holarchy-eidolon-adapter 0.2.0 → 0.2.2

package/dist/WorkflowHolonTaskContract.js

@@ -0,0 +1,211 @@
+import { canonicalOwnDataClone } from 'task-manager-contract';
+export const HOLON_TASK_TARGET_SCHEMA_VERSION = 'ai-workflow.holon-task-target/v1';
+export const HOLON_TASK_SNAPSHOT_RECEIPT_SCHEMA_VERSION = 'eidolon.holon-task-snapshot-receipt/v2';
+export const AI_ORGANIZATION_TASK_PROFILE_KIND = 'depa.ai.organization-task';
+export function holonTaskTargetFromNodeConfig(configInput, expected) {
+    const config = record(canonicalOwnDataClone(configInput), '$config');
+    if (!Object.prototype.hasOwnProperty.call(config, 'holonTaskTarget'))
+        return undefined;
+    const target = normalizeHolonTaskTarget(config.holonTaskTarget);
+    if (target.invocation.workflowKind !== expected.workflowKind
+        || target.invocation.workflowRef !== expected.workflowRef
+        || target.invocation.nodeId !== expected.nodeId) {
+        invalid('$config.holonTaskTarget.invocation', 'Target invocation identity does not match the authored node');
+    }
+    return target;
+}
+export class HolonTaskContractError extends Error {
+    path;
+    constructor(path, message) {
+        super(`${path}: ${message}`);
+        this.path = path;
+        this.name = 'HolonTaskContractError';
+    }
+}
+export function normalizeHolonTaskTarget(value) {
+    const root = record(canonicalOwnDataClone(value), '$target');
+    exactKeys(root, ['kind', 'schemaVersion', 'invocation', 'holon', 'executionBinding', 'taskSpace', 'output'], '$target');
+    exactLiteral(root.kind, 'holon-task-target', '$target.kind');
+    exactLiteral(root.schemaVersion, HOLON_TASK_TARGET_SCHEMA_VERSION, '$target.schemaVersion');
+    const invocation = record(root.invocation, '$target.invocation');
+    exactKeys(invocation, ['workflowKind', 'workflowRef', 'nodeId', 'invocationId'], '$target.invocation');
+    const workflowKind = oneOf(invocation.workflowKind, ['AICtrlWorkflow', 'AIDataWorkflow'], '$target.invocation.workflowKind');
+    const holon = record(root.holon, '$target.holon');
+    exactKeys(holon, ['rootHolonRef', 'effectiveAt'], '$target.holon');
+    const executionBinding = record(root.executionBinding, '$target.executionBinding');
+    exactKeys(executionBinding, ['ref', 'digest'], '$target.executionBinding');
+    const taskSpace = record(root.taskSpace, '$target.taskSpace');
+    exactKeys(taskSpace, ['profileRef', 'policyRef', 'requiredRoleRefs', 'requiredCapabilityRefs'], '$target.taskSpace');
+    const output = record(root.output, '$target.output');
+    exactKeys(output, ['schemaRef', 'materialPortRefs'], '$target.output');
+    return Object.freeze({
+        kind: 'holon-task-target',
+        schemaVersion: HOLON_TASK_TARGET_SCHEMA_VERSION,
+        invocation: Object.freeze({
+            workflowKind,
+            workflowRef: resourceRef(invocation.workflowRef, '$target.invocation.workflowRef'),
+            nodeId: exactString(invocation.nodeId, '$target.invocation.nodeId'),
+            invocationId: exactString(invocation.invocationId, '$target.invocation.invocationId'),
+        }),
+        holon: Object.freeze({
+            rootHolonRef: exactString(holon.rootHolonRef, '$target.holon.rootHolonRef'),
+            effectiveAt: utcInstant(holon.effectiveAt, '$target.holon.effectiveAt'),
+        }),
+        executionBinding: Object.freeze({
+            ref: resourceRef(executionBinding.ref, '$target.executionBinding.ref'),
+            digest: digest(executionBinding.digest, '$target.executionBinding.digest'),
+        }),
+        taskSpace: Object.freeze({
+            profileRef: resourceRef(taskSpace.profileRef, '$target.taskSpace.profileRef'),
+            policyRef: resourceRef(taskSpace.policyRef, '$target.taskSpace.policyRef'),
+            requiredRoleRefs: stringArray(taskSpace.requiredRoleRefs, '$target.taskSpace.requiredRoleRefs'),
+            requiredCapabilityRefs: resourceRefArray(taskSpace.requiredCapabilityRefs, '$target.taskSpace.requiredCapabilityRefs'),
+        }),
+        output: Object.freeze({
+            schemaRef: resourceRef(output.schemaRef, '$target.output.schemaRef'),
+            materialPortRefs: resourceRefArray(output.materialPortRefs, '$target.output.materialPortRefs'),
+        }),
+    });
+}
+export function normalizeHolonTaskSnapshotReceipt(value) {
+    const root = record(canonicalOwnDataClone(value), '$snapshotReceipt');
+    const legacy = root.schemaVersion === 'ai-workflow.holon-task-snapshot-receipt/v1' || root.schemaVersion === 'eidolon.holon-task-snapshot-receipt/v1';
+    exactKeys(root, [
+        'kind', 'schemaVersion', 'taskSpaceId', 'holonRef', 'effectiveAt', 'holonSnapshotRef',
+        'holonSnapshotDigest', 'snapshotArtifactDigest', 'issuerReceiptId',
+        ...(legacy ? ['issuerReceiptArtifactDigest'] : []), 'executionBindingRef', 'executionBindingDigest',
+        'eligibleMemberRefs', 'eligibleRoleRefs',
+    ], '$snapshotReceipt');
+    exactLiteral(root.kind, 'holon-task-snapshot-receipt', '$snapshotReceipt.kind');
+    if (!legacy)
+        exactLiteral(root.schemaVersion, HOLON_TASK_SNAPSHOT_RECEIPT_SCHEMA_VERSION, '$snapshotReceipt.schemaVersion');
+    if (legacy && root.issuerReceiptArtifactDigest !== root.issuerReceiptId)
+        invalid('$snapshotReceipt', 'Conflicting legacy receipt digests');
+    return Object.freeze({
+        kind: 'holon-task-snapshot-receipt',
+        schemaVersion: HOLON_TASK_SNAPSHOT_RECEIPT_SCHEMA_VERSION,
+        taskSpaceId: exactString(root.taskSpaceId, '$snapshotReceipt.taskSpaceId'),
+        holonRef: exactString(root.holonRef, '$snapshotReceipt.holonRef'),
+        effectiveAt: utcInstant(root.effectiveAt, '$snapshotReceipt.effectiveAt'),
+        holonSnapshotRef: exactString(root.holonSnapshotRef, '$snapshotReceipt.holonSnapshotRef'),
+        holonSnapshotDigest: digest(root.holonSnapshotDigest, '$snapshotReceipt.holonSnapshotDigest'),
+        snapshotArtifactDigest: digest(root.snapshotArtifactDigest, '$snapshotReceipt.snapshotArtifactDigest'),
+        issuerReceiptId: digest(root.issuerReceiptId, '$snapshotReceipt.issuerReceiptId'),
+        executionBindingRef: resourceRef(root.executionBindingRef, '$snapshotReceipt.executionBindingRef'),
+        executionBindingDigest: digest(root.executionBindingDigest, '$snapshotReceipt.executionBindingDigest'),
+        eligibleMemberRefs: stringArray(root.eligibleMemberRefs, '$snapshotReceipt.eligibleMemberRefs'),
+        eligibleRoleRefs: stringArray(root.eligibleRoleRefs, '$snapshotReceipt.eligibleRoleRefs'),
+    });
+}
+export function createAIOrganizationTaskProfile(targetInput, receiptInput, adoptionInputs = []) {
+    const target = normalizeHolonTaskTarget(targetInput);
+    const snapshotReceipt = normalizeHolonTaskSnapshotReceipt(receiptInput);
+    if (snapshotReceipt.taskSpaceId.length === 0
+        || snapshotReceipt.holonRef !== target.holon.rootHolonRef
+        || snapshotReceipt.effectiveAt !== target.holon.effectiveAt
+        || snapshotReceipt.executionBindingRef !== target.executionBinding.ref
+        || snapshotReceipt.executionBindingDigest !== target.executionBinding.digest) {
+        invalid('$profile', 'Snapshot receipt does not bind the exact target facts');
+    }
+    return Object.freeze({
+        kind: 'task-profile',
+        profileKind: AI_ORGANIZATION_TASK_PROFILE_KIND,
+        schemaVersion: 1,
+        facts: Object.freeze({
+            target,
+            snapshotReceipt,
+            assignmentReceipt: null,
+            memberRuntimeRef: null,
+            settlementReceipt: null,
+            snapshotAdoptions: Object.freeze(adoptionInputs.map(normalizeHolonTaskSnapshotAdoptionReceipt)),
+        }),
+    });
+}
+export function normalizeHolonTaskSnapshotAdoptionReceipt(value) {
+    const root = record(canonicalOwnDataClone(value), '$snapshotAdoptionReceipt');
+    exactKeys(root, [
+        'kind', 'schemaVersion', 'taskSpaceId', 'previousTaskId', 'successorTaskId',
+        'previousIssuerReceiptId', 'successorIssuerReceiptId', 'executionBindingDigest', 'adoptedAt',
+    ], '$snapshotAdoptionReceipt');
+    exactLiteral(root.kind, 'holon-task-snapshot-adoption-receipt', '$snapshotAdoptionReceipt.kind');
+    exactLiteral(root.schemaVersion, 'ai-workflow.holon-task-snapshot-adoption-receipt/v1', '$snapshotAdoptionReceipt.schemaVersion');
+    return Object.freeze({
+        kind: 'holon-task-snapshot-adoption-receipt',
+        schemaVersion: 'ai-workflow.holon-task-snapshot-adoption-receipt/v1',
+        taskSpaceId: exactString(root.taskSpaceId, '$snapshotAdoptionReceipt.taskSpaceId'),
+        previousTaskId: exactString(root.previousTaskId, '$snapshotAdoptionReceipt.previousTaskId'),
+        successorTaskId: exactString(root.successorTaskId, '$snapshotAdoptionReceipt.successorTaskId'),
+        previousIssuerReceiptId: digest(root.previousIssuerReceiptId, '$snapshotAdoptionReceipt.previousIssuerReceiptId'),
+        successorIssuerReceiptId: digest(root.successorIssuerReceiptId, '$snapshotAdoptionReceipt.successorIssuerReceiptId'),
+        executionBindingDigest: digest(root.executionBindingDigest, '$snapshotAdoptionReceipt.executionBindingDigest'),
+        adoptedAt: utcInstant(root.adoptedAt, '$snapshotAdoptionReceipt.adoptedAt'),
+    });
+}
+function record(value, path) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        invalid(path, 'Expected an object');
+    return value;
+}
+function exactKeys(value, expected, path) {
+    const actual = Object.keys(value);
+    const expectedSet = new Set(expected);
+    const extra = actual.find((key) => !expectedSet.has(key));
+    if (extra !== undefined)
+        invalid(`${path}.${extra}`, 'Unsupported field');
+    const missing = expected.find((key) => !Object.prototype.hasOwnProperty.call(value, key));
+    if (missing !== undefined)
+        invalid(`${path}.${missing}`, 'Required field is missing');
+}
+function exactString(value, path) {
+    if (typeof value !== 'string' || value.length === 0 || value !== value.trim())
+        invalid(path, 'Expected an exact non-empty string');
+    return value;
+}
+function exactLiteral(value, expected, path) {
+    if (value !== expected)
+        invalid(path, `Expected '${expected}'`);
+    return expected;
+}
+function oneOf(value, expected, path) {
+    if (typeof value !== 'string' || !expected.includes(value))
+        invalid(path, `Expected one of ${expected.join('|')}`);
+    return value;
+}
+function resourceRef(value, path) {
+    const ref = exactString(value, path);
+    if (!/^resource:\/\/[^/\s][^\s]*$/.test(ref))
+        invalid(path, 'Expected a canonical resource:// reference');
+    return ref;
+}
+function digest(value, path) {
+    if (typeof value !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(value))
+        invalid(path, 'Expected a canonical SHA-256 digest');
+    return value;
+}
+function utcInstant(value, path) {
+    const instant = exactString(value, path);
+    const parsed = Date.parse(instant);
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(instant)
+        || Number.isNaN(parsed) || new Date(parsed).toISOString() !== instant)
+        invalid(path, 'Expected a canonical UTC instant');
+    return instant;
+}
+function stringArray(value, path) {
+    if (!Array.isArray(value))
+        invalid(path, 'Expected an array');
+    const result = Object.freeze(value.map((item, index) => exactString(item, `${path}[${index}]`)));
+    if (new Set(result).size !== result.length)
+        invalid(path, 'Duplicate values are not allowed');
+    return result;
+}
+function resourceRefArray(value, path) {
+    if (!Array.isArray(value))
+        invalid(path, 'Expected an array');
+    const result = Object.freeze(value.map((item, index) => resourceRef(item, `${path}[${index}]`)));
+    if (new Set(result).size !== result.length)
+        invalid(path, 'Duplicate values are not allowed');
+    return result;
+}
+function invalid(path, message) {
+    throw new HolonTaskContractError(path, message);
+}

package/dist/canonicalBase64.d.ts

@@ -0,0 +1,2 @@
+/** 纯平台标准转换；公开适配包不依赖主机Buffer或Node类型。 */
+export declare function decodeCanonicalBase64(value: string): Uint8Array;

package/dist/canonicalBase64.js

@@ -0,0 +1,7 @@
+/** 纯平台标准转换；公开适配包不依赖主机Buffer或Node类型。 */
+export function decodeCanonicalBase64(value) {
+    const binary = atob(value);
+    if (!binary.length || btoa(binary) !== value)
+        throw new TypeError('Expected canonical non-empty base64');
+    return Uint8Array.from(binary, character => character.charCodeAt(0));
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./HolarchyEidolonAdapterError.js";
+export * from "./HolonDeploymentDefinition.js";
+export * from "./HolonDeploymentRuntime.js";
+export * from "./HolonExecutionBinding.js";
+export * from "./HolonExecutionBindingProjection.js";
+export { parseOrganizationWorkbenchRequest, parseOrganizationWorkbenchReply } from './WorkbenchProtocol.js';
+export type { OrganizationWorkbenchRequest, OrganizationWorkbenchReply } from './WorkbenchProtocol.js';
+export * from "./WorkflowHolonTaskContract.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from "./HolarchyEidolonAdapterError.js";
+export * from "./HolonDeploymentDefinition.js";
+export * from "./HolonDeploymentRuntime.js";
+export * from "./HolonExecutionBinding.js";
+export * from "./HolonExecutionBindingProjection.js";
+export { parseOrganizationWorkbenchRequest, parseOrganizationWorkbenchReply } from './WorkbenchProtocol.js';
+export * from "./WorkflowHolonTaskContract.js";

package/package.json

@@ -1,34 +1,50 @@
 {
   "name": "holarchy-eidolon-adapter",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": false,
   "description": "Eidolon ResourcePackage adapter for frozen Holarchy organization snapshots and execution bindings.",
   "type": "module",
-  "main": "./src/index.ts",
+  "main": "./dist/index.js",
   "exports": {
-    ".": "./src/index.ts",
-    "./HolonDeploymentDefinition": "./src/HolonDeploymentDefinition.ts",
-    "./HolonDeploymentRuntime": "./src/HolonDeploymentRuntime.ts",
-    "./HolonExecutionBinding": "./src/HolonExecutionBinding.ts",
-    "./HolonExecutionBindingProjection": "./src/HolonExecutionBindingProjection.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./HolonDeploymentDefinition": {
+      "types": "./dist/HolonDeploymentDefinition.d.ts",
+      "import": "./dist/HolonDeploymentDefinition.js"
+    },
+    "./HolonDeploymentRuntime": {
+      "types": "./dist/HolonDeploymentRuntime.d.ts",
+      "import": "./dist/HolonDeploymentRuntime.js"
+    },
+    "./HolonExecutionBinding": {
+      "types": "./dist/HolonExecutionBinding.d.ts",
+      "import": "./dist/HolonExecutionBinding.js"
+    },
+    "./HolonExecutionBindingProjection": {
+      "types": "./dist/HolonExecutionBindingProjection.d.ts",
+      "import": "./dist/HolonExecutionBindingProjection.js"
+    },
+    "./WorkbenchProtocol": {
+      "types": "./dist/WorkbenchProtocol.d.ts",
+      "import": "./dist/WorkbenchProtocol.js"
+    }
   },
   "files": [
-    "src"
+    "dist",
+    "README.md"
   ],
-  "scripts": {
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "bun test"
-  },
   "dependencies": {
-    "ai-workflow-contract": "0.2.0",
+    "ai-workflow-contract": "0.2.3",
     "depa-actor": "0.2.2",
-    "halfcode-compiler.xnl": "0.3.0",
-    "holarchy-core-contract": "0.2.0"
-  },
-  "devDependencies": {
-    "typescript": "^5.4.0"
+    "halfcode-compiler.xnl": "0.3.2",
+    "holarchy-core-contract": "0.3.1",
+    "task-manager-contract": "0.1.4"
   },
   "publishConfig": {
-    "access": "public"
-  }
+    "access": "public",
+    "registry": "https://registry.npmjs.com/"
+  },
+  "types": "./dist/index.d.ts"
 }

package/src/HolarchyEidolonAdapterError.ts

@@ -1,9 +0,0 @@
-export class HolarchyEidolonAdapterError extends Error {
-  constructor(
-    readonly code: string,
-    message: string,
-  ) {
-    super(`${code}: ${message}`)
-    this.name = "HolarchyEidolonAdapterError"
-  }
-}

package/src/HolonDeploymentDefinition.ts

@@ -1,241 +0,0 @@
-import { HolarchyEidolonAdapterError } from "./HolarchyEidolonAdapterError"
-
-export const HOLON_DEPLOYMENT_DEFINITION_SCHEMA_VERSION =
-  "eidolon.holon-deployment-definition/v1" as const
-
-export interface HolonDeploymentDefinitionFile {
-  readonly path: string
-  readonly digest: `sha256:${string}`
-  readonly sizeBytes: number
-}
-
-export interface HolonDeploymentDefinition {
-  readonly schemaVersion: typeof HOLON_DEPLOYMENT_DEFINITION_SCHEMA_VERSION
-  readonly deploymentId: string
-  readonly rootHolonRef: string
-  readonly bindingRef: `resource://${string}`
-  readonly snapshotRef: `resource://${string}`
-  readonly registryRevision: string
-  readonly snapshotTreeDigest: `sha256:${string}`
-  readonly snapshotReceiptDigest: `sha256:${string}`
-  readonly bindingBytesDigest: `sha256:${string}`
-  readonly bindingSemanticFingerprint: `sha256:${string}`
-  readonly files: readonly HolonDeploymentDefinitionFile[]
-}
-
-const REQUIRED_AUTHORITY_FILES = Object.freeze([
-  "authority/execution-binding-freeze-receipt.json",
-  "authority/execution-binding.json",
-  "authority/organization-snapshot-receipt.json",
-  "authority/organization-snapshot.json",
-] as const)
-
-const compareUtf16 = (left: string, right: string): number =>
-  left < right ? -1 : left > right ? 1 : 0
-
-const invalid = (path: string, message: string): never => {
-  throw new HolarchyEidolonAdapterError(
-    "EIDOLON_HOLON_DEPLOYMENT_DEFINITION_INVALID",
-    `${path}: ${message}`,
-  )
-}
-
-function closedObject(value: unknown, location: string): Readonly<Record<string, unknown>> {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return invalid(location, "Expected a plain object")
-  }
-  const prototype = Object.getPrototypeOf(value)
-  if (prototype !== Object.prototype && prototype !== null) {
-    return invalid(location, "Expected a plain object")
-  }
-  const descriptors = Object.getOwnPropertyDescriptors(value)
-  const keys = Reflect.ownKeys(descriptors)
-  if (keys.some((key) => typeof key !== "string")) {
-    return invalid(location, "Symbol properties are not allowed")
-  }
-  const result: Record<string, unknown> = Object.create(null)
-  for (const key of keys as string[]) {
-    const descriptor = descriptors[key]
-    if (!descriptor || !("value" in descriptor) || descriptor.enumerable !== true) {
-      return invalid(`${location}.${key}`, "Expected one enumerable own-data property")
-    }
-    result[key] = descriptor.value
-  }
-  return result
-}
-
-function exactKeys(
-  value: Readonly<Record<string, unknown>>,
-  expected: readonly string[],
-  location: string,
-): void {
-  const expectedSet = new Set(expected)
-  const extra = Object.keys(value).find((key) => !expectedSet.has(key))
-  if (extra !== undefined) invalid(`${location}.${extra}`, "Unsupported field")
-  const missing = expected.find((key) => !Object.prototype.hasOwnProperty.call(value, key))
-  if (missing !== undefined) invalid(`${location}.${missing}`, "Required field is missing")
-}
-
-function denseArray(value: unknown, location: string): readonly unknown[] {
-  if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
-    return invalid(location, "Expected a plain dense array")
-  }
-  const descriptors = Object.getOwnPropertyDescriptors(value)
-  for (let index = 0; index < value.length; index += 1) {
-    const descriptor = descriptors[String(index)]
-    if (!descriptor || !("value" in descriptor) || descriptor.enumerable !== true) {
-      return invalid(`${location}[${index}]`, "Expected a dense enumerable own-data entry")
-    }
-  }
-  for (const key of Reflect.ownKeys(descriptors)) {
-    if (key === "length") continue
-    if (typeof key !== "string" || !/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= value.length) {
-      return invalid(location, "Symbol and extra array properties are not allowed")
-    }
-  }
-  return value
-}
-
-function exactString(value: unknown, location: string): string {
-  if (typeof value !== "string" || value.length === 0 || value !== value.trim()) {
-    return invalid(location, "Expected an exact non-empty string")
-  }
-  return value
-}
-
-function exactLiteral<T extends string>(value: unknown, expected: T, location: string): T {
-  if (value !== expected) invalid(location, `Expected '${expected}'`)
-  return expected
-}
-
-function exactIdentity(value: unknown, location: string): string {
-  const identity = exactString(value, location)
-  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(identity)) {
-    return invalid(location, "Expected one portable identity")
-  }
-  return identity
-}
-
-function resourceRef(value: unknown, location: string): `resource://${string}` {
-  const ref = exactString(value, location)
-  if (!ref.startsWith("resource://") || ref.slice("resource://".length).includes("://")) {
-    return invalid(location, "Expected one exact resource:// identity")
-  }
-  const identity = ref.slice("resource://".length)
-  if (!identity) invalid(location, "Expected one exact resource:// identity")
-  return ref as `resource://${string}`
-}
-
-function sha256(value: unknown, location: string): `sha256:${string}` {
-  if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value)) {
-    return invalid(location, "Expected one canonical sha256 digest")
-  }
-  return value as `sha256:${string}`
-}
-
-function relativeFilePath(value: unknown, location: string): string {
-  const filePath = exactString(value, location)
-  const segments = filePath.split("/")
-  if (filePath.startsWith("/") || filePath.includes("\\")
-    || segments.some((segment) => !segment || segment === "." || segment === "..")) {
-    return invalid(location, "Expected one portable containment-safe relative file path")
-  }
-  return filePath
-}
-
-function file(value: unknown, index: number): HolonDeploymentDefinitionFile {
-  const location = `$.files[${index}]`
-  const record = closedObject(value, location)
-  exactKeys(record, ["path", "digest", "sizeBytes"], location)
-  if (!Number.isSafeInteger(record.sizeBytes) || (record.sizeBytes as number) < 0) {
-    invalid(`${location}.sizeBytes`, "Expected a non-negative safe integer")
-  }
-  return Object.freeze({
-    path: relativeFilePath(record.path, `${location}.path`),
-    digest: sha256(record.digest, `${location}.digest`),
-    sizeBytes: record.sizeBytes as number,
-  })
-}
-
-export function normalizeHolonDeploymentDefinition(value: unknown): HolonDeploymentDefinition {
-  const record = closedObject(value, "$")
-  exactKeys(record, [
-    "schemaVersion",
-    "deploymentId",
-    "rootHolonRef",
-    "bindingRef",
-    "snapshotRef",
-    "registryRevision",
-    "snapshotTreeDigest",
-    "snapshotReceiptDigest",
-    "bindingBytesDigest",
-    "bindingSemanticFingerprint",
-    "files",
-  ], "$")
-  const files = denseArray(record.files, "$.files")
-    .map((entry, index) => file(entry, index))
-    .sort((left, right) => compareUtf16(left.path, right.path))
-  if (files.length === 0 || new Set(files.map((entry) => entry.path)).size !== files.length) {
-    invalid("$.files", "Expected a non-empty list with unique file paths")
-  }
-  for (const required of REQUIRED_AUTHORITY_FILES) {
-    if (!files.some((entry) => entry.path === required)) {
-      invalid("$.files", `Required authority file '${required}' is missing`)
-    }
-  }
-  if (!files.some((entry) => /^\.agent-resources\/(global|workspace)\/manifest\.xnl$/.test(entry.path))) {
-    invalid("$.files", "At least one frozen ResourcePackage layer manifest is required")
-  }
-  return Object.freeze({
-    schemaVersion: exactLiteral(
-      record.schemaVersion,
-      HOLON_DEPLOYMENT_DEFINITION_SCHEMA_VERSION,
-      "$.schemaVersion",
-    ),
-    deploymentId: exactIdentity(record.deploymentId, "$.deploymentId"),
-    rootHolonRef: exactIdentity(record.rootHolonRef, "$.rootHolonRef"),
-    bindingRef: resourceRef(record.bindingRef, "$.bindingRef"),
-    snapshotRef: resourceRef(record.snapshotRef, "$.snapshotRef"),
-    registryRevision: sha256(record.registryRevision, "$.registryRevision"),
-    snapshotTreeDigest: sha256(record.snapshotTreeDigest, "$.snapshotTreeDigest"),
-    snapshotReceiptDigest: sha256(record.snapshotReceiptDigest, "$.snapshotReceiptDigest"),
-    bindingBytesDigest: sha256(record.bindingBytesDigest, "$.bindingBytesDigest"),
-    bindingSemanticFingerprint: sha256(
-      record.bindingSemanticFingerprint,
-      "$.bindingSemanticFingerprint",
-    ),
-    files: Object.freeze(files),
-  })
-}
-
-function sameBytes(left: Uint8Array, right: Uint8Array): boolean {
-  if (left.byteLength !== right.byteLength) return false
-  for (let index = 0; index < left.byteLength; index += 1) {
-    if (left[index] !== right[index]) return false
-  }
-  return true
-}
-
-export function canonicalHolonDeploymentDefinitionBytes(value: unknown): Uint8Array {
-  return new TextEncoder().encode(JSON.stringify(normalizeHolonDeploymentDefinition(value)))
-}
-
-export function parseHolonDeploymentDefinitionBytes(bytes: Uint8Array): HolonDeploymentDefinition {
-  let decoded: string
-  try {
-    decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes)
-  } catch {
-    return invalid("$bytes", "Definition bytes are not valid UTF-8")
-  }
-  let value: unknown
-  try {
-    value = JSON.parse(decoded)
-  } catch {
-    return invalid("$bytes", "Definition bytes are not valid JSON")
-  }
-  const definition = normalizeHolonDeploymentDefinition(value)
-  if (!sameBytes(bytes, canonicalHolonDeploymentDefinitionBytes(definition))) {
-    return invalid("$bytes", "Definition bytes are not canonical")
-  }
-  return definition
-}