@tangle-network/agent-profile-materialize 0.27.1 → 0.27.3

package/dist/prime-profile.js

@@ -80,6 +80,24 @@ export function readPrimeProfileControls(profile) {
     const controls = { skills: [], subagents: [] };
     if (!profile)
         return controls;
+    rejectUnboundPrimeControls(profile);
+    const instructionBlocks = [];
+    if (profile.prompt) {
+        readPrimePromptControls(profile.prompt, controls, instructionBlocks);
+    }
+    if (profile.resources) {
+        readPrimeResourceControls(profile.resources, controls, instructionBlocks);
+    }
+    if (instructionBlocks.length > 0) {
+        controls.instructions = instructionBlocks.join("\n\n");
+    }
+    if (profile.subagents) {
+        readPrimeSubagents(profile.subagents, controls);
+    }
+    return controls;
+}
+/** Refuse every profile control prime-agent has no verified read path for. */
+function rejectUnboundPrimeControls(profile) {
     if (profile.harness !== undefined && profile.harness !== "prime") {
         rejectPrimeDeclaration("harness", `prime cannot run a profile pinned to harness "${profile.harness}" — ` +
             'only "prime" (or an unset harness preference) is accepted.');
@@ -115,128 +133,123 @@ export function readPrimeProfileControls(profile) {
         rejectPrimeControl("confidential", "confidential execution is a property of the executor's isolation boundary, not " +
             "of the agent dir; this lowering cannot establish it.");
     }
-    const instructionBlocks = [];
-    if (profile.prompt) {
-        const { systemPrompt, appendSystemPrompt, instructions } = profile.prompt;
-        const knownPromptFields = new Set([
-            "systemPrompt",
-            "appendSystemPrompt",
-            "instructions",
-        ]);
-        const unknown = Object.entries(profile.prompt)
-            .filter(([key, value]) => !knownPromptFields.has(key) && value !== undefined)
-            .map(([key]) => key);
-        if (unknown.length > 0) {
-            rejectPrimeControl(`prompt fields: ${unknown.join(", ")}`, "no verified prime-agent read path exists for them.");
+}
+function readPrimePromptControls(prompt, controls, instructionBlocks) {
+    const { systemPrompt, appendSystemPrompt, instructions } = prompt;
+    const knownPromptFields = new Set([
+        "systemPrompt",
+        "appendSystemPrompt",
+        "instructions",
+    ]);
+    const unknown = Object.entries(prompt)
+        .filter(([key, value]) => !knownPromptFields.has(key) && value !== undefined)
+        .map(([key]) => key);
+    if (unknown.length > 0) {
+        rejectPrimeControl(`prompt fields: ${unknown.join(", ")}`, "no verified prime-agent read path exists for them.");
+    }
+    if (systemPrompt !== undefined) {
+        if (typeof systemPrompt !== "string" || systemPrompt.trim() === "") {
+            rejectPrimeDeclaration("prompt.systemPrompt", "an empty replacement would delete the built-in system prompt and " +
+                "install nothing.");
         }
-        if (systemPrompt !== undefined) {
-            if (typeof systemPrompt !== "string" || systemPrompt.trim() === "") {
-                rejectPrimeDeclaration("prompt.systemPrompt", "an empty replacement would delete the built-in system prompt and " +
-                    "install nothing.");
-            }
-            controls.systemPrompt = systemPrompt;
+        controls.systemPrompt = systemPrompt;
+    }
+    if (appendSystemPrompt !== undefined) {
+        if (typeof appendSystemPrompt !== "string" ||
+            appendSystemPrompt.trim() === "") {
+            rejectPrimeDeclaration("prompt.appendSystemPrompt", "must be non-empty text.");
         }
-        if (appendSystemPrompt !== undefined) {
-            if (typeof appendSystemPrompt !== "string" ||
-                appendSystemPrompt.trim() === "") {
-                rejectPrimeDeclaration("prompt.appendSystemPrompt", "must be non-empty text.");
-            }
-            controls.appendSystemPrompt = appendSystemPrompt;
+        controls.appendSystemPrompt = appendSystemPrompt;
+    }
+    for (const block of instructions ?? []) {
+        if (typeof block === "string" && block.trim() !== "")
+            instructionBlocks.push(block);
+    }
+}
+function readPrimeResourceControls(resources, controls, instructionBlocks) {
+    const { skills, instructions, failOnError, ...unsupported } = resources;
+    const rejectedKeys = Object.entries(unsupported)
+        .filter(([, value]) => value !== undefined)
+        .map(([key]) => key);
+    if (rejectedKeys.length > 0) {
+        rejectPrimeControl(`resources: ${rejectedKeys.join(", ")}`, "only resources.skills (--skill dirs, fork resource-loader.ts:437-442) and " +
+            "resources.instructions (agent-dir AGENTS.md, resource-loader.ts:86) have a " +
+            "verified prime-agent read path. Generic workspace files, tool files, " +
+            "subagent-definition files and prompt templates either have no headless read " +
+            "path or would run caller-authored code inside the agent process.");
+    }
+    if (failOnError === false) {
+        rejectPrimeControl("resources.failOnError: false", "this lowering always fails loud on a resource it cannot " +
+            "materialize; lenient materialization is not implemented.");
+    }
+    if (instructions !== undefined) {
+        const block = primeInstructionBlock(instructions, "resources.instructions");
+        if (block.trim() !== "")
+            instructionBlocks.push(block);
+    }
+    const seen = new Set();
+    for (const [index, ref] of (skills ?? []).entries()) {
+        if (ref.kind !== "inline") {
+            rejectPrimeControl(`resources.skills[${index}]`, "only inline skill refs are accepted — resolve GitHub-backed refs " +
+                "(resolveAgentProfileResources) before handing the profile to " +
+                "this lowering.");
         }
-        for (const block of instructions ?? []) {
-            if (typeof block === "string" && block.trim() !== "")
-                instructionBlocks.push(block);
+        const name = ref.name;
+        if (!PRIME_SKILL_NAME_RE.test(name) ||
+            name.length > PRIME_MAX_SKILL_NAME_LENGTH) {
+            rejectPrimeDeclaration(`resources.skills[${index}]`, `name ${JSON.stringify(name)} is not a valid prime skill name — it becomes the ` +
+                "skill directory name, so it must be lowercase a-z0-9 with single hyphens, at " +
+                `most ${PRIME_MAX_SKILL_NAME_LENGTH} chars (fork skills.ts:122-147).`);
         }
+        if (seen.has(name)) {
+            rejectPrimeDeclaration("resources.skills", `declares ${JSON.stringify(name)} twice; duplicate skill names collide in the ` +
+                "fork's skill registry, which keeps only the first and warns.");
+        }
+        seen.add(name);
+        if (ref.content.trim() === "") {
+            rejectPrimeDeclaration(`resources.skills[${index}]`, `skill ${JSON.stringify(name)} declares no content.`);
+        }
+        controls.skills.push({ name, content: ref.content });
     }
-    if (profile.resources) {
-        const { skills, instructions, failOnError, ...unsupported } = profile.resources;
-        const rejectedKeys = Object.entries(unsupported)
+}
+function readPrimeSubagents(subagents, controls) {
+    const usedIds = new Map();
+    for (const [name, spec] of Object.entries(subagents)) {
+        if (name.trim() === "") {
+            rejectPrimeDeclaration("subagents", "a subagent name must be non-empty.");
+        }
+        const inexpressible = [
+            ["model", spec.model],
+            ["tools", spec.tools],
+            ["permissions", spec.permissions],
+            ["maxSteps", spec.maxSteps],
+        ]
             .filter(([, value]) => value !== undefined)
             .map(([key]) => key);
-        if (rejectedKeys.length > 0) {
-            rejectPrimeControl(`resources: ${rejectedKeys.join(", ")}`, "only resources.skills (--skill dirs, fork resource-loader.ts:437-442) and " +
-                "resources.instructions (agent-dir AGENTS.md, resource-loader.ts:86) have a " +
-                "verified prime-agent read path. Generic workspace files, tool files, " +
-                "subagent-definition files and prompt templates either have no headless read " +
-                "path or would run caller-authored code inside the agent process.");
-        }
-        if (failOnError === false) {
-            rejectPrimeControl("resources.failOnError: false", "this lowering always fails loud on a resource it cannot " +
-                "materialize; lenient materialization is not implemented.");
+        if (inexpressible.length > 0) {
+            rejectPrimeControl(`subagents[${JSON.stringify(name)}] fields: ${inexpressible.join(", ")}`, "a prime continual-harness subagent spec is prompt-roster " +
+                "guidance for `await rlm('<task>')` (fork refinement.ts:483-496) " +
+                "and pins no model, tool set, permission, or step budget on the " +
+                "spawned child.");
         }
-        if (instructions !== undefined) {
-            const block = primeInstructionBlock(instructions, "resources.instructions");
-            if (block.trim() !== "")
-                instructionBlocks.push(block);
+        if (!spec.description?.trim() && !spec.prompt?.trim()) {
+            rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, "declares no behavior — a spec needs a description and/or prompt, since an " +
+                "empty entry gives the model an empty roster line.");
         }
-        const seen = new Set();
-        for (const [index, ref] of (skills ?? []).entries()) {
-            if (ref.kind !== "inline") {
-                rejectPrimeControl(`resources.skills[${index}]`, "only inline skill refs are accepted — resolve GitHub-backed refs " +
-                    "(resolveAgentProfileResources) before handing the profile to " +
-                    "this lowering.");
-            }
-            const name = ref.name;
-            if (!PRIME_SKILL_NAME_RE.test(name) ||
-                name.length > PRIME_MAX_SKILL_NAME_LENGTH) {
-                rejectPrimeDeclaration(`resources.skills[${index}]`, `name ${JSON.stringify(name)} is not a valid prime skill name — it becomes the ` +
-                    "skill directory name, so it must be lowercase a-z0-9 with single hyphens, at " +
-                    `most ${PRIME_MAX_SKILL_NAME_LENGTH} chars (fork skills.ts:122-147).`);
-            }
-            if (seen.has(name)) {
-                rejectPrimeDeclaration("resources.skills", `declares ${JSON.stringify(name)} twice; duplicate skill names collide in the ` +
-                    "fork's skill registry, which keeps only the first and warns.");
-            }
-            seen.add(name);
-            if (ref.content.trim() === "") {
-                rejectPrimeDeclaration(`resources.skills[${index}]`, `skill ${JSON.stringify(name)} declares no content.`);
-            }
-            controls.skills.push({ name, content: ref.content });
+        const id = primeSubagentEntryId(name);
+        const clash = usedIds.get(id);
+        if (clash !== undefined) {
+            rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, `collides with subagent ${JSON.stringify(clash)} on harness-state id ` +
+                `${JSON.stringify(id)}.`);
         }
+        usedIds.set(id, name);
+        controls.subagents.push({
+            name,
+            description: spec.description,
+            prompt: spec.prompt,
+            metadata: spec.metadata,
+        });
     }
-    if (instructionBlocks.length > 0) {
-        controls.instructions = instructionBlocks.join("\n\n");
-    }
-    if (profile.subagents) {
-        const usedIds = new Map();
-        for (const [name, spec] of Object.entries(profile.subagents)) {
-            if (name.trim() === "") {
-                rejectPrimeDeclaration("subagents", "a subagent name must be non-empty.");
-            }
-            const inexpressible = [
-                ["model", spec.model],
-                ["tools", spec.tools],
-                ["permissions", spec.permissions],
-                ["maxSteps", spec.maxSteps],
-            ]
-                .filter(([, value]) => value !== undefined)
-                .map(([key]) => key);
-            if (inexpressible.length > 0) {
-                rejectPrimeControl(`subagents[${JSON.stringify(name)}] fields: ${inexpressible.join(", ")}`, "a prime continual-harness subagent spec is prompt-roster " +
-                    "guidance for `await rlm('<task>')` (fork refinement.ts:483-496) " +
-                    "and pins no model, tool set, permission, or step budget on the " +
-                    "spawned child.");
-            }
-            if (!spec.description?.trim() && !spec.prompt?.trim()) {
-                rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, "declares no behavior — a spec needs a description and/or prompt, since an " +
-                    "empty entry gives the model an empty roster line.");
-            }
-            const id = primeSubagentEntryId(name);
-            const clash = usedIds.get(id);
-            if (clash !== undefined) {
-                rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, `collides with subagent ${JSON.stringify(clash)} on harness-state id ` +
-                    `${JSON.stringify(id)}.`);
-            }
-            usedIds.set(id, name);
-            controls.subagents.push({
-                name,
-                description: spec.description,
-                prompt: spec.prompt,
-                metadata: spec.metadata,
-            });
-        }
-    }
-    return controls;
 }
 /**
  * Refuse a run whose selected model disagrees with the profile's own.

package/dist/profile-bundle-lru.d.ts

@@ -5,7 +5,7 @@
  * is absent or corrupt, and every write to it is best-effort so a full or
  * read-only cache can never break admit, claim, or eviction.
  */
-export interface ProfileBundleLru {
+interface ProfileBundleLru {
     v: 1;
     objects: Record<string, {
         bytes: number;
@@ -53,3 +53,4 @@ export declare function evictUnlocked(root: string, maxBytes: number): Promise<v
  * never touched.
  */
 export declare function evictProfileBundles(root: string, maxBytes: number): Promise<void>;
+export {};

package/dist/secret-concurrent-revision.js

@@ -7,12 +7,8 @@ import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
 import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
 import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
 import { assertWorkspacePlanSupported } from "./plan-support.js";
-/**
- * Publish a resolved revision for exactly one native subprocess UID. The
- * executor-owned naming key hides low-entropy credential guesses from paths;
- * the resolved digest and manifest never leave this server-side result.
- */
-export async function prepareSecretConcurrentProfileRevision(input) {
+/** Refuse an executor that cannot isolate the revision, or a plan that claims its launch names. */
+function assertSecretRevisionLaunch(input) {
     if (process.platform !== "linux" ||
         process.getuid?.() !== 0 ||
         !Number.isSafeInteger(input.subprocessUid) ||
@@ -30,11 +26,17 @@ export async function prepareSecretConcurrentProfileRevision(input) {
             throw new Error(`Secret OpenCode reserves ${name} for its launch binding`);
         }
     }
+}
+/**
+ * The OpenCode plan the revision materializes: the trusted provider config
+ * merged in, and every public MCP header turned into a reference.
+ */
+function secretOpenCodePlan(sourcePlan, providerConfig, secretReferences) {
     // Workspace `reference/` files stay in this revision's read-only tree. The
     // sealed launch runs from that tree, so a cwd-relative `reference/` path
     // reads this revision's copy and nothing is written to the shared workspace.
-    let plan = prepareExplicitOpenCodePlan(input.plan);
-    if (input.providerConfig) {
+    let plan = prepareExplicitOpenCodePlan(sourcePlan);
+    if (providerConfig) {
         plan = {
             ...plan,
             files: plan.files.map((file) => file.relPath === "opencode.json" &&
@@ -44,13 +46,12 @@ export async function prepareSecretConcurrentProfileRevision(input) {
                     ...file,
                     content: JSON.stringify({
                         ...JSON.parse(file.content),
-                        provider: input.providerConfig,
+                        provider: providerConfig,
                     }),
                 }
                 : file),
         };
     }
-    const secretReferences = {};
     plan = referencePublicMcpHeaders(plan, secretReferences);
     if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
         throw new Error("Secret OpenCode reserves its native config directory");
@@ -64,6 +65,39 @@ export async function prepareSecretConcurrentProfileRevision(input) {
         plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
         throw new Error("Secret OpenCode refuses a profile secret in its launch environment or arguments");
     }
+    return plan;
+}
+/** Publish the staged revision read-only, or adopt an identical one already published. */
+function publishSecretRevision(prepared, directory, subprocessUid) {
+    const existing = lstatIfPresent(directory);
+    if (existing) {
+        assertPublishedSecretRevision(directory, prepared.manifest);
+        prepared.dispose();
+    }
+    else {
+        try {
+            makeSecretRevisionReadOnly(prepared.root, subprocessUid);
+            renameSync(prepared.root, directory);
+        }
+        catch (error) {
+            const raced = lstatIfPresent(directory);
+            if (!raced?.isDirectory() || raced.isSymbolicLink())
+                throw error;
+            assertPublishedSecretRevision(directory, prepared.manifest);
+            makeStageWritable(prepared.root);
+            prepared.dispose();
+        }
+    }
+}
+/**
+ * Publish a resolved revision for exactly one native subprocess UID. The
+ * executor-owned naming key hides low-entropy credential guesses from paths;
+ * the resolved digest and manifest never leave this server-side result.
+ */
+export async function prepareSecretConcurrentProfileRevision(input) {
+    assertSecretRevisionLaunch(input);
+    const secretReferences = {};
+    const plan = secretOpenCodePlan(input.plan, input.providerConfig, secretReferences);
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
     // File slots reference their secrets, so an unchanged profile with a rotated
@@ -104,25 +138,7 @@ export async function prepareSecretConcurrentProfileRevision(input) {
             .update(JSON.stringify(spawn))
             .digest("hex");
         writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
-        const existing = lstatIfPresent(directory);
-        if (existing) {
-            assertPublishedSecretRevision(directory, prepared.manifest);
-            prepared.dispose();
-        }
-        else {
-            try {
-                makeSecretRevisionReadOnly(prepared.root, input.subprocessUid);
-                renameSync(prepared.root, directory);
-            }
-            catch (error) {
-                const raced = lstatIfPresent(directory);
-                if (!raced?.isDirectory() || raced.isSymbolicLink())
-                    throw error;
-                assertPublishedSecretRevision(directory, prepared.manifest);
-                makeStageWritable(prepared.root);
-                prepared.dispose();
-            }
-        }
+        publishSecretRevision(prepared, directory, input.subprocessUid);
         return {
             directory,
             manifest: prepared.manifest,

package/dist/workspace-apply-publish.d.ts

@@ -0,0 +1,26 @@
+export type ExistingFilePolicy = "allow-identical" | "reject";
+export type WorkspaceOwnership = {
+    uid: number;
+    gid: number;
+} | undefined;
+export type ApplyFile = NormalizedPlanFile & {
+    rootDir: string;
+    absPath: string;
+};
+/** What one publication needs once the files to write are chosen. */
+export interface PublishContext {
+    rootFor: (root: NormalizedPlanFile["root"]) => string;
+    existingFiles: ExistingFilePolicy;
+    ownership: WorkspaceOwnership;
+    publicPlanDigest: string;
+    plannedContent: Map<string, string>;
+}
+export declare const fileIdentity: (file: NormalizedPlanFile) => string;
+export declare function holdsCurrentOwnership(absPath: string, ownership: WorkspaceOwnership): boolean;
+export declare function planWrites(filesToApply: ApplyFile[], context: PublishContext): ApplyFile[];
+export declare function publishWrites(writes: ApplyFile[], prepared: PreparedWorkspaceFile[], context: PublishContext): void;
+export declare function rollbackPublished(prepared: PreparedWorkspaceFile[], error: unknown): never;
+export declare function removeTemporaries(prepared: PreparedWorkspaceFile[], receipt: WorkspacePlanReceipt): void;
+import type { NormalizedPlanFile } from "./plan-normalize.js";
+import type { WorkspacePlanReceipt } from "./plan-types.js";
+import { type PreparedWorkspaceFile } from "./workspace-apply-files.js";

package/dist/workspace-apply-publish.js

@@ -0,0 +1,178 @@
+export const fileIdentity = (file) => `${file.root}\0${file.relPath}`;
+export function holdsCurrentOwnership(absPath, ownership) {
+    return (ownership === undefined || workspaceFileHasOwnership(absPath, ownership));
+}
+/** Only materializer-owned files are held to the writer's ownership. */
+function ownershipCurrent(file, ownership) {
+    return (file.ownership !== "materializer" ||
+        holdsCurrentOwnership(file.absPath, ownership));
+}
+// An owned path holds this package's own earlier output, so re-applying
+// into the same workspace replaces it rather than failing the turn — once
+// the bytes already there prove that provenance. The replacement keeps what
+// an agent appended below a generated context file (its memory), so it can
+// differ from the planned bytes. `reject` still refuses: that policy is
+// "nothing may pre-exist here", which is a statement about the workspace,
+// not authorship.
+function replacementContent(file, context) {
+    const planned = context.plannedContent.get(fileIdentity(file));
+    if (context.existingFiles !== "allow-identical" ||
+        file.ownership !== "materializer" ||
+        planned === undefined) {
+        return undefined;
+    }
+    return materializerReplacement(file.relPath, () => regularFileContent(file.absPath), planned);
+}
+// Validate the complete plan before the first write so a late traversal or
+// existing symlink cannot leave a partially materialized workspace.
+export function planWrites(filesToApply, context) {
+    const writes = [];
+    for (const file of filesToApply) {
+        assertNoSymlinkPathComponents(file.rootDir, file.absPath);
+        if (!workspaceFileExists(file.absPath)) {
+            writes.push(file);
+            continue;
+        }
+        const content = replacementContent(file, context);
+        if (content !== undefined) {
+            writes.push({ ...file, content });
+            continue;
+        }
+        if (context.existingFiles === "reject" || !workspaceFileMatches(file)) {
+            throw new Error(workspaceFileConflictMessage(file, context.existingFiles, context.publicPlanDigest));
+        }
+        writes.push(file);
+    }
+    return writes;
+}
+// rename() replaces in one step, so no window exists in which the path is
+// missing and a concurrent spawn reads nothing. The staged inode moves onto the
+// path, which is what rollback identifies the file by, so an abort still
+// removes exactly what this call published — leaving the path ABSENT rather
+// than restored to the superseded bytes. That is the fail-closed direction: the
+// harness whose flag names a missing file refuses to start, whereas silently
+// restored previous-turn bytes would run the wrong prompt. A replaced file that
+// holds an agent's appended text is the exception: it is linked aside first and
+// restored, because removing it would delete the agent's own text.
+function replacePublishedFile(entry, context) {
+    assertNoSymlinkPathComponents(context.rootFor(entry.file.root), entry.file.absPath);
+    if (entry.file.content !== context.plannedContent.get(fileIdentity(entry.file))) {
+        const superseded = join(dirname(entry.file.absPath), `.agent-profile-${randomUUID()}.superseded`);
+        linkSync(entry.file.absPath, superseded);
+        entry.superseded = superseded;
+    }
+    renameSync(entry.temporaryPath, entry.file.absPath);
+    entry.published = true;
+}
+function publishPreparedFile(entry, context) {
+    assertNoSymlinkPathComponents(context.rootFor(entry.file.root), entry.file.absPath);
+    try {
+        linkSync(entry.temporaryPath, entry.file.absPath);
+        entry.published = true;
+    }
+    catch (error) {
+        if (isFsError(error, "EEXIST") &&
+            context.existingFiles === "allow-identical" &&
+            workspaceFileMatches(entry.file) &&
+            ownershipCurrent(entry.file, context.ownership)) {
+            return;
+        }
+        if (isFsError(error, "EEXIST") &&
+            replacementContent(entry.file, context) === entry.file.content) {
+            // The replacement is recomposed from the bytes there now, so an
+            // agent append that landed since validation refuses below instead
+            // of being overwritten; one landing between that read and the
+            // rename is not detected.
+            replacePublishedFile(entry, context);
+            return;
+        }
+        if (isFsError(error, "EEXIST")) {
+            throw new Error(workspaceFileConflictMessage(entry.file, context.existingFiles, context.publicPlanDigest), { cause: error });
+        }
+        throw error;
+    }
+}
+// Prepared temp links stay alive through publication and rollback. Their
+// inodes distinguish files created here from concurrent replacements.
+export function publishWrites(writes, prepared, context) {
+    for (const file of writes) {
+        if (context.existingFiles === "allow-identical" &&
+            workspaceFileExists(file.absPath) &&
+            workspaceFileMatches(file) &&
+            ownershipCurrent(file, context.ownership)) {
+            continue;
+        }
+        prepared.push(prepareWorkspaceFile(file.rootDir, file, context.ownership));
+    }
+    for (const entry of prepared)
+        publishPreparedFile(entry, context);
+}
+export function rollbackPublished(prepared, 
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- rollback rethrows the caught failure unchanged; an exception has no schema to parse at a boundary.
+error) {
+    const cleanupErrors = [];
+    for (const entry of [...prepared].reverse()) {
+        try {
+            if (entry.published &&
+                workspacePathHasIdentity(entry.file.absPath, entry.identity)) {
+                if (entry.superseded) {
+                    renameSync(entry.superseded, entry.file.absPath);
+                }
+                else {
+                    unlinkSync(entry.file.absPath);
+                }
+            }
+        }
+        catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+        }
+        try {
+            if (entry.superseded)
+                unlinkSync(entry.superseded);
+        }
+        catch (cleanupError) {
+            if (!isFsError(cleanupError, "ENOENT"))
+                cleanupErrors.push(cleanupError);
+        }
+        try {
+            if (workspacePathHasIdentity(entry.temporaryPath, entry.identity)) {
+                unlinkSync(entry.temporaryPath);
+            }
+        }
+        catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+        }
+    }
+    if (cleanupErrors.length > 0) {
+        throw new AggregateError([error, ...cleanupErrors], "Failed to apply workspace plan and roll back published files");
+    }
+    throw error;
+}
+export function removeTemporaries(prepared, receipt) {
+    const cleanupErrors = [];
+    const temporaryPaths = [];
+    for (const entry of prepared) {
+        for (const path of [entry.temporaryPath, entry.superseded]) {
+            if (path === undefined)
+                continue;
+            try {
+                unlinkSync(path);
+            }
+            catch (error) {
+                if (!isFsError(error, "ENOENT")) {
+                    cleanupErrors.push(error);
+                    temporaryPaths.push(path);
+                }
+            }
+        }
+    }
+    if (cleanupErrors.length > 0) {
+        throw new WorkspacePlanCleanupError(cleanupErrors, receipt, temporaryPaths);
+    }
+}
+import { randomUUID } from "node:crypto";
+import { linkSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { materializerReplacement } from "./harness.js";
+import { WorkspacePlanCleanupError } from "./plan-types.js";
+import { assertNoSymlinkPathComponents, isFsError, prepareWorkspaceFile, regularFileContent, workspaceFileConflictMessage, workspaceFileExists, workspaceFileHasOwnership, workspaceFileMatches, workspacePathHasIdentity, } from "./workspace-apply-files.js";