@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/developer-agent/generator-preview.js

@@ -0,0 +1,650 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperAgentGeneratorPreviewError = void 0;
+exports.classifyDeveloperAgentUpgradePreviewFailure = classifyDeveloperAgentUpgradePreviewFailure;
+exports.createDeveloperAgentUpgradePreview = createDeveloperAgentUpgradePreview;
+exports.persistDeveloperAgentUpgradePreview = persistDeveloperAgentUpgradePreview;
+const node_buffer_1 = require("node:buffer");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const upgrade_js_1 = require("../generators/upgrade/upgrade.js");
+const model_js_1 = require("./model.js");
+const validation_js_1 = require("./validation.js");
+const generator_planning_js_1 = require("./generator-planning.js");
+const preview_changes_js_1 = require("./preview-changes.js");
+const preview_source_js_1 = require("./preview-source.js");
+const ordering_js_1 = require("./ordering.js");
+const PREVIEW_REFERENCE = /^\.ebk\/agent\/previews\/[a-z][a-z0-9-]{0,62}\.json$/;
+const MAX_PREVIEW_SURFACES = 512;
+const MAX_RECORDING_SOURCE_FILE_BYTES = 5 * 1024 * 1024;
+const MAX_RECORDING_SOURCE_TOTAL_BYTES = 32 * 1024 * 1024;
+class DeveloperAgentGeneratorPreviewError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'DeveloperAgentGeneratorPreviewError';
+    }
+}
+exports.DeveloperAgentGeneratorPreviewError = DeveloperAgentGeneratorPreviewError;
+function classifyDeveloperAgentUpgradePreviewFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes('repository trust denies') ||
+        message.includes('is not authorized for authoring')) {
+        throw new DeveloperAgentGeneratorPreviewError('policy-conflict', 'Repository Blueprint trust policy denies the exact installed publisher.');
+    }
+    if (message.includes('is not installed in the workspace') ||
+        message.includes('Blueprint trust policy does not exist') ||
+        message.includes('Blueprint trust snapshot does not exist') ||
+        message.includes('pnpm-lock.yaml does not exist')) {
+        throw new DeveloperAgentGeneratorPreviewError('prerequisite-missing', 'The exact installed Blueprint package or its offline trust prerequisites are missing.');
+    }
+    if (message.includes('Blueprint destination validation failed: the publisher plan')) {
+        throw new DeveloperAgentGeneratorPreviewError('unsupported-operation', 'The external Blueprint publisher returned an unsafe or conflicting destination plan.');
+    }
+    if (message.includes('Blueprint destination validation failed: the existing filesystem')) {
+        throw new DeveloperAgentGeneratorPreviewError('prerequisite-missing', 'External Blueprint destination prerequisites are unavailable or unsafe.');
+    }
+    if (message.includes('Resolved Blueprint package identity') ||
+        message.includes('Blueprint manifest identity') ||
+        message.includes('Installed external Blueprint') ||
+        message.includes('Local external Blueprint packages') ||
+        message.includes('Resolved installed Blueprint has no lockfile')) {
+        throw new DeveloperAgentGeneratorPreviewError('ownership-conflict', 'Installed Blueprint package identity does not match the ownership-bound exact package version.');
+    }
+    if (message.includes('optional dependency ambiguity') ||
+        message.includes('optional peer ambiguity') ||
+        message.includes('unsupported platform or native field') ||
+        message.includes('unsupported install/build') ||
+        message.includes('unsupported native build') ||
+        message.includes('unsupported bundled dependency') ||
+        message.includes('unsupported native build or binary surface') ||
+        message.includes('External Blueprint execution is unsupported on Windows') ||
+        message.includes('refuses rootless or userns-remapped Docker')) {
+        throw new DeveloperAgentGeneratorPreviewError('unsupported-operation', 'The external Blueprint dependency closure is incompatible with the pinned private Linux container boundary.');
+    }
+    if (message.includes('Blueprint package metadata is malformed') ||
+        message.includes('Invalid Blueprint manifest') ||
+        message.includes('Invalid Blueprint input schema') ||
+        message.includes('Blueprint inputs are invalid') ||
+        message.includes('Blueprint generator result') ||
+        message.includes('External Blueprint publisher') ||
+        message.includes('Resolved external Blueprint has no generator entry point') ||
+        (message.includes('requires EBK engine') &&
+            message.includes('this workspace provides')) ||
+        message.includes('Standard Foundation is incompatible with the target Blueprint')) {
+        throw new DeveloperAgentGeneratorPreviewError('unsupported-operation', 'The exact external Blueprint publisher contract is malformed, incompatible, or failed bounded execution.');
+    }
+    if (message.includes('blocked breaking Blueprint transition') ||
+        (message.includes('Breaking Blueprint migration') &&
+            message.includes('report-only in v1'))) {
+        throw new DeveloperAgentGeneratorPreviewError('unsupported-operation', 'The selected Blueprint transition requires reviewed manual succession and is not supported by typed v1 Upgrade apply.');
+    }
+    if (message.includes('user-modified managed files') ||
+        message.includes('cannot rewrite an existing seeded database migration') ||
+        message.includes('sst-version-drift') ||
+        message.includes('Recording Tree')) {
+        throw new DeveloperAgentGeneratorPreviewError('generated-drift', 'Upgrade preview encountered managed, seeded, version, or workspace-tree drift.');
+    }
+    if (message.includes('Report and apply the workspace upgrade before') ||
+        message.includes('Report and apply the Foundation upgrade before upgrading a Product Slice') ||
+        message.includes('Ownership metadata belongs to')) {
+        throw new DeveloperAgentGeneratorPreviewError('ownership-conflict', 'Upgrade preview ownership state conflicts with the required upgrade order or selected target.');
+    }
+    if (message.includes('does not exist at') ||
+        message.includes('must depend on @empire-builder-kit/runtime') ||
+        message.includes('require exact Nx and Runtime framework dependencies')) {
+        throw new DeveloperAgentGeneratorPreviewError('prerequisite-missing', 'Upgrade preview prerequisites for the selected workspace, Foundation, or Product Slice are missing.');
+    }
+    throw error;
+}
+function safePath(path) {
+    const normalized = path.normalize('NFC');
+    if (path !== normalized ||
+        path.includes('\\') ||
+        normalized.length === 0 ||
+        normalized.startsWith('/') ||
+        /^[A-Za-z]:\//.test(normalized) ||
+        node_path_1.posix.normalize(normalized) !== normalized ||
+        [...normalized].some((character) => {
+            const codePoint = character.codePointAt(0) ?? 0;
+            return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+        }) ||
+        normalized
+            .split('/')
+            .some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new Error(`Recording Tree path is unsafe: ${path}.`);
+    }
+    return normalized;
+}
+class RecordingWorkspaceTree {
+    root;
+    changes = new Map();
+    aliases = new Map();
+    originals = new Map();
+    sourceBytesRead = 0;
+    constructor(workspaceRoot) {
+        this.root = (0, node_fs_1.realpathSync)(workspaceRoot);
+    }
+    absolute(path) {
+        const normalized = safePath(path);
+        const alias = normalized.toLocaleLowerCase('en-US');
+        const prior = this.aliases.get(alias);
+        if (prior !== undefined && prior !== normalized) {
+            throw new Error(`Recording Tree refuses canonical path aliases ${prior} and ${normalized}.`);
+        }
+        this.aliases.set(alias, normalized);
+        const absolute = (0, node_path_1.resolve)(this.root, ...normalized.split('/'));
+        const fromRoot = (0, node_path_1.relative)(this.root, absolute);
+        if (fromRoot === '..' ||
+            fromRoot.startsWith(`..${node_path_1.sep}`) ||
+            (0, node_path_1.isAbsolute)(fromRoot)) {
+            throw new Error(`Recording Tree path escapes its workspace: ${path}.`);
+        }
+        return absolute;
+    }
+    entry(path) {
+        const normalized = safePath(path);
+        this.absolute(normalized);
+        const segments = normalized.split('/');
+        let current = this.root;
+        for (let index = 0; index < segments.length; index += 1) {
+            current = (0, node_path_1.resolve)(current, segments[index]);
+            try {
+                const entry = (0, node_fs_1.lstatSync)(current);
+                if (entry.isSymbolicLink()) {
+                    throw new Error(`Recording Tree refuses symbolic-link input ${segments
+                        .slice(0, index + 1)
+                        .join('/')}.`);
+                }
+                const real = (0, node_fs_1.realpathSync)(current);
+                const fromRoot = (0, node_path_1.relative)(this.root, real);
+                if (fromRoot === '..' ||
+                    fromRoot.startsWith(`..${node_path_1.sep}`) ||
+                    (0, node_path_1.isAbsolute)(fromRoot) ||
+                    fromRoot.split(node_path_1.sep).join('/') !==
+                        segments.slice(0, index + 1).join('/')) {
+                    throw new Error(`Recording Tree refuses non-canonical or escaping path ${normalized}.`);
+                }
+                if (index < segments.length - 1 && !entry.isDirectory()) {
+                    throw new Error(`Recording Tree found a non-directory ancestor for ${normalized}.`);
+                }
+                if (index === segments.length - 1)
+                    return entry;
+            }
+            catch (error) {
+                if (error &&
+                    typeof error === 'object' &&
+                    'code' in error &&
+                    error.code === 'ENOENT') {
+                    return null;
+                }
+                throw error;
+            }
+        }
+        return null;
+    }
+    readOriginal(path) {
+        const normalized = safePath(path);
+        const cached = this.originals.get(normalized);
+        if (cached !== undefined || this.originals.has(normalized)) {
+            return cached ?? null;
+        }
+        const inspected = this.entry(normalized);
+        if (inspected === null || !inspected.isFile()) {
+            this.originals.set(normalized, null);
+            return null;
+        }
+        const absolute = this.absolute(normalized);
+        let descriptor;
+        try {
+            descriptor = (0, node_fs_1.openSync)(absolute, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+            const before = (0, node_fs_1.fstatSync)(descriptor);
+            if (!before.isFile()) {
+                this.originals.set(normalized, null);
+                return null;
+            }
+            if (before.size > MAX_RECORDING_SOURCE_FILE_BYTES ||
+                this.sourceBytesRead + before.size > MAX_RECORDING_SOURCE_TOTAL_BYTES) {
+                throw new Error(`Recording Tree source exceeds its bounded read budget at ${normalized}.`);
+            }
+            const bytes = node_buffer_1.Buffer.alloc(before.size);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const count = (0, node_fs_1.readSync)(descriptor, bytes, offset, bytes.length - offset, offset);
+                if (count === 0)
+                    break;
+                offset += count;
+            }
+            const after = (0, node_fs_1.fstatSync)(descriptor);
+            if (offset !== bytes.length ||
+                after.dev !== before.dev ||
+                after.ino !== before.ino ||
+                after.size !== before.size ||
+                after.mtimeMs !== before.mtimeMs ||
+                after.ctimeMs !== before.ctimeMs) {
+                throw new Error(`Recording Tree source changed while it was read: ${normalized}.`);
+            }
+            const real = (0, node_fs_1.realpathSync)(absolute);
+            const fromRoot = (0, node_path_1.relative)(this.root, real);
+            const canonicalRelative = fromRoot.split(node_path_1.sep).join('/');
+            if (fromRoot === '..' ||
+                fromRoot.startsWith(`..${node_path_1.sep}`) ||
+                (0, node_path_1.isAbsolute)(fromRoot) ||
+                canonicalRelative !== normalized) {
+                throw new Error(`Recording Tree refuses non-canonical or escaping source ${normalized}.`);
+            }
+            this.sourceBytesRead += bytes.length;
+            this.originals.set(normalized, bytes);
+            return bytes;
+        }
+        catch (error) {
+            if (error &&
+                typeof error === 'object' &&
+                'code' in error &&
+                error.code === 'ENOENT') {
+                this.originals.set(normalized, null);
+                return null;
+            }
+            if (error &&
+                typeof error === 'object' &&
+                'code' in error &&
+                error.code === 'ELOOP') {
+                throw new Error(`Recording Tree refuses symbolic-link input ${normalized}.`);
+            }
+            throw error;
+        }
+        finally {
+            if (descriptor !== undefined)
+                (0, node_fs_1.closeSync)(descriptor);
+        }
+    }
+    source(path) {
+        const normalized = safePath(path);
+        const recorded = this.changes.get(normalized);
+        if (recorded) {
+            return recorded.content === null ? null : node_buffer_1.Buffer.from(recorded.content);
+        }
+        const original = this.readOriginal(normalized);
+        return original === null ? null : node_buffer_1.Buffer.from(original);
+    }
+    original(path) {
+        const original = this.readOriginal(path);
+        return original === null ? null : node_buffer_1.Buffer.from(original);
+    }
+    read(path, encoding) {
+        const source = this.source(path);
+        return source === null || encoding === undefined
+            ? source
+            : source.toString(encoding);
+    }
+    write(path, content, options) {
+        const normalized = safePath(path);
+        const bytes = node_buffer_1.Buffer.from(content);
+        const original = this.original(normalized);
+        if (original?.equals(bytes) && options === undefined) {
+            this.changes.delete(normalized);
+            return;
+        }
+        this.changes.set(normalized, {
+            content: bytes,
+            ...(options ? { options } : {}),
+        });
+    }
+    exists(path) {
+        const normalized = safePath(path);
+        const recorded = this.changes.get(normalized);
+        if (recorded)
+            return recorded.content !== null;
+        const entry = this.entry(normalized);
+        return entry?.isFile() === true || entry?.isDirectory() === true;
+    }
+    delete(path) {
+        const normalized = safePath(path);
+        if (this.original(normalized) === null) {
+            this.changes.delete(normalized);
+            return;
+        }
+        this.changes.set(normalized, { content: null });
+    }
+    rename(from, to) {
+        const source = this.source(from);
+        if (source === null) {
+            throw new Error(`Recording Tree cannot rename missing path ${from}.`);
+        }
+        this.write(to, source);
+        this.delete(from);
+    }
+    isFile(path) {
+        const normalized = safePath(path);
+        const recorded = this.changes.get(normalized);
+        if (recorded)
+            return recorded.content !== null;
+        return this.entry(normalized)?.isFile() === true;
+    }
+    children(path) {
+        const normalized = path === '' ? '' : safePath(path).replace(/\/+$/, '');
+        const children = new Set();
+        try {
+            const absolute = normalized === '' ? this.root : this.absolute(normalized);
+            const before = normalized === '' ? (0, node_fs_1.lstatSync)(this.root) : this.entry(normalized);
+            if (!before?.isDirectory())
+                return [];
+            for (const child of (0, node_fs_1.readdirSync)(absolute)) {
+                safePath(normalized === '' ? child : `${normalized}/${child}`);
+                children.add(child);
+            }
+            const after = normalized === '' ? (0, node_fs_1.lstatSync)(this.root) : this.entry(normalized);
+            if (!after?.isDirectory() ||
+                after.dev !== before.dev ||
+                after.ino !== before.ino ||
+                after.mtimeMs !== before.mtimeMs ||
+                after.ctimeMs !== before.ctimeMs) {
+                throw new Error(`Recording Tree directory changed while it was inspected: ${normalized || '.'}.`);
+            }
+        }
+        catch (error) {
+            if (!error ||
+                typeof error !== 'object' ||
+                !('code' in error) ||
+                error.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+        const prefix = normalized === '' ? '' : `${normalized}/`;
+        for (const [changedPath, change] of this.changes) {
+            if (!changedPath.startsWith(prefix))
+                continue;
+            const remainder = changedPath.slice(prefix.length);
+            const child = remainder.split('/')[0];
+            if (change.content === null && !remainder.includes('/')) {
+                children.delete(child);
+            }
+            else {
+                children.add(child);
+            }
+        }
+        return [...children].sort();
+    }
+    listChanges() {
+        return [...this.changes.entries()]
+            .map(([path, change]) => ({
+            content: change.content,
+            path,
+            type: change.content === null
+                ? 'DELETE'
+                : this.original(path) !== null
+                    ? 'UPDATE'
+                    : 'CREATE',
+            ...(change.options ? { options: change.options } : {}),
+        }))
+            .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
+    }
+    changePermissions(path, mode) {
+        const source = this.source(path);
+        if (source === null) {
+            throw new Error(`Recording Tree cannot change permissions for missing path ${path}.`);
+        }
+        this.write(path, source, { mode });
+    }
+}
+async function createDeveloperAgentUpgradePreview(workspaceRoot, context, input) {
+    const root = (0, node_fs_1.realpathSync)(workspaceRoot);
+    if ((0, node_fs_1.realpathSync)(context.workspace.repositoryRoot) !== root ||
+        (0, node_fs_1.realpathSync)(context.git.worktreeRoot) !== root) {
+        throw new Error('Upgrade preview context repository and Git worktree roots must match the invoked workspace.');
+    }
+    if (context.git.dirty ||
+        context.warnings.some(({ classification }) => classification === 'stale-base')) {
+        throw new Error('Upgrade preview authorization requires clean, non-stale source.');
+    }
+    if (input.preview) {
+        throw new Error('Upgrade preview creation does not accept a prior preview.');
+    }
+    const tree = new RecordingWorkspaceTree(workspaceRoot);
+    const beforeModes = (0, preview_changes_js_1.developerAgentPreviewOwnershipModes)(tree, input.name);
+    const upgradeOptions = (0, generator_planning_js_1.developerAgentUpgradeGeneratorOptions)(context, input.name);
+    try {
+        await (0, upgrade_js_1.upgradeGenerator)(tree, {
+            apply: true,
+            ...upgradeOptions,
+            name: input.name,
+            skipFormat: true,
+            skipInstall: true,
+        }, {
+            info: () => undefined,
+            warn: () => undefined,
+        }, { externalBlueprintDiagnostics: 'suppress' });
+    }
+    catch (error) {
+        classifyDeveloperAgentUpgradePreviewFailure(error);
+    }
+    const modes = new Map([
+        ...beforeModes,
+        ...(0, preview_changes_js_1.developerAgentPreviewOwnershipModes)(tree, input.name),
+    ]);
+    const changes = (0, preview_changes_js_1.createDeveloperAgentPreviewChanges)(tree.listChanges(), modes);
+    if (changes.length > MAX_PREVIEW_SURFACES) {
+        throw new Error(`Upgrade preview exceeds ${MAX_PREVIEW_SURFACES} generated surfaces.`);
+    }
+    const generatedSurfaces = changes.map(({ ownershipMode, path }) => ({
+        ownershipMode,
+        path,
+    }));
+    const preview = {
+        changes,
+        generatedSurfaces,
+        generator: 'upgrade',
+        input: { generator: 'upgrade', name: input.name },
+        kind: model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_KIND,
+        operationId: 'generator:upgrade:preview',
+        schemaVersion: model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION,
+        source: (0, preview_source_js_1.developerAgentGeneratorPreviewSource)(context),
+    };
+    (0, validation_js_1.serializeDeveloperAgentGeneratorPreview)(preview);
+    return preview;
+}
+function inspectPreviewDirectory(path, privateDirectory) {
+    const entry = (0, node_fs_1.lstatSync)(path);
+    if (entry.isSymbolicLink() ||
+        !entry.isDirectory() ||
+        (0, node_fs_1.realpathSync)(path) !== path) {
+        throw new Error(`Preview directory is not a regular directory: ${path}.`);
+    }
+    if (privateDirectory &&
+        process.platform !== 'win32' &&
+        ((typeof process.getuid === 'function' && entry.uid !== process.getuid()) ||
+            (entry.mode & 0o077) !== 0)) {
+        throw new Error(`Preview directory must be owned by the current user without group or world access: ${path}.`);
+    }
+    return entry;
+}
+function requirePrivateDirectory(path) {
+    try {
+        return inspectPreviewDirectory(path, true);
+    }
+    catch (error) {
+        if (error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'ENOENT') {
+            try {
+                (0, node_fs_1.mkdirSync)(path, { mode: 0o700 });
+            }
+            catch (mkdirError) {
+                if (!mkdirError ||
+                    typeof mkdirError !== 'object' ||
+                    !('code' in mkdirError) ||
+                    mkdirError.code !== 'EEXIST') {
+                    throw mkdirError;
+                }
+            }
+            return inspectPreviewDirectory(path, true);
+        }
+        throw error;
+    }
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function assertDirectoryIdentity(path, expected, privateDirectory) {
+    const current = inspectPreviewDirectory(path, privateDirectory);
+    if (!sameIdentity(current, expected)) {
+        throw new Error(`Preview directory identity changed during publication: ${path}.`);
+    }
+}
+function unlinkOwnedFile(path, expected) {
+    if (!expected)
+        return 'absent';
+    try {
+        const current = (0, node_fs_1.lstatSync)(path);
+        if (current.isSymbolicLink() ||
+            !current.isFile() ||
+            !sameIdentity(current, expected)) {
+            return 'not-owned';
+        }
+        (0, node_fs_1.unlinkSync)(path);
+        return 'removed';
+    }
+    catch (error) {
+        return error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'ENOENT'
+            ? 'absent'
+            : 'failed';
+    }
+}
+function persistDeveloperAgentUpgradePreview(workspaceRoot, preview, reference) {
+    if (!PREVIEW_REFERENCE.test(reference)) {
+        throw new Error('Upgrade preview output must equal .ebk/agent/previews/<safe-slug>.json.');
+    }
+    const root = (0, node_fs_1.realpathSync)(workspaceRoot);
+    const ebk = (0, node_path_1.resolve)(root, '.ebk');
+    const agent = (0, node_path_1.resolve)(ebk, 'agent');
+    const directory = (0, node_path_1.resolve)(agent, 'previews');
+    const ebkEntry = inspectPreviewDirectory(ebk, false);
+    const agentEntry = requirePrivateDirectory(agent);
+    const directoryEntry = requirePrivateDirectory(directory);
+    const finalPath = (0, node_path_1.resolve)(root, ...reference.split('/'));
+    const serialized = (0, validation_js_1.serializeDeveloperAgentGeneratorPreview)(preview);
+    const temporary = (0, node_path_1.resolve)(directory, `.${preview.input.name}.${(0, node_crypto_1.randomUUID)()}.tmp`);
+    let descriptor;
+    let temporaryIdentity;
+    let publishedIdentity;
+    let publicationComplete = false;
+    let publicationFailure;
+    const cleanupFailures = [];
+    try {
+        assertDirectoryIdentity(ebk, ebkEntry, false);
+        assertDirectoryIdentity(agent, agentEntry, true);
+        assertDirectoryIdentity(directory, directoryEntry, true);
+        descriptor = (0, node_fs_1.openSync)(temporary, node_fs_1.constants.O_CREAT |
+            node_fs_1.constants.O_EXCL |
+            node_fs_1.constants.O_WRONLY |
+            (node_fs_1.constants.O_NOFOLLOW ?? 0), 0o600);
+        const serializedBytes = node_buffer_1.Buffer.from(serialized, 'utf8');
+        let writeOffset = 0;
+        while (writeOffset < serializedBytes.length) {
+            const count = (0, node_fs_1.writeSync)(descriptor, serializedBytes, writeOffset, serializedBytes.length - writeOffset, writeOffset);
+            if (count === 0) {
+                throw new Error('Upgrade preview temporary output write stalled.');
+            }
+            writeOffset += count;
+        }
+        (0, node_fs_1.fsyncSync)(descriptor);
+        const written = (0, node_fs_1.fstatSync)(descriptor);
+        if (!written.isFile() || written.size !== serializedBytes.length) {
+            throw new Error('Upgrade preview temporary output is not regular.');
+        }
+        temporaryIdentity = written;
+        (0, node_fs_1.closeSync)(descriptor);
+        descriptor = undefined;
+        assertDirectoryIdentity(ebk, ebkEntry, false);
+        assertDirectoryIdentity(agent, agentEntry, true);
+        assertDirectoryIdentity(directory, directoryEntry, true);
+        // A hard-link publish is atomic and no-clobber on supported filesystems.
+        // Concurrent publishers need no persistent coordination artifact: the
+        // filesystem selects one winner for a shared final path. If the filesystem
+        // does not support hard links, publication fails closed.
+        (0, node_fs_1.linkSync)(temporary, finalPath);
+        publishedIdentity = temporaryIdentity;
+        descriptor = (0, node_fs_1.openSync)(finalPath, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const publishedBefore = (0, node_fs_1.fstatSync)(descriptor);
+        const publishedBytes = node_buffer_1.Buffer.alloc(publishedBefore.size);
+        let readOffset = 0;
+        while (readOffset < publishedBytes.length) {
+            const count = (0, node_fs_1.readSync)(descriptor, publishedBytes, readOffset, publishedBytes.length - readOffset, readOffset);
+            if (count === 0)
+                break;
+            readOffset += count;
+        }
+        const publishedAfter = (0, node_fs_1.fstatSync)(descriptor);
+        if (!publishedBefore.isFile() ||
+            !sameIdentity(publishedBefore, written) ||
+            publishedBefore.size !== serializedBytes.length ||
+            readOffset !== publishedBytes.length ||
+            !publishedBytes.equals(serializedBytes) ||
+            publishedAfter.dev !== publishedBefore.dev ||
+            publishedAfter.ino !== publishedBefore.ino ||
+            publishedAfter.size !== publishedBefore.size ||
+            publishedAfter.mtimeMs !== publishedBefore.mtimeMs ||
+            publishedAfter.ctimeMs !== publishedBefore.ctimeMs ||
+            (process.platform !== 'win32' &&
+                ((typeof process.getuid === 'function' &&
+                    publishedBefore.uid !== process.getuid()) ||
+                    (publishedBefore.mode & 0o077) !== 0))) {
+            throw new Error('Published upgrade preview must be exact regular bytes and, on POSIX, current-user private.');
+        }
+        (0, node_fs_1.closeSync)(descriptor);
+        descriptor = undefined;
+        assertDirectoryIdentity(ebk, ebkEntry, false);
+        assertDirectoryIdentity(agent, agentEntry, true);
+        assertDirectoryIdentity(directory, directoryEntry, true);
+        publicationComplete = true;
+    }
+    catch (error) {
+        publicationFailure = error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+        if (!publicationComplete) {
+            const finalCleanup = unlinkOwnedFile(finalPath, publishedIdentity);
+            if (publishedIdentity &&
+                finalCleanup !== 'removed' &&
+                finalCleanup !== 'absent') {
+                cleanupFailures.push(`final output (${finalCleanup})`);
+            }
+        }
+        const temporaryCleanup = unlinkOwnedFile(temporary, temporaryIdentity);
+        if (temporaryIdentity &&
+            temporaryCleanup !== 'removed' &&
+            temporaryCleanup !== 'absent') {
+            cleanupFailures.push(`temporary output (${temporaryCleanup})`);
+        }
+    }
+    if (cleanupFailures.length > 0) {
+        const original = publicationFailure instanceof Error
+            ? ` Original failure: ${publicationFailure.message}`
+            : publicationFailure === undefined
+                ? ''
+                : ' Original publication also failed.';
+        throw new DeveloperAgentGeneratorPreviewError('cleanup-incomplete', `Upgrade preview publication could not clean its generation-owned ${cleanupFailures.join(', ')}.${original}`);
+    }
+    if (publicationFailure !== undefined)
+        throw publicationFailure;
+    const receipt = {
+        digest: `sha256:${(0, node_crypto_1.createHash)('sha256')
+            .update(serialized, 'utf8')
+            .digest('hex')}`,
+        kind: model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_RECEIPT_KIND,
+        preview,
+        reference,
+        schemaVersion: model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION,
+    };
+    (0, validation_js_1.serializeDeveloperAgentGeneratorPreviewReceipt)(receipt);
+    return receipt;
+}
+//# sourceMappingURL=generator-preview.js.map