@git.zone/tsbundle 2.11.4 → 2.13.0

package/ts/mod_custom/index.ts

@@ -2,20 +2,36 @@ import * as plugins from './plugins.js';
 import * as paths from '../paths.js';
 import * as interfaces from '../interfaces/index.js';
 import { TsBundle } from '../tsbundle.class.tsbundle.js';
-import { HtmlHandler } from '../mod_html/index.js';
 import { Base64TsOutput } from '../mod_output/index.js';
-
-const TEMP_DIR = '.nogit/tsbundle-temp';
+import {
+  chunkManifestFile,
+  createProcessOwnership,
+  getChunkNamespace,
+  isProcessOwnershipActive,
+  publishGeneratedArtifacts,
+  startOwnershipHeartbeat,
+  withArtifactPublicationLocks,
+  type IAdditionalArtifact,
+} from '../mod_output/artifactpublisher.js';
+
+const legacyTempDir = '.nogit/tsbundle-temp';
+const localTempPrefix = 'tsbundle-temp-';
+const cleanupTempPrefix = '.tsbundle-temp-cleanup-';
 const toolCacheMarkerFile = '.gitzone-tool-cache.json';
 const toolCacheOwner = '@git.zone/tsbundle';
 const tempCacheKind = 'bundle-temp-workspace';
 const staleTempThresholdMs = 24 * 60 * 60 * 1000;
+const minimumTempLeaseTimeoutMs = 2 * 60 * 1000;
 
 interface IToolCacheMarker {
   owner: string;
   kind: string;
   safeToPrune: boolean;
   createdAt: string;
+  invocationId?: string;
+  leaseManaged?: boolean;
+  processId?: number;
+  processIdentity?: string;
   schemaVersion: 1;
 }
 
@@ -23,6 +39,7 @@ interface ITempWorkspace {
   tempDir: string;
   canCleanupWorkspace: boolean;
   cleanupOnFailure: boolean;
+  marker?: IToolCacheMarker;
 }
 
 export class CustomBundleHandler {
@@ -30,6 +47,7 @@ export class CustomBundleHandler {
   private config!: interfaces.ITsbundleConfig;
   private cliOptions: interfaces.ICustomBundleCliOptions;
   private didRunStartupCleanup = false;
+  private readonly invocationId = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
 
   constructor(cwd: string = paths.cwd, cliOptions: interfaces.ICustomBundleCliOptions = {}) {
     this.cwd = cwd;
@@ -78,16 +96,17 @@ export class CustomBundleHandler {
     const tempWorkspace = await this.prepareTempWorkspace();
     const tempDir = tempWorkspace.tempDir;
     const tempBundlePath = plugins.path.join(tempDir, 'bundle.js');
-
-    // A marked workspace can survive a failed or explicitly retained build. Clear
-    // only the files this build owns so an old map cannot leak into new output.
-    await plugins.fsPromises.rm(tempBundlePath, { force: true });
-    await plugins.fsPromises.rm(`${tempBundlePath}.map`, { force: true });
+    const stopTempHeartbeat = tempWorkspace.marker
+      ? startOwnershipHeartbeat(plugins.path.join(tempDir, toolCacheMarkerFile))
+      : undefined;
 
     // Build the bundle to temp location
     const tsbundle = new TsBundle();
     let completedSuccessfully = false;
     try {
+      // A marked workspace can survive a failed or explicitly retained build.
+      // Clear prior generated artifacts so stale chunks cannot leak into output.
+      await this.clearTempBuildArtifacts(tempDir);
       await tsbundle.build(
         this.cwd,
         bundleConfig.from,
@@ -96,6 +115,8 @@ export class CustomBundleHandler {
           bundler,
           production: bundleConfig.production || false,
           sourcemap: bundleConfig.sourcemap !== false,
+          banner: bundleConfig.banner,
+          chunkOwner: plugins.path.basename(bundleConfig.to),
         }
       );
 
@@ -106,18 +127,19 @@ export class CustomBundleHandler {
       }
 
       completedSuccessfully = true;
-    } catch (error: any) {
+    } catch (error: unknown) {
       console.error(`\n\x1b[31m❌ Bundle failed: ${bundleConfig.from} -> ${bundleConfig.to}\x1b[0m`);
       // Don't re-print error details - they were already shown by the child process.
       // Propagate the failure so package builds cannot succeed without their bundle.
       throw error;
     } finally {
+      stopTempHeartbeat?.();
       if (completedSuccessfully && tempWorkspace.canCleanupWorkspace && !this.shouldKeepTemp(bundleConfig)) {
-        await this.cleanupTempWorkspace('successful bundle', tempDir);
+        await this.cleanupTempWorkspace('successful bundle', tempDir, tempWorkspace.marker);
       } else if (completedSuccessfully) {
         console.log(`Keeping tsbundle temp workspace: ${tempDir}`);
       } else if (tempWorkspace.cleanupOnFailure && !this.shouldKeepTemp(bundleConfig)) {
-        await this.cleanupTempWorkspace('failed bundle', tempDir);
+        await this.cleanupTempWorkspace('failed bundle', tempDir, tempWorkspace.marker);
       }
     }
   }
@@ -132,42 +154,77 @@ export class CustomBundleHandler {
       return false;
     }
 
-    const tempDir = this.getTempDir();
-    const marker = await this.readTempMarker(tempDir);
+    let didCleanup = await this.cleanupStaleMarkedTempWorkspaces(
+      this.getProjectTempRoot(),
+      thresholdMsArg,
+    );
+    didCleanup = await this.cleanupStaleMarkedTempWorkspaces(
+      plugins.os.tmpdir(),
+      thresholdMsArg,
+    ) || didCleanup;
+
+    const legacyTempPath = this.getTempDir();
+    const marker = await this.readTempMarker(legacyTempPath);
     if (!marker) {
-      return false;
+      return didCleanup;
     }
 
     const createdAt = Date.parse(marker.createdAt);
-    if (Number.isFinite(createdAt) && Date.now() - createdAt < thresholdMsArg) {
-      return false;
+    if (!Number.isFinite(createdAt) || Date.now() - createdAt < thresholdMsArg) {
+      return didCleanup;
+    }
+    if (this.isTempMarkerActive(marker, legacyTempPath, thresholdMsArg)) {
+      return didCleanup;
     }
 
-    await this.cleanupTempWorkspace('stale marked temp workspace');
-    return true;
+    didCleanup = await this.cleanupTempWorkspace(
+      'stale marked temp workspace',
+      legacyTempPath,
+      marker,
+    ) || didCleanup;
+    return didCleanup;
   }
 
   private getTempDir(): string {
-    return plugins.path.join(this.cwd, TEMP_DIR);
+    return plugins.path.join(this.cwd, legacyTempDir);
   }
 
-  private assertExpectedTempDir(tempDirArg: string): void {
-    const expected = plugins.path.resolve(this.cwd, TEMP_DIR);
-    const actual = plugins.path.resolve(tempDirArg);
-    if (actual !== expected) {
-      throw new Error(`Refusing to clean unexpected tsbundle temp path: ${tempDirArg}`);
-    }
+  private getProjectTempRoot(): string {
+    return plugins.path.join(this.cwd, '.nogit');
   }
 
   private assertManagedTempDir(tempDirArg: string): void {
-    const expected = plugins.path.resolve(this.cwd, TEMP_DIR);
+    const expected = plugins.path.resolve(this.cwd, legacyTempDir);
     const actual = plugins.path.resolve(tempDirArg);
+    const projectTempRoot = plugins.path.resolve(this.getProjectTempRoot());
     const osTempRoot = plugins.path.resolve(plugins.os.tmpdir());
-    const isIsolatedTemp = plugins.path.dirname(actual) === osTempRoot
-      && plugins.path.basename(actual).startsWith('tsbundle-temp-');
-    if (actual !== expected && !isIsolatedTemp) {
+    const isExpectedTemp = actual === expected;
+    const basename = plugins.path.basename(actual);
+    const hasManagedName = basename.startsWith(localTempPrefix)
+      || basename.startsWith(cleanupTempPrefix);
+    const isProjectTemp = plugins.path.dirname(actual) === projectTempRoot && hasManagedName;
+    const isOsTemp = plugins.path.dirname(actual) === osTempRoot && hasManagedName;
+    if (!isExpectedTemp && !isProjectTemp && !isOsTemp) {
       throw new Error(`Refusing to clean unexpected tsbundle temp path: ${tempDirArg}`);
     }
+
+    const stat = plugins.fsSync.lstatSync(actual);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Refusing to use symbolic-link temp path: ${tempDirArg}`);
+    }
+
+    const physicalActual = plugins.fsSync.realpathSync(actual);
+    const physicalParent = plugins.fsSync.realpathSync(plugins.path.dirname(actual));
+    const physicalCwd = plugins.fsSync.realpathSync(this.cwd);
+    const physicalExpected = plugins.path.join(physicalCwd, legacyTempDir);
+    const physicalProjectTempRoot = plugins.path.join(physicalCwd, '.nogit');
+    const physicalOsTempRoot = plugins.fsSync.realpathSync(osTempRoot);
+    const isPhysicalExpected = isExpectedTemp && physicalActual === physicalExpected;
+    const isPhysicalProjectTemp = isProjectTemp && physicalParent === physicalProjectTempRoot;
+    const isPhysicalOsTemp = isOsTemp && physicalParent === physicalOsTempRoot;
+    if (!isPhysicalExpected && !isPhysicalProjectTemp && !isPhysicalOsTemp) {
+      throw new Error(`Refusing to use temp path outside its physical owner: ${tempDirArg}`);
+    }
   }
 
   private isTruthy(valueArg: unknown): boolean {
@@ -181,6 +238,43 @@ export class CustomBundleHandler {
     return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'y';
   }
 
+  private hasErrorCode(errorArg: unknown): errorArg is NodeJS.ErrnoException {
+    return typeof errorArg === 'object' && errorArg !== null && 'code' in errorArg;
+  }
+
+  private isTempMarkerActive(
+    markerArg: IToolCacheMarker,
+    tempDirArg: string,
+    leaseTimeoutMsArg: number,
+  ): boolean {
+    if (!markerArg.processId) {
+      return false;
+    }
+    return isProcessOwnershipActive(
+      {
+        leaseManaged: markerArg.leaseManaged,
+        processId: markerArg.processId,
+        processIdentity: markerArg.processIdentity,
+      },
+      plugins.path.join(tempDirArg, toolCacheMarkerFile),
+      Math.max(leaseTimeoutMsArg, minimumTempLeaseTimeoutMs),
+    );
+  }
+
+  private markersMatch(
+    firstMarkerArg: IToolCacheMarker,
+    secondMarkerArg: IToolCacheMarker,
+  ): boolean {
+    return firstMarkerArg.owner === secondMarkerArg.owner
+      && firstMarkerArg.kind === secondMarkerArg.kind
+      && firstMarkerArg.createdAt === secondMarkerArg.createdAt
+      && firstMarkerArg.invocationId === secondMarkerArg.invocationId
+      && firstMarkerArg.processId === secondMarkerArg.processId
+      && firstMarkerArg.processIdentity === secondMarkerArg.processIdentity
+      && firstMarkerArg.leaseManaged === secondMarkerArg.leaseManaged
+      && firstMarkerArg.schemaVersion === secondMarkerArg.schemaVersion;
+  }
+
   private shouldKeepTemp(bundleConfigArg?: interfaces.IBundleConfig): boolean {
     return this.isTruthy(process.env.TSBUNDLE_KEEP_TEMP)
       || this.cliOptions.keepTemp === true
@@ -190,73 +284,184 @@ export class CustomBundleHandler {
   }
 
   private async prepareTempWorkspace(): Promise<ITempWorkspace> {
-    const tempDirArg = this.getTempDir();
-    this.assertExpectedTempDir(tempDirArg);
-    const marker = await this.readTempMarker(tempDirArg);
-    if (marker) {
-      return { tempDir: tempDirArg, canCleanupWorkspace: true, cleanupOnFailure: false };
-    }
+    return await this.createIsolatedTempWorkspace();
+  }
 
-    let entries: string[] = [];
+  private async createIsolatedTempWorkspace(): Promise<ITempWorkspace> {
+    const projectTempRoot = this.getProjectTempRoot();
+    await plugins.fsPromises.mkdir(projectTempRoot, { recursive: true });
+    const rootStat = plugins.fsSync.lstatSync(projectTempRoot);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+      throw new Error(`Refusing to use unsafe project temp root: ${projectTempRoot}`);
+    }
+    const expectedPhysicalRoot = plugins.path.join(plugins.fsSync.realpathSync(this.cwd), '.nogit');
+    if (plugins.fsSync.realpathSync(projectTempRoot) !== expectedPhysicalRoot) {
+      throw new Error(`Refusing to use project temp root outside the project: ${projectTempRoot}`);
+    }
+    const tempDir = await plugins.fsPromises.mkdtemp(
+      plugins.path.join(projectTempRoot, localTempPrefix),
+    );
     try {
-      entries = await plugins.fsPromises.readdir(tempDirArg);
-    } catch {
-      await plugins.fsPromises.mkdir(tempDirArg, { recursive: true });
+      const marker = await this.writeTempMarker(tempDir);
+      return {
+        tempDir,
+        canCleanupWorkspace: true,
+        cleanupOnFailure: true,
+        marker,
+      };
+    } catch (error: unknown) {
+      await plugins.fsPromises.rm(tempDir, { recursive: true, force: true });
+      throw error;
     }
+  }
 
-    if (entries.length > 0) {
-      const isolatedTempDir = await this.createIsolatedTempWorkspace();
-      console.log(`tsbundle: leaving existing unmarked temp workspace untouched: ${tempDirArg}`);
-      console.log(`tsbundle: using isolated marked temp workspace: ${isolatedTempDir}`);
-      return { tempDir: isolatedTempDir, canCleanupWorkspace: true, cleanupOnFailure: true };
+  private async clearTempBuildArtifacts(tempDirArg: string): Promise<void> {
+    this.assertManagedTempDir(tempDirArg);
+    const entries = await plugins.fsPromises.readdir(tempDirArg, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === toolCacheMarkerFile) {
+        continue;
+      }
+      await plugins.fsPromises.rm(plugins.path.join(tempDirArg, entry.name), {
+        recursive: true,
+        force: true,
+      });
     }
-
-    await this.writeTempMarker(tempDirArg);
-    return { tempDir: tempDirArg, canCleanupWorkspace: true, cleanupOnFailure: false };
   }
 
-  private async createIsolatedTempWorkspace(): Promise<string> {
-    const tempDir = await plugins.fsPromises.mkdtemp(plugins.path.join(plugins.os.tmpdir(), 'tsbundle-temp-'));
-    await this.writeTempMarker(tempDir);
-    return tempDir;
+  private async listBundleArtifacts(tempDirArg: string): Promise<string[]> {
+    const result: string[] = [];
+    const collect = async (directoryArg: string): Promise<void> => {
+      const entries = await plugins.fsPromises.readdir(directoryArg, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.name === toolCacheMarkerFile || entry.name === chunkManifestFile) {
+          continue;
+        }
+        const entryPath = plugins.path.join(directoryArg, entry.name);
+        if (entry.isDirectory()) {
+          await collect(entryPath);
+        } else if (entry.isFile()) {
+          result.push(entryPath);
+        }
+      }
+    };
+    await collect(tempDirArg);
+    return result.sort((a, b) => a.localeCompare(b));
   }
 
-  private async writeTempMarker(tempDirArg: string): Promise<void> {
+  private async writeTempMarker(
+    tempDirArg: string,
+    exclusive = false,
+  ): Promise<IToolCacheMarker> {
+    await plugins.fsPromises.mkdir(tempDirArg, { recursive: true });
     this.assertManagedTempDir(tempDirArg);
     const marker: IToolCacheMarker = {
       owner: toolCacheOwner,
       kind: tempCacheKind,
       safeToPrune: true,
       createdAt: new Date().toISOString(),
+      invocationId: this.invocationId,
+      ...createProcessOwnership(),
       schemaVersion: 1,
     };
-    await plugins.fsPromises.mkdir(tempDirArg, { recursive: true });
     await plugins.fsPromises.writeFile(
       plugins.path.join(tempDirArg, toolCacheMarkerFile),
       `${JSON.stringify(marker, null, 2)}\n`,
+      { flag: exclusive ? 'wx' : 'w', mode: 0o600 },
     );
+    return marker;
   }
 
   private async readTempMarker(tempDirArg: string): Promise<IToolCacheMarker | undefined> {
-    this.assertManagedTempDir(tempDirArg);
     try {
+      this.assertManagedTempDir(tempDirArg);
       const markerRaw = await plugins.fsPromises.readFile(plugins.path.join(tempDirArg, toolCacheMarkerFile), 'utf8');
-      const marker = JSON.parse(markerRaw) as Partial<IToolCacheMarker>;
+      let marker: Partial<IToolCacheMarker>;
+      try {
+        marker = JSON.parse(markerRaw) as Partial<IToolCacheMarker>;
+      } catch {
+        return undefined;
+      }
       if (
         marker.owner === toolCacheOwner &&
         marker.kind === tempCacheKind &&
-        marker.safeToPrune === true &&
-        marker.schemaVersion === 1
+          marker.safeToPrune === true &&
+          (marker.invocationId === undefined || (
+            typeof marker.invocationId === 'string'
+            && /^[A-Za-z0-9._-]{1,128}$/.test(marker.invocationId)
+          )) &&
+          (marker.processId === undefined || (
+            typeof marker.processId === 'number'
+            && Number.isSafeInteger(marker.processId)
+            && marker.processId > 0
+          )) &&
+          (marker.processIdentity === undefined || typeof marker.processIdentity === 'string') &&
+          (marker.leaseManaged === undefined || typeof marker.leaseManaged === 'boolean') &&
+          marker.schemaVersion === 1
       ) {
         return marker as IToolCacheMarker;
       }
-    } catch {
-      return undefined;
+    } catch (error: unknown) {
+      if (this.hasErrorCode(error) && error.code === 'ENOENT') {
+        return undefined;
+      }
+      throw error;
     }
 
     return undefined;
   }
 
+  private async cleanupStaleMarkedTempWorkspaces(
+    rootDirectoryArg: string,
+    thresholdMsArg: number,
+  ): Promise<boolean> {
+    let didCleanup = false;
+    let entries;
+    try {
+      entries = await plugins.fsPromises.readdir(rootDirectoryArg, { withFileTypes: true });
+    } catch (error: unknown) {
+      if (this.hasErrorCode(error) && error.code === 'ENOENT') {
+        return false;
+      }
+      throw error;
+    }
+    for (const entry of entries) {
+      if (
+        !entry.isDirectory()
+        || (!entry.name.startsWith(localTempPrefix) && !entry.name.startsWith(cleanupTempPrefix))
+      ) {
+        continue;
+      }
+      const tempDir = plugins.path.join(rootDirectoryArg, entry.name);
+      let marker: IToolCacheMarker | undefined;
+      try {
+        marker = await this.readTempMarker(tempDir);
+      } catch (error: unknown) {
+        if (this.hasErrorCode(error) && error.code === 'ENOENT') {
+          continue;
+        }
+        throw error;
+      }
+      if (!marker) {
+        continue;
+      }
+      const createdAt = Date.parse(marker.createdAt);
+      if (
+        !Number.isFinite(createdAt)
+        || Date.now() - createdAt < thresholdMsArg
+        || this.isTempMarkerActive(marker, tempDir, thresholdMsArg)
+      ) {
+        continue;
+      }
+      didCleanup = await this.cleanupTempWorkspace(
+        'stale isolated temp workspace',
+        tempDir,
+        marker,
+      ) || didCleanup;
+    }
+    return didCleanup;
+  }
+
   private async getDirectorySize(pathArg: string): Promise<number> {
     let total = 0;
     let entries;
@@ -294,15 +499,53 @@ export class CustomBundleHandler {
     return `${value.toFixed(decimals)} ${units[unitIndex]}`;
   }
 
-  private async cleanupTempWorkspace(reasonArg: string, tempDir = this.getTempDir()): Promise<void> {
-    this.assertManagedTempDir(tempDir);
+  private async cleanupTempWorkspace(
+    reasonArg: string,
+    tempDir = this.getTempDir(),
+    expectedMarkerArg?: IToolCacheMarker,
+  ): Promise<boolean> {
+    try {
+      this.assertManagedTempDir(tempDir);
+    } catch (error: unknown) {
+      if (this.hasErrorCode(error) && error.code === 'ENOENT') {
+        return false;
+      }
+      throw error;
+    }
     const marker = await this.readTempMarker(tempDir);
-    if (!marker) {
-      return;
+    if (!marker || (expectedMarkerArg && !this.markersMatch(marker, expectedMarkerArg))) {
+      return false;
     }
-    const reclaimedBytes = await this.getDirectorySize(tempDir);
-    await plugins.fsPromises.rm(tempDir, { recursive: true, force: true });
+    const quarantinePath = plugins.path.join(
+      plugins.path.dirname(tempDir),
+      `${cleanupTempPrefix}${this.invocationId}-${Math.random().toString(36).slice(2)}`,
+    );
+    try {
+      await plugins.fsPromises.rename(tempDir, quarantinePath);
+    } catch (error: unknown) {
+      if (this.hasErrorCode(error) && error.code === 'ENOENT') {
+        return false;
+      }
+      throw error;
+    }
+
+    const quarantinedMarker = await this.readTempMarker(quarantinePath);
+    if (!quarantinedMarker || !this.markersMatch(marker, quarantinedMarker)) {
+      try {
+        if (!plugins.fsSync.existsSync(tempDir)) {
+          await plugins.fsPromises.rename(quarantinePath, tempDir);
+        }
+      } catch (error: unknown) {
+        if (!this.hasErrorCode(error) || !['EEXIST', 'ENOENT'].includes(error.code || '')) {
+          throw error;
+        }
+      }
+      return false;
+    }
+    const reclaimedBytes = await this.getDirectorySize(quarantinePath);
+    await plugins.fsPromises.rm(quarantinePath, { recursive: true, force: true });
     console.log(`Cleaned tsbundle temp workspace after ${reasonArg}, reclaimed ${this.formatBytes(reclaimedBytes)}`);
+    return true;
   }
 
   /**
@@ -313,10 +556,12 @@ export class CustomBundleHandler {
     tempBundlePath: string
   ): Promise<void> {
     const base64Output = new Base64TsOutput(this.cwd);
-
-    // Add the bundle itself
-    const bundleContent = await plugins.fs.file(tempBundlePath).read();
-    base64Output.addFile('bundle.js', bundleContent);
+    const tempDir = plugins.path.dirname(tempBundlePath);
+    for (const artifactPath of await this.listBundleArtifacts(tempDir)) {
+      const relativePath = plugins.path.relative(tempDir, artifactPath);
+      const artifactContent = await plugins.fs.file(artifactPath).read();
+      base64Output.addFile(relativePath, artifactContent);
+    }
 
     // Add included files
     if (bundleConfig.includeFiles && bundleConfig.includeFiles.length > 0) {
@@ -330,7 +575,10 @@ export class CustomBundleHandler {
     }
 
     // Write the TypeScript output
-    await base64Output.writeToFile(bundleConfig.to, bundleConfig.maxLineLength);
+    const outputPath = plugins.smartpath.transform.toAbsolute(bundleConfig.to, this.cwd) as string;
+    await withArtifactPublicationLocks(outputPath, async () => {
+      await base64Output.writeToFile(bundleConfig.to, bundleConfig.maxLineLength);
+    });
   }
 
   /**
@@ -340,35 +588,42 @@ export class CustomBundleHandler {
     bundleConfig: interfaces.IBundleConfig,
     tempBundlePath: string
   ): Promise<void> {
-    // Move bundle to final destination
     const toPath = plugins.smartpath.transform.toAbsolute(bundleConfig.to, this.cwd) as string;
     const toDir = plugins.path.dirname(toPath);
-    await plugins.fs.directory(toDir).create();
-
-    const bundleContent = await plugins.fs.file(tempBundlePath).read();
-    await plugins.fs.file(toPath).write(bundleContent);
-    console.log(`Bundle written to: ${bundleConfig.to}`);
-
-    if (bundleConfig.sourcemap === false) {
-      await plugins.fsPromises.rm(`${toPath}.map`, { force: true });
-    }
-
-    // Process included files (copy them)
+    const tempDir = plugins.path.dirname(tempBundlePath);
+    const logicalOutputName = plugins.path.basename(toPath);
+    const additionalArtifacts: IAdditionalArtifact[] = [];
     if (bundleConfig.includeFiles && bundleConfig.includeFiles.length > 0) {
-      const htmlHandler = new HtmlHandler();
-      const outputDir = plugins.path.dirname(toPath);
-
       for (const entry of bundleConfig.includeFiles) {
         const pattern = typeof entry === 'string' ? entry : entry.from;
-        await this.copyIncludedFiles(pattern, outputDir);
+        additionalArtifacts.push(...await this.collectIncludedFiles(pattern, toDir));
       }
     }
+    await publishGeneratedArtifacts({
+      additionalArtifacts,
+      sourceDirectory: tempDir,
+      sourceMainPath: tempBundlePath,
+      targetPath: toPath,
+      lockTargetPath: plugins.path.join(toDir, '.tsbundle-output-directory'),
+      logicalOutputName,
+      chunkNamespace: getChunkNamespace(logicalOutputName),
+      sourceMapsEnabled: bundleConfig.sourcemap !== false,
+    });
+    console.log(`Bundle written to: ${bundleConfig.to}`);
+    for (const artifact of additionalArtifacts) {
+      const relativePath = plugins.path.relative(this.cwd, artifact.sourcePath);
+      console.log(`Copied: ${relativePath} -> ${artifact.targetPath}`);
+    }
   }
 
   /**
-   * Copy files matching a pattern to the output directory
+   * Resolve files matching a pattern for transactional publication.
    */
-  private async copyIncludedFiles(pattern: string, outputDir: string): Promise<void> {
+  private async collectIncludedFiles(
+    pattern: string,
+    outputDir: string,
+  ): Promise<IAdditionalArtifact[]> {
+    const artifacts: IAdditionalArtifact[] = [];
     const absolutePattern = plugins.smartpath.transform.toAbsolute(pattern, this.cwd) as string;
     const patternDir = plugins.path.dirname(absolutePattern);
     const patternBase = plugins.path.basename(absolutePattern);
@@ -379,7 +634,7 @@ export class CustomBundleHandler {
       const dirExists = await plugins.fs.directory(dirPath).exists();
       if (!dirExists) {
         console.log(`Directory does not exist: ${dirPath}`);
-        return;
+        return artifacts;
       }
 
       const isRecursive = pattern.includes('**');
@@ -397,24 +652,21 @@ export class CustomBundleHandler {
         if (!entry.isDirectory && regex.test(entry.name)) {
           // entry.path is already absolute from smartfs
           const fullPath = entry.path;
-          const relativePath = plugins.path.relative(this.cwd, fullPath);
           const destPath = plugins.path.join(outputDir, plugins.path.basename(entry.path));
-          await plugins.fs.directory(plugins.path.dirname(destPath)).create();
-          await plugins.fs.file(fullPath).copy(destPath);
-          console.log(`Copied: ${relativePath} -> ${destPath}`);
+          artifacts.push({ sourcePath: fullPath, targetPath: destPath });
         }
       }
     } else {
       const fileExists = await plugins.fs.file(absolutePattern).exists();
       if (!fileExists) {
         console.log(`File does not exist: ${absolutePattern}`);
-        return;
+        return artifacts;
       }
       const fileName = plugins.path.basename(absolutePattern);
       const destPath = plugins.path.join(outputDir, fileName);
-      await plugins.fs.file(absolutePattern).copy(destPath);
-      console.log(`Copied: ${pattern} -> ${destPath}`);
+      artifacts.push({ sourcePath: absolutePattern, targetPath: destPath });
     }
+    return artifacts;
   }
 }