@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/developer-agent/generator-planning.js

@@ -0,0 +1,645 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperAgentGeneratorPlanError = void 0;
+exports.parseDeveloperAgentGeneratorInput = parseDeveloperAgentGeneratorInput;
+exports.generatorContextSelection = generatorContextSelection;
+exports.developerAgentWorkspaceVerificationTarget = developerAgentWorkspaceVerificationTarget;
+exports.developerAgentUpgradeGeneratorOptions = developerAgentUpgradeGeneratorOptions;
+exports.assertDeveloperAgentUpgradePreviewContext = assertDeveloperAgentUpgradePreviewContext;
+exports.bindDeveloperAgentGeneratorPlan = bindDeveloperAgentGeneratorPlan;
+exports.rebindDeveloperAgentGeneratorPlan = rebindDeveloperAgentGeneratorPlan;
+const node_util_1 = require("node:util");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../blueprints/index.js");
+const function_js_1 = require("../generators/function/function.js");
+const logging_registry_js_1 = require("../generators/logging-registry.js");
+const built_in_plan_js_1 = require("../generators/slice/built-in-plan.js");
+const workload_js_1 = require("../generators/workload/workload.js");
+const performance_registration_js_1 = require("../generators/workload/performance-registration.js");
+const reliability_registration_js_1 = require("../generators/workload/reliability-registration.js");
+const ordering_js_1 = require("./ordering.js");
+const preview_source_js_1 = require("./preview-source.js");
+const workspace_path_js_1 = require("./workspace-path.js");
+const SLUG = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+const SAFE_PATH = /^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$)).+$/;
+const PREVIEW_REFERENCE = /^\.ebk\/agent\/previews\/[a-z][a-z0-9-]{0,62}\.json$/;
+const MAX_NAME_LENGTH = 63;
+const PRODUCT_OWNERSHIP_PATH = '.ebk/ownership.json';
+const RELEASE_REGISTRY_PATH = 'operations/release.json';
+class DeveloperAgentGeneratorPlanError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'DeveloperAgentGeneratorPlanError';
+    }
+}
+exports.DeveloperAgentGeneratorPlanError = DeveloperAgentGeneratorPlanError;
+function invalidGeneratorInput(message) {
+    throw new DeveloperAgentGeneratorPlanError('invalid-input', message);
+}
+function unavailableGeneratorDestination(message) {
+    throw new DeveloperAgentGeneratorPlanError('prerequisite-missing', message);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, required, optional = []) {
+    if (!isRecord(value))
+        return false;
+    const allowed = new Set([...required, ...optional]);
+    return (required.every((field) => Object.prototype.hasOwnProperty.call(value, field)) && Object.keys(value).every((field) => allowed.has(field)));
+}
+function boundedSlug(value, label) {
+    if (typeof value !== 'string' ||
+        value.length === 0 ||
+        value.length > MAX_NAME_LENGTH ||
+        value !== value.trim() ||
+        !SLUG.test(value)) {
+        return invalidGeneratorInput(`${label} must be a lowercase hyphenated identifier of at most ${MAX_NAME_LENGTH} characters.`);
+    }
+    return value;
+}
+function previewReference(value) {
+    if (!exactKeys(value, ['digest', 'reference']) ||
+        typeof value.digest !== 'string' ||
+        !DIGEST.test(value.digest) ||
+        typeof value.reference !== 'string' ||
+        value.reference.length > 1024 ||
+        !PREVIEW_REFERENCE.test(value.reference)) {
+        return invalidGeneratorInput('Upgrade preview must contain an exact SHA-256 digest and an ignored .ebk/agent/previews/ reference.');
+    }
+    return { digest: value.digest, reference: value.reference };
+}
+function workspacePathExists(context, path) {
+    const root = (0, node_fs_1.realpathSync)(context.workspace.repositoryRoot);
+    const segments = path.split('/');
+    let current = root;
+    for (let index = 0; index < segments.length; index += 1) {
+        current = (0, node_path_1.resolve)(current, segments[index]);
+        try {
+            const entry = (0, node_fs_1.lstatSync)(current);
+            if (entry.isSymbolicLink()) {
+                return unavailableGeneratorDestination(`Generator collision inspection refuses symbolic-link path ${segments
+                    .slice(0, index + 1)
+                    .join('/')}.`);
+            }
+            const real = (0, node_fs_1.realpathSync)(current);
+            const fromRoot = (0, node_path_1.relative)(root, real);
+            if (fromRoot === '..' ||
+                fromRoot.startsWith(`..${node_path_1.sep}`) ||
+                (0, node_path_1.isAbsolute)(fromRoot) ||
+                fromRoot.split(node_path_1.sep).join('/') !== segments.slice(0, index + 1).join('/')) {
+                return unavailableGeneratorDestination(`Generator collision inspection refuses non-canonical path ${path}.`);
+            }
+            if (index < segments.length - 1 && !entry.isDirectory()) {
+                return unavailableGeneratorDestination(`Generator collision inspection found a non-directory ancestor for ${path}.`);
+            }
+        }
+        catch (error) {
+            if (error &&
+                typeof error === 'object' &&
+                'code' in error &&
+                error.code === 'ENOENT') {
+                return false;
+            }
+            throw error;
+        }
+    }
+    return true;
+}
+function serviceShouldOwnProtectedLoadAdapter(context, slice) {
+    const descriptorPath = node_path_1.posix.join('packages', slice, 'operations/performance.json');
+    if (!workspacePathExists(context, descriptorPath)) {
+        return unavailableGeneratorDestination(`Generator planning requires ${descriptorPath}.`);
+    }
+    const absolute = (0, node_path_1.resolve)((0, node_fs_1.realpathSync)(context.workspace.repositoryRoot), ...descriptorPath.split('/'));
+    let value;
+    try {
+        value = JSON.parse((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+    }
+    catch {
+        return unavailableGeneratorDestination(`Generator planning cannot parse ${descriptorPath}.`);
+    }
+    const load = isRecord(value) ? value['load'] : undefined;
+    if (!isRecord(load)) {
+        return unavailableGeneratorDestination(`Generator planning cannot reconcile Service adapter authority in ${descriptorPath}.`);
+    }
+    if (load['serviceAdapterStatus'] ===
+        'requires-adopter-service-runtime-endpoint' &&
+        load['serviceAdapterOwner'] === null) {
+        return true;
+    }
+    if (load['serviceAdapterStatus'] ===
+        'managed-generated-service-runtime-endpoint' &&
+        typeof load['serviceAdapterOwner'] === 'string' &&
+        SLUG.test(load['serviceAdapterOwner']) &&
+        workspacePathExists(context, node_path_1.posix.join('packages', slice, 'services', load['serviceAdapterOwner'], 'src/performance.ts'))) {
+        return false;
+    }
+    return unavailableGeneratorDestination(`Generator planning cannot reconcile Service adapter authority in ${descriptorPath}.`);
+}
+function parseDeveloperAgentGeneratorInput(value) {
+    if (!isRecord(value) || typeof value.generator !== 'string') {
+        return invalidGeneratorInput('Generator input must be one closed object with a stable generator discriminator.');
+    }
+    if (value.generator === 'slice') {
+        if (!exactKeys(value, ['generator', 'name'])) {
+            return invalidGeneratorInput('Slice generator input accepts only generator and name; Blueprint and raw input fields are not accepted.');
+        }
+        return { generator: 'slice', name: boundedSlug(value.name, 'Slice name') };
+    }
+    if (value.generator === 'function' ||
+        value.generator === 'service' ||
+        value.generator === 'job') {
+        const generator = value.generator;
+        if (!exactKeys(value, ['feature', 'generator', 'name', 'slice'])) {
+            return invalidGeneratorInput(`${generator} generator input accepts exactly feature, generator, name, and slice.`);
+        }
+        return {
+            feature: boundedSlug(value.feature, 'Feature'),
+            generator,
+            name: boundedSlug(value.name, `${generator} name`),
+            slice: boundedSlug(value.slice, 'Slice name'),
+        };
+    }
+    if (value.generator === 'upgrade') {
+        if (!exactKeys(value, ['generator', 'name'], ['preview'])) {
+            return invalidGeneratorInput('Upgrade generator input accepts only generator, name, and an optional caller-retained, digest-bound preview reference.');
+        }
+        return {
+            generator: 'upgrade',
+            name: boundedSlug(value.name, 'Upgrade target'),
+            ...(value.preview === undefined
+                ? {}
+                : { preview: previewReference(value.preview) }),
+        };
+    }
+    return invalidGeneratorInput(`Generator ${String(value.generator)} is not in the stable typed generator surface.`);
+}
+function generatorContextSelection(input) {
+    if (input.generator === 'function' ||
+        input.generator === 'service' ||
+        input.generator === 'job') {
+        return {
+            selectedFeature: input.feature,
+            selectedProjects: [input.slice],
+            selectedSlice: input.slice,
+        };
+    }
+    if (input.generator === 'upgrade' &&
+        input.name !== 'workspace' &&
+        input.name !== 'foundation') {
+        return {
+            selectedProjects: [input.name, 'foundation'].sort(),
+            selectedSlice: input.name,
+        };
+    }
+    if (input.generator === 'upgrade' && input.name === 'foundation') {
+        return { selectedProjects: ['foundation'] };
+    }
+    return {};
+}
+function surface(path, ownershipMode = 'managed') {
+    return { ownershipMode, path };
+}
+function sortedSurfaces(entries) {
+    const byPath = new Map();
+    for (const entry of entries) {
+        if (!SAFE_PATH.test(entry.path) ||
+            !(0, workspace_path_js_1.isCanonicalDeveloperAgentWorkspacePath)(entry.path)) {
+            throw new Error(`Generator planner produced unsafe workspace path ${entry.path}.`);
+        }
+        const previous = byPath.get(entry.path);
+        if (previous && previous.ownershipMode !== entry.ownershipMode) {
+            throw new Error(`Generator planner produced conflicting ownership for ${entry.path}.`);
+        }
+        byPath.set(entry.path, entry);
+    }
+    return [...byPath.values()].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
+}
+function prefixedSurfaces(slice, paths) {
+    return paths.map(({ mode, path }) => surface(node_path_1.posix.join('packages', slice, path), mode ?? 'managed'));
+}
+function requireSliceContext(context, slice, feature, rebindCompleted = false) {
+    const project = context.projects.find(({ name, tags }) => name === slice && tags.includes('type:slice'));
+    if (!project ||
+        context.selection.slice !== slice ||
+        (feature !== undefined && context.selection.feature !== feature)) {
+        throw new DeveloperAgentGeneratorPlanError(rebindCompleted ? 'ownership-conflict' : 'invalid-input', 'Generator Slice and feature inputs must exactly match repository-inspected context.');
+    }
+    return project;
+}
+function contracts(project, classes, existing = []) {
+    const values = [
+        ...existing,
+        ...classes.map((contractClass) => ({
+            class: contractClass,
+            reference: `${project}:${contractClass}`,
+        })),
+    ];
+    const seen = new Set();
+    return values
+        .filter(({ class: contractClass, reference }) => {
+        const key = `${contractClass}\0${reference}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    })
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.class, right.class) ||
+        (0, ordering_js_1.compareDeveloperAgentStrings)(left.reference, right.reference));
+}
+function commandFor(generator, mode, args) {
+    return {
+        args: [
+            'nx',
+            'generate',
+            `@empire-builder-kit/nx:${generator}`,
+            ...args,
+            '--interactive=false',
+            ...(mode === 'preview' ? ['--dry-run'] : []),
+        ],
+        executable: 'pnpm',
+    };
+}
+function canonicalProjectIdentity(value) {
+    return value.normalize('NFC').toLocaleLowerCase('en-US');
+}
+function requireAvailableProspectiveProjectIds(context, projectIds, label) {
+    const existing = new Set(context.projectNames.map((name) => canonicalProjectIdentity(name)));
+    for (const projectId of projectIds) {
+        if (existing.has(canonicalProjectIdentity(projectId))) {
+            return invalidGeneratorInput(`${label} would generate Nx project ${projectId}, which already exists or aliases an identity in the full inspected Nx graph.`);
+        }
+    }
+}
+function developerAgentWorkspaceVerificationTarget(context) {
+    const identity = context.workspace.identity;
+    if (identity.length === 0 ||
+        identity.length > MAX_NAME_LENGTH ||
+        !SLUG.test(identity)) {
+        return invalidGeneratorInput('Generator verification requires one exact normalized workspace identity.');
+    }
+    const selectedWorkspaceProjects = context.projects.filter(({ tags }) => tags.includes('scope:workspace'));
+    if (selectedWorkspaceProjects.length > 1 ||
+        (selectedWorkspaceProjects.length === 1 &&
+            selectedWorkspaceProjects[0].name !== identity)) {
+        return invalidGeneratorInput('Generator verification requires the inspected workspace project to match the exact workspace identity.');
+    }
+    return `${identity}:verify`;
+}
+function requireMatchingOperation(operation, input) {
+    if (operation.owner !== 'nx-generator' ||
+        operation.generator?.generator !== input.generator ||
+        operation.id !==
+            `generator:${input.generator}:${operation.generator?.mode ?? ''}`) {
+        return invalidGeneratorInput('Generator input must exactly match the selected typed generator operation.');
+    }
+    return operation.generator;
+}
+function slicePlan(context, input, mode, rebindCompleted = false) {
+    if (!rebindCompleted &&
+        (context.selection.projectInventory !== 'full' ||
+            context.selection.slice !== undefined ||
+            context.selection.feature !== undefined)) {
+        return invalidGeneratorInput('New Slice generation requires an unnarrowed, full inspected Nx project inventory.');
+    }
+    if (!rebindCompleted &&
+        workspacePathExists(context, node_path_1.posix.join('packages', input.name))) {
+        return unavailableGeneratorDestination(`Product Slice ${input.name} collides with an existing packages/${input.name} path.`);
+    }
+    const blueprint = (0, index_js_1.resolveBlueprint)({
+        engineVersion: context.workspace.frameworkVersion,
+        reference: 'standard',
+        workspaceRoot: context.workspace.repositoryRoot,
+    });
+    if (blueprint.source !== 'built-in') {
+        throw new Error('Typed Slice planning is restricted to the built-in Standard Blueprint.');
+    }
+    const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(input.name, `@${context.workspace.identity}`, context.workspace.frameworkVersion, blueprint.manifest, {});
+    if (!rebindCompleted) {
+        requireAvailableProspectiveProjectIds(context, plan.ownership.projects, `Product Slice ${input.name}`);
+    }
+    const ownership = new Map(plan.ownership.paths.map(({ mode: pathMode, path }) => [path, pathMode]));
+    const root = node_path_1.posix.join('packages', input.name);
+    const generatedSurfaces = sortedSurfaces([
+        ...Object.keys(plan.files).map((path) => surface(node_path_1.posix.join(root, path), ownership.get(path) ?? 'managed')),
+        surface('pnpm-lock.yaml', 'adopter-owned'),
+    ]);
+    const prospectiveVerification = mode === 'apply'
+        ? plan.ownership.projects.map((project) => `${project}:verify`).sort()
+        : [];
+    return {
+        command: commandFor('slice', mode, [
+            `--name=${input.name}`,
+            '--blueprint=standard',
+            '--inputs={}',
+            '--skipFormat=false',
+            '--skipInstall=false',
+        ]),
+        contracts: contracts(input.name, [
+            'async',
+            'authorization',
+            'configuration',
+            'data',
+            'database',
+            'event',
+            'frontend',
+            'infrastructure',
+            'performance',
+            'release',
+            'reliability',
+            'supply-chain',
+            'synchronous',
+        ]),
+        generatedSurfaces,
+        projects: [...plan.ownership.projects],
+        prospectiveVerification,
+        verification: [
+            ...new Set([
+                ...prospectiveVerification,
+                developerAgentWorkspaceVerificationTarget(context),
+            ]),
+        ].sort(),
+    };
+}
+function functionPlan(context, input, mode, rebindCompleted = false) {
+    requireSliceContext(context, input.slice, input.feature, rebindCompleted);
+    if (!rebindCompleted) {
+        for (const path of [
+            node_path_1.posix.join('packages', input.slice, 'api', `${input.name}.ts`),
+            node_path_1.posix.join('packages', input.slice, 'infra/functions', `${input.name}.ts`),
+        ]) {
+            if (workspacePathExists(context, path)) {
+                return unavailableGeneratorDestination(`Function ${input.name} collides with existing ${path}.`);
+            }
+        }
+    }
+    const plan = (0, function_js_1.createFunctionFilePlan)(context.workspace.identity, input.slice, input.name, input.feature);
+    const generatedSurfaces = sortedSurfaces([
+        ...prefixedSurfaces(input.slice, plan.paths),
+        ...prefixedSurfaces(input.slice, [
+            { path: 'infra/product.ts' },
+            { path: 'infra/workload-roles/candidate.ts' },
+            { path: 'infra/workload-roles/effective-intent.ts' },
+            { path: logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH },
+            { path: PRODUCT_OWNERSHIP_PATH },
+        ]),
+    ]);
+    return {
+        command: commandFor('function', mode, [
+            `--name=${input.name}`,
+            `--slice=${input.slice}`,
+            `--feature=${input.feature}`,
+            '--skipFormat=false',
+        ]),
+        contracts: contracts(input.slice, ['authorization', 'infrastructure', 'reliability', 'synchronous'], context.selection.contracts),
+        generatedSurfaces,
+        projects: [input.slice],
+        prospectiveVerification: [],
+        verification: [
+            ...new Set([
+                `${input.slice}:verify`,
+                developerAgentWorkspaceVerificationTarget(context),
+            ]),
+        ].sort(),
+    };
+}
+function workloadPlan(context, input, mode, rebindCompleted = false) {
+    requireSliceContext(context, input.slice, input.feature, rebindCompleted);
+    const kind = input.generator;
+    const workloadRoot = node_path_1.posix.join('packages', input.slice, kind === 'service' ? 'services' : 'jobs', input.name);
+    if (!rebindCompleted && workspacePathExists(context, workloadRoot)) {
+        return unavailableGeneratorDestination(`${kind} ${input.name} collides with existing ${workloadRoot}.`);
+    }
+    const ownsProtectedLoadAdapter = kind === 'service'
+        ? serviceShouldOwnProtectedLoadAdapter(context, input.slice)
+        : false;
+    const plan = (0, workload_js_1.createWorkloadFilePlan)(context.workspace.identity, input.slice, input.name, kind, context.workspace.frameworkVersion, input.feature, ownsProtectedLoadAdapter);
+    if (!rebindCompleted) {
+        requireAvailableProspectiveProjectIds(context, [plan.project], `${kind} ${input.name}`);
+    }
+    const generatedSurfaces = sortedSurfaces([
+        ...prefixedSurfaces(input.slice, plan.paths),
+        ...prefixedSurfaces(input.slice, [
+            { path: 'infra/product.ts' },
+            { path: 'infra/workload-roles/candidate.ts' },
+            { path: 'infra/workload-roles/effective-intent.ts' },
+            { path: logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH },
+            { mode: 'seeded', path: performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH },
+            ...(ownsProtectedLoadAdapter
+                ? [
+                    { path: performance_registration_js_1.WORKLOAD_PERFORMANCE_OPERATIONS_PATH },
+                    {
+                        mode: 'seeded',
+                        path: performance_registration_js_1.WORKLOAD_PERFORMANCE_SCENARIO_PATH,
+                    },
+                    {
+                        mode: 'seeded',
+                        path: performance_registration_js_1.WORKLOAD_PERFORMANCE_SECRET_ACCESS_PATH,
+                    },
+                ]
+                : []),
+            { mode: 'seeded', path: reliability_registration_js_1.WORKLOAD_RELIABILITY_REGISTRY_PATH },
+            { mode: 'seeded', path: RELEASE_REGISTRY_PATH },
+            { path: PRODUCT_OWNERSHIP_PATH },
+        ]),
+        surface('pnpm-lock.yaml', 'adopter-owned'),
+    ]);
+    const prospectiveVerification = mode === 'apply' ? [`${plan.project}:verify`] : [];
+    return {
+        command: commandFor(kind, mode, [
+            `--name=${input.name}`,
+            `--slice=${input.slice}`,
+            `--feature=${input.feature}`,
+            '--skipFormat=false',
+            '--skipInstall=false',
+        ]),
+        contracts: contracts(input.slice, [
+            'async',
+            ...(kind === 'service' ? ['synchronous'] : []),
+            'configuration',
+            'infrastructure',
+            'performance',
+            'release',
+            'reliability',
+            'supply-chain',
+        ], context.selection.contracts),
+        generatedSurfaces,
+        projects: [input.slice, plan.project].sort(),
+        prospectiveVerification,
+        verification: [
+            ...new Set([
+                `${input.slice}:verify`,
+                ...prospectiveVerification,
+                developerAgentWorkspaceVerificationTarget(context),
+            ]),
+        ].sort(),
+    };
+}
+function requireUpgradeProject(context, name) {
+    const project = name === 'workspace'
+        ? context.projects.find(({ tags }) => tags.includes('scope:workspace'))
+        : name === 'foundation'
+            ? context.projects.find(({ tags }) => tags.includes('scope:foundation'))
+            : context.projects.find(({ name: projectName, tags }) => projectName === name && tags.includes('type:slice'));
+    if (!project) {
+        return invalidGeneratorInput(`Upgrade target ${name} is not an existing owned workspace, Foundation, or Product Slice in inspected context.`);
+    }
+    if (name !== 'workspace' &&
+        name !== 'foundation' &&
+        context.selection.slice !== name) {
+        return invalidGeneratorInput('Product Slice upgrade target must exactly match the inspected Slice.');
+    }
+    return project;
+}
+function developerAgentUpgradeGeneratorOptions(context, target) {
+    if (target === 'workspace' || target === 'foundation')
+        return {};
+    const state = context.workspace.ownershipVersions.find((entry) => entry.kind === 'slice' && entry.target === target);
+    if (!state?.blueprintName || !state.installedBlueprintVersion) {
+        throw new DeveloperAgentGeneratorPlanError('prerequisite-missing', `Upgrade target ${target} requires exact installed Blueprint identity.`);
+    }
+    return {
+        blueprint: state.blueprintName === '@empire-builder-kit/blueprint-standard'
+            ? 'standard'
+            : `${state.blueprintName}@${state.installedBlueprintVersion}`,
+    };
+}
+function requireUpgradePreview(context, input, preview) {
+    if (!input.preview || !preview) {
+        return invalidGeneratorInput('Upgrade apply requires a caller-retained, digest-bound preview artifact that is revalidated and independently re-derived before apply.');
+    }
+    assertDeveloperAgentUpgradePreviewContext(context, preview);
+    if (preview.generator !== 'upgrade' ||
+        preview.operationId !== 'generator:upgrade:preview' ||
+        preview.input.generator !== 'upgrade' ||
+        preview.input.name !== input.name) {
+        return invalidGeneratorInput('Upgrade preview artifact does not match the normalized Upgrade input.');
+    }
+    return preview.generatedSurfaces;
+}
+function assertDeveloperAgentUpgradePreviewContext(context, preview) {
+    const expectedSource = (0, preview_source_js_1.developerAgentGeneratorPreviewSource)(context);
+    if (context.git.dirty) {
+        throw new DeveloperAgentGeneratorPlanError('dirty-worktree', 'Upgrade preview authorization requires a clean worktree.');
+    }
+    if (context.warnings.some(({ classification }) => classification === 'stale-base')) {
+        throw new DeveloperAgentGeneratorPlanError('stale-base', 'Upgrade preview authorization requires current default-base facts.');
+    }
+    if (!(0, node_util_1.isDeepStrictEqual)(preview.source, expectedSource)) {
+        throw new DeveloperAgentGeneratorPlanError(preview.source.commit !== context.git.commit
+            ? 'stale-base'
+            : 'generated-drift', 'Upgrade preview artifact does not match current framework, Blueprint, candidate, ownership-version, and workspace facts.');
+    }
+}
+function upgradePlan(context, input, mode, preview, rebindCompleted = false) {
+    const project = requireUpgradeProject(context, input.name);
+    const upgradeOptions = developerAgentUpgradeGeneratorOptions(context, input.name);
+    const externalBlueprint = upgradeOptions.blueprint !== undefined &&
+        upgradeOptions.blueprint !== 'standard';
+    if (mode === 'preview' && input.preview) {
+        return invalidGeneratorInput('Upgrade preview operation does not accept an earlier preview reference.');
+    }
+    if (mode === 'apply' && !input.preview) {
+        return invalidGeneratorInput('Upgrade apply requires a caller-retained, digest-bound preview artifact that is revalidated and independently re-derived before apply.');
+    }
+    const generatedSurfaces = mode === 'apply' && !rebindCompleted
+        ? sortedSurfaces([...requireUpgradePreview(context, input, preview)])
+        : [];
+    const applySurfaces = mode === 'apply'
+        ? sortedSurfaces([
+            ...generatedSurfaces,
+            surface('pnpm-lock.yaml', 'adopter-owned'),
+        ])
+        : generatedSurfaces;
+    return {
+        command: commandFor('upgrade', mode, [
+            `--name=${input.name}`,
+            ...(upgradeOptions.blueprint
+                ? [`--blueprint=${upgradeOptions.blueprint}`]
+                : []),
+            `--apply=${mode === 'apply' ? 'true' : 'false'}`,
+            ...(mode === 'apply'
+                ? [
+                    `--developerAgentPreview=${input.preview.reference}`,
+                    `--developerAgentPreviewDigest=${input.preview.digest}`,
+                ]
+                : []),
+            '--skipFormat=true',
+            '--skipInstall=true',
+        ]),
+        contracts: contracts(project.name, [
+            'configuration',
+            'release',
+            ...(externalBlueprint ? ['supply-chain'] : []),
+        ], context.selection.contracts),
+        ...(mode === 'preview'
+            ? {
+                authority: 'local-source',
+            }
+            : {}),
+        generatedSurfaces: applySurfaces,
+        projects: [project.name],
+        prospectiveVerification: [],
+        verification: [
+            ...new Set([
+                `${project.name}:verify`,
+                developerAgentWorkspaceVerificationTarget(context),
+            ]),
+        ].sort(),
+    };
+}
+function bindDeveloperAgentGeneratorPlan(context, operation, inputValue, preview) {
+    const input = parseDeveloperAgentGeneratorInput(inputValue);
+    const generatorOperation = requireMatchingOperation(operation, input);
+    if (input.generator !== 'upgrade' && 'preview' in input) {
+        return invalidGeneratorInput('Only Upgrade apply accepts a caller-retained, digest-bound preview reference.');
+    }
+    if (input.generator === 'slice') {
+        return slicePlan(context, input, generatorOperation.mode);
+    }
+    if (input.generator === 'function') {
+        return functionPlan(context, input, generatorOperation.mode);
+    }
+    if (input.generator === 'service' || input.generator === 'job') {
+        return workloadPlan(context, input, generatorOperation.mode);
+    }
+    return upgradePlan(context, input, generatorOperation.mode, preview);
+}
+/**
+ * Re-derives a completed generator's exact authority and scope from its closed
+ * typed identity plus current repository facts. Collision and preview-file
+ * checks belong to pre-mutation planning, so this path intentionally skips
+ * them while retaining the same generator plan derivation.
+ */
+function rebindDeveloperAgentGeneratorPlan(context, operation, inputValue) {
+    const input = parseDeveloperAgentGeneratorInput(inputValue);
+    const generatorOperation = requireMatchingOperation(operation, input);
+    const reboundContext = input.generator === 'slice' ||
+        (input.generator === 'upgrade' &&
+            (input.name === 'workspace' || input.name === 'foundation'))
+        ? {
+            ...context,
+            selection: {
+                contracts: [],
+                foundationCapabilities: context.selection.foundationCapabilities,
+                projectInventory: context.selection.projectInventory,
+            },
+        }
+        : context;
+    if (input.generator === 'slice') {
+        return slicePlan(reboundContext, input, generatorOperation.mode, true);
+    }
+    if (input.generator === 'function') {
+        return functionPlan(reboundContext, input, generatorOperation.mode, true);
+    }
+    if (input.generator === 'service' || input.generator === 'job') {
+        return workloadPlan(reboundContext, input, generatorOperation.mode, true);
+    }
+    return upgradePlan(reboundContext, input, generatorOperation.mode, undefined, true);
+}
+//# sourceMappingURL=generator-planning.js.map