@fabrika/builder 0.2.0 → 0.3.2

package/daemon/src/paths.ts

@@ -1,16 +1,14 @@
 import { createCanvasPaths } from '@fabrika/canvas-kernel/server'
-import { existsSync } from 'fs'
 import { homedir, tmpdir } from 'os'
 import { join, resolve } from 'path'
 
 export const NEUTRAL_DATA_DIR = join(homedir(), '.fabrika')
-export const LEGACY_DATA_DIR = join(homedir(), '.claude', 'fabrika')
 
-export function resolveDataDir(): string {
-	const explicit = process.env['FABRIKA_DATA_DIR']
+// The CLI passes `--data-dir`; a daemon started by hand falls back to FABRIKA_DATA_DIR.
+export function resolveDataDir(argv: readonly string[] = process.argv, env: NodeJS.ProcessEnv = process.env): string {
+	const flag = argv.indexOf('--data-dir')
+	const explicit = (flag === -1 ? undefined : argv[flag + 1]) ?? env['FABRIKA_DATA_DIR']
 	if (explicit) return resolve(explicit)
-	if (existsSync(NEUTRAL_DATA_DIR)) return NEUTRAL_DATA_DIR
-	if (existsSync(LEGACY_DATA_DIR)) return LEGACY_DATA_DIR
 	return NEUTRAL_DATA_DIR
 }
 
@@ -18,6 +16,7 @@ export const paths = createCanvasPaths({
 	appName: 'fabrika',
 	dataDir: resolveDataDir(),
 	tempDir: join(tmpdir(), 'fabrika'),
+	ensure: false,
 })
 
 export const DATA_DIR = paths.dataDir

package/daemon/src/phases.ts

@@ -1,99 +1,6 @@
 import { existsSync, readdirSync, statSync } from 'fs'
 import { basename, dirname, join } from 'path'
-
-export type PhaseId =
-	| 'intake'
-	| 'vision'
-	| 'flows'
-	| 'tech'
-	| 'design'
-	| 'skeletons'
-	| 'issues'
-	| 'build'
-
-export interface Phase {
-	id: PhaseId
-	index: number
-	title: string
-	reads: string[]
-	produces: string[]
-	gate: boolean
-	gateName?: string
-}
-
-export const PHASES: Phase[] = [
-	{
-		id: 'intake',
-		index: 1,
-		title: 'Intake (brief → classification)',
-		reads: ['intent/brief.md'],
-		produces: ['intent/brief.md'],
-		gate: true,
-		gateName: 'intake',
-	},
-	{
-		id: 'vision',
-		index: 2,
-		title: 'Vision + scope + principles',
-		reads: ['intent/brief.md'],
-		produces: ['intent/glossary.md', 'principles/principles.md'],
-		gate: true,
-		gateName: 'vision',
-	},
-	{
-		id: 'flows',
-		index: 3,
-		title: 'User flows',
-		reads: ['intent/*', 'principles/*'],
-		produces: ['architecture/flows/*.flow.md'],
-		gate: true,
-		gateName: 'flows',
-	},
-	{
-		id: 'tech',
-		index: 4,
-		title: 'Tech + scaffold decision',
-		reads: ['architecture/flows/*'],
-		produces: ['architecture/tech.md'],
-		gate: true,
-		gateName: 'tech',
-	},
-	{
-		id: 'design',
-		index: 5,
-		title: 'Design tokens + mockups',
-		reads: ['architecture/flows/*', 'architecture/tech.md'],
-		produces: ['architecture/design.md', 'pages/*.jsx'],
-		gate: true,
-		gateName: 'design',
-	},
-	{
-		id: 'skeletons',
-		index: 6,
-		title: 'Opice skeletons',
-		reads: ['architecture/flows/*', 'architecture/spec/*'],
-		produces: ['../tests/browser/*.test.ts'],
-		gate: true,
-		gateName: 'skeletons',
-	},
-	{
-		id: 'issues',
-		index: 7,
-		title: 'Induce issues (compile step, not a real phase — SPEC §6.4)',
-		reads: ['../tests/browser/*'],
-		produces: ['issues/ISSUE-*.md'],
-		gate: false,
-	},
-	{
-		id: 'build',
-		index: 8,
-		title: 'Build (agent-assisted, supervised subagents)',
-		reads: ['issues/*'],
-		produces: [],
-		gate: true,
-		gateName: 'build',
-	},
-]
+import { isPhaseHint, type Phase, phaseById, type PhaseId, PHASES } from '../../shared/phases'
 
 export interface PhaseState {
 	current: PhaseId
@@ -111,8 +18,8 @@ export interface GateOracle {
 	hasGateRevision?(sessionId: string, gateName: string): boolean
 }
 
-function expandGlob(fabrikaDir: string, glob: string): string[] {
-	const abs = join(fabrikaDir, glob)
+function expandGlob(repoRoot: string, glob: string): string[] {
+	const abs = join(repoRoot, glob)
 	if (!abs.includes('*')) {
 		return existsSync(abs) ? [abs] : []
 	}
@@ -144,10 +51,10 @@ function isNonEmptyFile(p: string): boolean {
 	}
 }
 
-export function producesSatisfied(phase: Phase, fabrikaDir: string): boolean {
-	if (phase.produces.length === 0) return false
+export function producesSatisfied(phase: Phase, repoRoot: string): boolean {
 	for (const glob of phase.produces) {
-		const matches = expandGlob(fabrikaDir, glob).filter(isNonEmptyFile)
+		if (isPhaseHint(glob)) return false
+		const matches = expandGlob(repoRoot, glob).filter(isNonEmptyFile)
 		if (matches.length === 0) return false
 	}
 	return true
@@ -161,17 +68,14 @@ export function gateSatisfied(
 	if (!phase.gate) return true
 	if (!oracle) return true
 	if (oracle.getLatestUnconsumedFeedback(sessionId) !== null) return false
-	if (oracle.hasGateRevision && phase.gateName) {
-		return oracle.hasGateRevision(sessionId, phase.gateName)
-	}
-	return true
+	return oracle.hasGateRevision?.(sessionId, phase.id) ?? true
 }
 
-function resolveReads(phase: Phase, fabrikaDir: string): string[] {
+function resolveReads(phase: Phase, repoRoot: string): string[] {
 	const out: string[] = []
-	for (const glob of phase.reads) {
+	for (const glob of phase.reads.filter((read) => !isPhaseHint(read))) {
 		out.push(
-			...expandGlob(fabrikaDir, glob).filter(p => {
+			...expandGlob(repoRoot, glob).filter(p => {
 				try {
 					return statSync(p).size > 0 || statSync(p).isDirectory()
 				} catch {
@@ -188,34 +92,31 @@ export function derivePhaseState(
 	sessionId = '',
 	oracle?: GateOracle,
 ): PhaseState {
+	const repoRoot = dirname(fabrikaDir)
 	const completed: PhaseId[] = []
 
 	for (const phase of PHASES) {
-		if (producesSatisfied(phase, fabrikaDir) && gateSatisfied(phase, sessionId, oracle)) {
+		const satisfied = producesSatisfied(phase, repoRoot)
+		if (satisfied && gateSatisfied(phase, sessionId, oracle)) {
 			completed.push(phase.id)
 			continue
 		}
-		return {
-			current: phase.id,
-			index: phase.index,
-			completed,
-			reads: resolveReads(phase, fabrikaDir),
-			produces: phase.produces,
-			gate: phase.gate,
-			...(phase.gateName ? { gateName: phase.gateName } : {}),
-			satisfied: producesSatisfied(phase, fabrikaDir),
-		}
+		return toState(phase, repoRoot, completed, satisfied)
 	}
 
-	const build = PHASES[PHASES.length - 1]!
+	const build = phaseById('build')
+	return toState(build, repoRoot, completed.filter(id => id !== build.id), false)
+}
+
+function toState(phase: Phase, repoRoot: string, completed: PhaseId[], satisfied: boolean): PhaseState {
 	return {
-		current: build.id,
-		index: build.index,
-		completed: completed.filter(id => id !== build.id),
-		reads: resolveReads(build, fabrikaDir),
-		produces: build.produces,
-		gate: build.gate,
-		...(build.gateName ? { gateName: build.gateName } : {}),
-		satisfied: false,
+		current: phase.id,
+		index: phase.number,
+		completed,
+		reads: resolveReads(phase, repoRoot),
+		produces: phase.produces,
+		gate: phase.gate,
+		...(phase.gate ? { gateName: phase.id } : {}),
+		satisfied,
 	}
 }

package/daemon/src/platform-compiler.ts

@@ -0,0 +1,21 @@
+import { compileFabrikaManifest, createZeropsArtifactSourceDescriptor, isZeropsAppConfig } from '@fabrika/provider-zerops'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+// This entry point is executed only in the credential-free child process.
+async function compile(): Promise<void> {
+	const env = process.argv[2]
+	const output = process.argv[3]
+	if (!env || !output) throw new Error('Missing compiler arguments')
+	const module: unknown = await import(pathToFileURL(join(process.cwd(), 'fabrika.config.ts')).href)
+	const config: unknown = typeof module === 'object' && module !== null ? Reflect.get(module, 'default') : undefined
+	if (!isZeropsAppConfig(config)) throw new Error('Unsupported project config')
+	const source = await createZeropsArtifactSourceDescriptor(await Bun.file('zerops.yaml').text())
+	await Bun.write(output, JSON.stringify(compileFabrikaManifest(config, env, source)))
+}
+
+if (import.meta.main) {
+	await compile().catch(() => {
+		process.exitCode = 1
+	})
+}

package/daemon/src/platform-remote.ts

@@ -0,0 +1,146 @@
+import { createRpcClient, type RpcFetch } from '@fabrika/app'
+import type { AppEnvDto, ControlRpcContract, JsonValue, ProviderEnvelopeDto, RunStatus } from '@fabrika/control-contract'
+import { z } from 'zod'
+import { parseBuilderOrigin } from '../../shared'
+import { PlatformError, type StoredCredential, storedIntegerSchema, storedTextSchema } from './platform-storage'
+
+const discoveryInputSchema = z.object({ version: z.literal(1), controlOrigin: z.unknown(), iamIssuer: z.unknown(), provider: z.unknown() })
+	.strict().refine(value => Object.keys(value).length === 4)
+const rpcResultSchema = z.object({ result: z.unknown() }).passthrough().refine(value =>
+	Object.hasOwn(value, 'result') && !Object.hasOwn(value, 'error')
+)
+const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>
+	z.union([
+		z.null(),
+		z.string(),
+		z.boolean(),
+		z.number().finite(),
+		z.array(jsonValueSchema),
+		z.record(jsonValueSchema),
+	])
+)
+const envelopeSchema: z.ZodType<ProviderEnvelopeDto> = z.object({
+	provider: storedTextSchema,
+	version: storedIntegerSchema,
+	payload: jsonValueSchema,
+})
+const environmentsSchema = z.object({
+	items: z.array(z.object({
+		appId: storedTextSchema,
+		env: storedTextSchema,
+		domain: storedTextSchema.nullable(),
+		publicOrigin: storedTextSchema.nullable(),
+		triggerRef: storedTextSchema.nullable(),
+		namespaceId: storedTextSchema.nullable(),
+		provider: storedTextSchema,
+		target: envelopeSchema,
+		artifact: envelopeSchema,
+		createdAt: storedIntegerSchema,
+	})),
+})
+const runSchema = z.object({
+	id: storedTextSchema,
+	appId: storedTextSchema,
+	env: storedTextSchema,
+	ref: storedTextSchema,
+	commitSha: storedTextSchema.nullable(),
+	status: z.enum(['pending', 'running', 'succeeded', 'failed']),
+})
+
+export async function boundedJson(response: Response): Promise<unknown> {
+	if (!response.ok) {
+		await response.body?.cancel()
+		throw new PlatformError(`Platform request failed (HTTP ${response.status})`)
+	}
+	const reader = response.body?.getReader()
+	if (!reader) throw new PlatformError('Platform response is empty')
+	let size = 0
+	const chunks: Uint8Array[] = []
+	try {
+		while (true) {
+			const part = await reader.read()
+			if (part.done) break
+			size += part.value.byteLength
+			if (size > 1024 * 1024) throw new PlatformError('Platform response exceeds size limit')
+			chunks.push(part.value)
+		}
+		return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+	} finally {
+		await reader.cancel()
+	}
+}
+
+export class PlatformRemote {
+	constructor(private readonly fetcher: RpcFetch = fetch, readonly signal: AbortSignal) {}
+
+	async json(url: string, body?: unknown): Promise<unknown> {
+		try {
+			return await boundedJson(
+				await this.fetcher(url, {
+					method: body === undefined ? 'GET' : 'POST',
+					...(body === undefined ? {} : { body: JSON.stringify(body), headers: { 'content-type': 'application/json' } }),
+					redirect: 'error',
+					credentials: 'omit',
+					signal: AbortSignal.any([this.signal, AbortSignal.timeout(30_000)]),
+				}),
+			)
+		} catch (error) {
+			throw error instanceof PlatformError ? error : new PlatformError('Platform request failed or returned invalid data')
+		}
+	}
+
+	async discover(origin: string): Promise<{ controlOrigin: string; iamIssuer: string }> {
+		const result = discoveryInputSchema.safeParse(await this.json(`${origin}/.well-known/fabrika-builder`))
+		if (!result.success) throw new PlatformError('Unsupported builder discovery response')
+		const discovery = result.data
+		const controlOrigin = parseBuilderOrigin(discovery.controlOrigin, 'Control origin')
+		const iamIssuer = parseBuilderOrigin(discovery.iamIssuer, 'IAM issuer')
+		if (controlOrigin !== origin) throw new PlatformError('Discovery Control origin does not match the requested installation')
+		if (discovery.provider !== 'zerops') throw new PlatformError('Unsupported provider: this builder release supports Zerops only')
+		return { controlOrigin, iamIssuer }
+	}
+
+	control(credential: StoredCredential) {
+		return this.controlForReceipt(credential.connection.controlOrigin, credential.token)
+	}
+
+	controlForReceipt(controlOrigin: string, token: string) {
+		const endpoint = `${controlOrigin}/api/rpc`
+		return createRpcClient<ControlRpcContract>({
+			baseUrl: endpoint,
+			fetch: async (input, init) => {
+				if (input !== endpoint) throw new PlatformError('Control endpoint mismatch')
+				const headers = new Headers(init?.headers)
+				headers.set('authorization', `Bearer ${token}`)
+				const response = await this.fetcher(input, {
+					...init,
+					headers,
+					credentials: 'omit',
+					redirect: 'error',
+					signal: AbortSignal.any([this.signal, AbortSignal.timeout(30_000)]),
+				})
+				const data = rpcResultSchema.safeParse(await boundedJson(response))
+				if (!data.success) throw new PlatformError('Control refused the request')
+				return Response.json({ result: data.data.result })
+			},
+		})
+	}
+}
+
+export function parseEnvironments(value: unknown): AppEnvDto[] {
+	const result = environmentsSchema.safeParse(value)
+	if (!result.success) {
+		const invalidList = result.error.issues.some(issue => issue.path.length === 1 && issue.path[0] === 'items')
+		throw new PlatformError(invalidList ? 'Invalid environment list' : 'Invalid stored or upstream data')
+	}
+	return result.data.items
+}
+
+export function parseRun(value: unknown): { id: string; appId: string; env: string; ref: string; commitSha: string | null; status: RunStatus } {
+	const result = runSchema.safeParse(value)
+	if (!result.success) {
+		const invalidStatus = result.error.issues.some(issue => issue.path[0] === 'status')
+		throw new PlatformError(invalidStatus ? 'Invalid deploy run status' : 'Invalid stored or upstream data')
+	}
+	return result.data
+}

package/daemon/src/platform-routes.ts

@@ -0,0 +1,46 @@
+import type { Route } from '@fabrika/daemon-kit'
+import { z } from 'zod'
+import { type BuilderPlatformStatus, parseConnectProjectInput, parsePreviewProjectInput, parseRegisterProjectInput } from '../../shared'
+import type { BuilderPlatform } from './platform'
+import { boundedJson } from './platform-remote'
+import { PlatformError } from './platform-storage'
+
+const emptyActionSchema = z.object({}).strict()
+
+export function createPlatformRoutes(platform: BuilderPlatform): Route[] {
+	return ['register', 'platform', 'connect', 'disconnect', 'deploy', 'preview'].map((action) => ({
+		method: action === 'platform' ? 'GET' : 'POST',
+		pattern: new URLPattern({ pathname: `/api/project/:id/${action}` }),
+		handler: async (req, _url, match) => {
+			try {
+				const id = match.pathname.groups['id']
+				if (!id) throw new PlatformError('Missing project ID')
+				if (action === 'platform') return Response.json(platform.status(id), { headers: { 'cache-control': 'no-store' } })
+				const body = await boundedJson(new Response(req.body))
+				let status: BuilderPlatformStatus
+				switch (action) {
+					case 'register':
+						status = platform.register(id, parseRegisterProjectInput(body).projectRoot)
+						break
+					case 'connect':
+						status = await platform.connect(id, parseConnectProjectInput(body).controlOrigin)
+						break
+					case 'preview':
+						status = platform.preview(id, parsePreviewProjectInput(body).url)
+						break
+					default:
+						if (!emptyActionSchema.safeParse(body).success) throw new PlatformError('Action expects an empty JSON object')
+						status = action === 'deploy' ? platform.deploy(id) : platform.disconnect(id)
+				}
+				return Response.json(status, { headers: { 'cache-control': 'no-store' } })
+			} catch (error) {
+				return Response.json({
+					error: {
+						code: 'builder_platform',
+						message: error instanceof PlatformError ? error.message : 'Invalid project request or unavailable local storage',
+					},
+				}, { status: 400, headers: { 'cache-control': 'no-store' } })
+			}
+		},
+	}))
+}

package/daemon/src/platform-source.ts

@@ -0,0 +1,147 @@
+import type { AppDto } from '@fabrika/control-contract'
+import {
+	type FabrikaManifest,
+	normalizeZeropsSourceRepository,
+	parseFabrikaManifest,
+	verifyZeropsArtifactSourceDescriptor,
+} from '@fabrika/provider-zerops'
+import { chmodSync, lstatSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { noSymlinks, PlatformError } from './platform-storage'
+
+async function git(root: string, args: string[], signal: AbortSignal): Promise<string> {
+	const child = Bun.spawn(['git', '-C', root, ...args], {
+		env: gitEnvironment(process.env),
+		stdout: 'pipe',
+		stderr: 'ignore',
+		stdin: 'ignore',
+		signal,
+		timeout: 60_000,
+	})
+	const [output, code] = await Promise.all([new Response(child.stdout).text(), child.exited])
+	if (code !== 0 || output.length > 1024 * 1024) throw new PlatformError('Git verification failed; check the repository and your Git credentials')
+	return output.trim()
+}
+
+export function repositoryIdentity(url: string): string {
+	const ssh = /^git@github\.com:([^\s]+)$/.exec(url) ?? /^ssh:\/\/git@github\.com\/([^\s]+)$/.exec(url)
+	try {
+		const repository = normalizeZeropsSourceRepository(ssh ? `https://github.com/${ssh[1]}` : url)
+		return `${repository.owner}/${repository.name}`
+	} catch {
+		throw new PlatformError('Source must identify the approved GitHub repository')
+	}
+}
+
+export async function verifySource(root: string, app: AppDto, signal: AbortSignal): Promise<string> {
+	if (realpathSync(await git(root, ['rev-parse', '--show-toplevel'], signal)) !== root) {
+		throw new PlatformError('Project must be the Git repository root')
+	}
+	if (app.workerDir && app.workerDir !== '.') throw new PlatformError('Builder deployment requires repository-root application sources')
+	if (app.configPath && app.configPath !== 'fabrika.config.ts' && app.configPath !== './fabrika.config.ts') {
+		throw new PlatformError('Approved application config path does not match')
+	}
+	if (await git(root, ['status', '--porcelain=v1', '--untracked-files=all'], signal)) {
+		throw new PlatformError('Commit all tracked and untracked source changes before deploying')
+	}
+	for (const name of ['fabrika.config.ts', 'zerops.yaml']) {
+		noSymlinks(join(root, name))
+		if (!lstatSync(join(root, name)).isFile()) throw new PlatformError('Application config and descriptor must be regular files')
+		const entry = await git(root, ['ls-files', '--stage', '--', name], signal)
+		if (!/^100(?:644|755) [0-9a-f]{40,64} 0\t/.test(entry)) {
+			throw new PlatformError('Application config and descriptor must be tracked nonsymlink files')
+		}
+	}
+	const sha = await git(root, ['rev-parse', '--verify', 'HEAD^{commit}'], signal)
+	if (!/^[0-9a-f]{40}$/.test(sha)) throw new PlatformError('Repository must have a full SHA-1 HEAD commit')
+	// Read the configured URL, not `remote get-url`, which expands local transport rewrites.
+	const remote = await git(root, ['config', '--get', 'remote.origin.url'], signal)
+	if (repositoryIdentity(remote) !== repositoryIdentity(app.repoUrl)) {
+		throw new PlatformError('Repository origin does not match the approved application')
+	}
+	const branch = await git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD'], signal)
+	const refs = await git(root, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], signal)
+	if (refs !== `${sha}\trefs/heads/${branch}`) throw new PlatformError('Push the current branch HEAD before deploying')
+	return sha
+}
+
+export function compilerEnvironment(source: Readonly<Record<string, string | undefined>>): Record<string, string> {
+	const result: Record<string, string> = { NODE_ENV: 'production' }
+	for (const key of ['PATH', 'LANG', 'LC_ALL', 'TZ']) {
+		const value = source[key]
+		if (value !== undefined) result[key] = value
+	}
+	return result
+}
+
+export function gitEnvironment(source: Readonly<Record<string, string | undefined>>): Record<string, string> {
+	const result: Record<string, string> = {}
+	for (
+		const key of [
+			'HOME',
+			'USER',
+			'LOGNAME',
+			'PATH',
+			'LANG',
+			'LC_ALL',
+			'TERM',
+			'DISPLAY',
+			'WAYLAND_DISPLAY',
+			'XDG_CONFIG_HOME',
+			'SSH_AUTH_SOCK',
+			'SSH_AGENT_PID',
+			'SSH_ASKPASS',
+			'SSH_ASKPASS_REQUIRE',
+			'GIT_ASKPASS',
+			'GIT_SSH',
+			'GIT_SSH_COMMAND',
+			'GIT_SSH_VARIANT',
+			'GIT_TERMINAL_PROMPT',
+			'GIT_CONFIG_GLOBAL',
+			'GIT_CONFIG_SYSTEM',
+			'GIT_CONFIG_NOSYSTEM',
+			'GIT_SSL_CAINFO',
+			'GIT_SSL_CAPATH',
+			'SSL_CERT_FILE',
+			'SSL_CERT_DIR',
+		]
+	) {
+		const value = source[key]
+		if (value !== undefined) result[key] = value
+	}
+	return result
+}
+
+export async function compileProject(root: string, env: string, appId: string, tempParent: string, signal: AbortSignal): Promise<FabrikaManifest> {
+	noSymlinks(tempParent)
+	const directory = mkdtempSync(join(tempParent, 'compile-'))
+	chmodSync(directory, 0o700)
+	const output = join(directory, 'manifest.json')
+	try {
+		const child = Bun.spawn([process.execPath, '--no-env-file', fileURLToPath(new URL('./platform-compiler.ts', import.meta.url)), env, output], {
+			cwd: root,
+			env: compilerEnvironment(process.env),
+			stdout: 'ignore',
+			stderr: 'ignore',
+			stdin: 'ignore',
+			signal,
+			timeout: 120_000,
+		})
+		if (await child.exited !== 0) throw new PlatformError('Application compilation failed')
+		noSymlinks(output)
+		const stat = lstatSync(output)
+		if (!stat.isFile() || stat.size > 1024 * 1024) throw new PlatformError('Invalid compiler result')
+		const parsed: unknown = JSON.parse(readFileSync(output, 'utf8'))
+		const manifest = parseFabrikaManifest(parsed, { appId, env })
+		await verifyZeropsArtifactSourceDescriptor(manifest.target.sourceDescriptor)
+		if (manifest.target.sourceDescriptor.contents !== readFileSync(join(root, 'zerops.yaml'), 'utf8')) {
+			throw new PlatformError('Compiled descriptor differs from the source')
+		}
+		return manifest
+	} catch (error) {
+		throw error instanceof PlatformError ? error : new PlatformError('Application compilation returned an invalid manifest')
+	} finally {
+		rmSync(directory, { recursive: true, force: true })
+	}
+}