const parsed = AppliedManifestSchema.safeParse(candidate);
+    if (!parsed.success)
+        return corrupt();
+    const bindings = canonicalBindings(parsed.data.bindings);
+    if (bindings.some((binding, index) => !sameBinding(binding, parsed.data.bindings[index]))) {
+        return corrupt();
+    }
+    if (parsed.data.bindingDigest !== digest(bindings))
+        return corrupt();
+    return Object.freeze({
+        managedBy: MANAGED_BY,
+        generation: parsed.data.generation,
+        bindings,
+        bindingDigest: parsed.data.bindingDigest,
+        resolutionDigest: parsed.data.resolutionDigest,
+        rootId: "rootId" in parsed.data ? parsed.data.rootId : null,
+    });
+};
+/** Publication boundary parser; it must run before creating or settling any filesystem state. */
+export const parsePublishableAppliedProjectSkillManifest = (candidate) => {
+    const parsed = parseAppliedProjectSkillManifest(candidate);
+    if (parsed.rootId === null)
+        return corrupt();
+    return Object.freeze({ ...parsed, rootId: parsed.rootId });
+};