animader-cli 0.0.0-stage → 0.1.1

package/adapters/export-node.mjs

@@ -0,0 +1,603 @@
+// The Node adapter for the release export. It owns every actual byte and
+// process: the fresh native bake in a throwaway project copy, the real
+// vendored PieceHost derivation, the real pngine reflection parser, the real
+// `pacer pack` CLI over that reflection join, the playable-by-this-host
+// audit and the pinned owner esbuild bundle. `lib/export.mjs` owns the
+// portable layout, manifest, size report and staged-write decisions; the
+// bake/derive/reflect/pack/audit sequence itself is the shared pipeline in
+// `lib/pipeline.mjs`, the same stages `animader build` and dev's preflight
+// run over this export's own input snapshot.
+
+import { execFile } from 'node:child_process';
+import { promises as fsp } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { promisify } from 'node:util';
+import { brotliCompressSync, constants as zlibConstants, gzipSync } from 'node:zlib';
+
+import { createNodeIo, hashBytes, hashFile, removeTree } from './node-fs.mjs';
+import { createPngineNative } from './pngine.mjs';
+import { listSnapshotInputFiles, snapshotProject } from './snapshot.mjs';
+import { assertProjectSnapshotsMatch, buildProject } from '../lib/pipeline.mjs';
+import {
+  BAKED_PAYLOAD,
+  BUILD_RECEIPT,
+  GENERATED_DIR,
+  PACKED_SCORE,
+  inspectProject,
+} from '../lib/contract.mjs';
+import { DemoError, buildError, projectError } from '../lib/errors.mjs';
+import { releasePlayerConfig, selectedSoundtrack } from '../lib/export.mjs';
+import { resolveRoots } from '../toolchain/prepare.mjs';
+import { contributorToolchain } from '../src/toolchain.mjs';
+
+// The input snapshot moved to its own adapter so the export, `animader
+// build` and dev's preflight share one filter and one hashing walk; the
+// historical export-node import paths keep working.
+export { snapshotProject, snapshotFilter, listSnapshotInputFiles } from './snapshot.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG = resolve(HERE, '..');
+const REPO = resolve(PKG, '..', '..');
+const PLAYER = join(PKG, 'player');
+const INDEX = join(PLAYER, 'index.html');
+const CSS = join(PLAYER, 'player.css');
+const RELEASE_ENTRY = join(PLAYER, 'release.mjs');
+const LICENSE = join(REPO, 'LICENSE');
+const execFileAsync = promisify(execFile);
+
+export function createExportIo() {
+  return {
+    async inspect(path) {
+      try {
+        const info = await fsp.lstat(path);
+        return {
+          kind: info.isSymbolicLink() ? 'symlink' : info.isDirectory() ? 'dir' : info.isFile() ? 'file' : 'other',
+          size: info.size,
+        };
+      } catch (error) {
+        if (error.code === 'ENOENT') return null;
+        throw error;
+      }
+    },
+    remove: (path) => fsp.rm(path, { recursive: true, force: true }),
+    ensureDir: (path) => fsp.mkdir(path, { recursive: true }),
+    writeFile: (path, bytes) => fsp.writeFile(path, bytes),
+    rename: (from, to) => fsp.rename(from, to),
+    hashBytes,
+  };
+}
+
+export function measureBytes(bytes) {
+  return {
+    gzip9: gzipSync(bytes, { level: 9 }).byteLength,
+    brotli11: brotliCompressSync(bytes, {
+      params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 11 },
+    }).byteLength,
+  };
+}
+
+/** The real CLI binary the contributor export is pinned to (the pacer checkout's zig-out). */
+export function resolvePacerCli(roots = resolveRoots()) {
+  return join(roots.pacerRoot, 'zig-out', 'bin', 'pacer');
+}
+
+/**
+ * The reflection dump pacer's `--targets-json` adapter reads, written from
+ * the table's own insertion order. Only the two keys the adapter consumes
+ * ride the file; size/offset are host parser details, not join inputs.
+ */
+export function reflectionJson(reflection) {
+  const rows = [];
+  for (const [name, field] of Object.entries(reflection ?? {})) {
+    rows.push(`${JSON.stringify(name)}:${JSON.stringify({
+      type: field?.type,
+      elemCount: field?.elemCount ?? 0,
+    })}`);
+  }
+  return `{${rows.join(',')}}\n`;
+}
+
+/**
+ * Run the real `pacer pack` over the exact derived score and the reflection's
+ * own target list. The CLI owns compilation, the pack preflight and the
+ * 'PACB' encoding; the export never repairs a score or invents a target. The
+ * temporary score and reflection are removed on success and failure. The
+ * answer carries the CLI's own tool identity (name and binary digest) for
+ * the build receipt's toolchain row.
+ *
+ * @param {{scoreText: string, reflection: object, outPath: string, workDir: string, pacerCli?: string}} options
+ */
+export async function packScore({
+  scoreText,
+  reflection,
+  outPath,
+  workDir,
+  pacerCli = resolvePacerCli(),
+}) {
+  const scorePath = join(workDir, 'score.sjon');
+  const targetsPath = join(workDir, 'targets.json');
+  await fsp.mkdir(dirname(outPath), { recursive: true });
+  await fsp.writeFile(scorePath, Buffer.from(scoreText, 'utf8'));
+  await fsp.writeFile(targetsPath, reflectionJson(reflection));
+
+  const args = ['pack', scorePath, '--out', outPath, '--targets-json', targetsPath];
+  try {
+    let run;
+    try {
+      run = await execFileAsync(pacerCli, args, {
+        cwd: dirname(pacerCli),
+        encoding: 'utf8',
+        maxBuffer: 8 * 1024 * 1024,
+      });
+    } catch (cause) {
+      if (cause?.code === 'ENOENT') {
+        throw new DemoError(
+          'pack_tool_missing',
+          `the real pacer CLI is missing at ${pacerCli}; the export does not fall back to a text compiler`,
+          {
+            exitCode: 4,
+            stage: 'pack',
+            remedy: 'Build it at the pinned pacer checkout: cd $ANIMADER_PACER && zig build cli',
+            cause,
+          },
+        );
+      }
+      const stderr = String(cause?.stderr ?? '').trim();
+      const detail = stderr || String(cause?.stdout ?? '').trim() || String(cause?.message ?? cause);
+      throw new DemoError(
+        'pack_failed',
+        `the real pacer pack refused the derived score (exit ${cause?.code ?? 'unknown'}): ${detail}`,
+        {
+          exitCode: 4,
+          stage: 'pack',
+          remedy: 'Inspect the CLI diagnostics; the export never edits or repairs a derived score.',
+          cause,
+        },
+      );
+    }
+
+    let bytes;
+    try {
+      bytes = await fsp.readFile(outPath);
+    } catch (cause) {
+      throw new DemoError('pack_failed', `pacer pack exited 0 but wrote no score at ${outPath}`, {
+        exitCode: 4,
+        stage: 'pack',
+        remedy: 'Inspect the recorded CLI report; a successful pack must land a PACB file.',
+        cause,
+      });
+    }
+    if (bytes.byteLength < 4 || bytes.subarray(0, 4).toString('latin1') !== 'PACB') {
+      throw new DemoError('pack_failed', `pacer pack wrote no 'PACB' container at ${outPath}`, {
+        exitCode: 4,
+        stage: 'pack',
+        remedy: 'Inspect the pinned CLI; the export only ships the runtime container.',
+      });
+    }
+
+    let report = null;
+    try {
+      report = JSON.parse(run.stdout);
+    } catch {
+      // The exit code and container are the contract; stdout is a report.
+    }
+    return {
+      bytes,
+      stdout: run.stdout,
+      stderr: run.stderr,
+      args,
+      pacerCli,
+      report,
+      tool: { name: 'pacer', sha256: await hashFile(pacerCli) },
+    };
+  } finally {
+    await fsp.rm(scorePath, { force: true });
+    await fsp.rm(targetsPath, { force: true });
+    await fsp.rm(`${outPath}.tmp`, { force: true });
+  }
+}
+
+/**
+ * Parse one baked payload with pngine's own public bytecode and uniform-table
+ * readers, then spell the WGSL type names with the same helper the existing
+ * integration test uses. This is a build-time parser, never shipped.
+ *
+ * The readers resolve through the toolchain descriptor: the vendored viewer
+ * plus the pngine checkout's own core/helper in contributor mode, the
+ * installed packages' exports otherwise (the helper itself is the packaged
+ * artifact the plan names, because pngine does not export it).
+ *
+ * @param {{payloadBytes: Uint8Array, toolchain?: object, vendorRoot?: string, pngineRoot?: string}} options
+ */
+export async function reflectionOfPayload({ payloadBytes, toolchain = null, vendorRoot, pngineRoot }) {
+  const chain = toolchain ?? contributorToolchain({
+    vendorRoot,
+    roots: pngineRoot !== undefined ? { pngineRoot } : undefined,
+  });
+  const { extractBytecode } = await import(pathToFileURL(chain.pngine.viewer).href);
+  const { parseUniformTable } = await import(pathToFileURL(chain.pngine.core).href);
+  const { uniformTypeName } = await import(pathToFileURL(chain.pngine.uniformTypeName).href);
+  const bytecode = await extractBytecode(new Uint8Array(payloadBytes));
+  const table = parseUniformTable(bytecode);
+  const fields = {};
+  for (const [name, info] of table.uniforms) {
+    fields[name] = {
+      type: uniformTypeName(info.type),
+      elemCount: info.elemCount,
+      size: info.size,
+      offset: info.offset,
+    };
+  }
+  return fields;
+}
+
+
+/** The release HTML is the dev DOM with exactly the two references relative. */
+export async function releaseIndexHtml() {
+  const source = await fsp.readFile(INDEX, 'utf8');
+  const css = '<link rel="stylesheet" href="/player/player.css">';
+  const script = '<script type="module" src="/player/page.mjs"></script>';
+  if (!source.includes(css) || !source.includes(script)) {
+    throw new DemoError('index_template_changed', 'the dev index no longer carries the two references the release rewrite owns', {
+      exitCode: 4,
+      remedy: 'Inspect demo/player/index.html; the release must keep the same DOM and only rewrite its stylesheet and entry references.',
+    });
+  }
+  return Buffer.from(source.replace(css, '<link rel="stylesheet" href="./player.css">')
+    .replace(script, '<script type="module" src="./app.mjs"></script>'));
+}
+
+/**
+ * Bundle the release entry with the toolchain's pinned esbuild: the pngine
+ * owner's install in contributor mode, the CLI's own dependency in an
+ * installed package tree. No install, no new dependency, no source map,
+ * one ESM file.
+ *
+ * The entry's third-party imports are bare specifiers ('pngine/viewer',
+ * '@mr_hugo/pacer/rt', '@mr_hugo/pacer/route'); esbuild resolves them through `alias`
+ * against the toolchain's runtime files, so the entry itself never carries
+ * a path out of the package.
+ */
+export function bundleRelease({ toolchain = null, roots, vendorRoot, entry = RELEASE_ENTRY } = {}) {
+  const chain = toolchain ?? contributorToolchain({
+    vendorRoot: vendorRoot ?? join(REPO, 'demo', 'vendor'),
+    roots,
+  });
+  const esbuild = chain.esbuild.require();
+
+  const runtimeModules = {
+    'pngine/viewer': chain.runtime.path('pngine.mjs'),
+    '@mr_hugo/pacer/rt': chain.runtime.path('pacer/rt.js'),
+    '@mr_hugo/pacer/route': chain.runtime.path('pacer/route.js'),
+  };
+
+  let result;
+  try {
+    result = esbuild.buildSync({
+      entryPoints: [entry],
+      outfile: join(PKG, '.tmp', 'release-app.mjs'),
+      bundle: true,
+      alias: runtimeModules,
+      write: false,
+      format: 'esm',
+      platform: 'browser',
+      target: 'es2022',
+      minify: true,
+      sourcemap: false,
+      legalComments: 'eof',
+      charset: 'utf8',
+      metafile: true,
+      logLevel: 'silent',
+      absWorkingDir: PKG,
+    });
+  } catch (cause) {
+    const details = (cause?.errors ?? []).map((error) => error.text ?? error.message).join('; ');
+    throw new DemoError('bundle_failed', `esbuild could not bundle the release entry: ${details || cause?.message || cause}`, {
+      exitCode: 4,
+      remedy: 'Fix the release entry/import graph; the export never renames an unminified mirror as production.',
+      cause,
+    });
+  }
+
+  const files = result.outputFiles ?? [];
+  const app = files.filter((file) => file.path.endsWith('.mjs'));
+  if (app.length !== 1) {
+    throw new DemoError('bundle_shape', `esbuild answered ${app.length} ESM outputs; the release needs exactly one app.mjs`, {
+      exitCode: 4,
+      remedy: 'Remove dynamic imports from the release entry or make them static so the bundle stays one file.',
+    });
+  }
+  const bytes = Buffer.from(app[0].contents);
+  const text = bytes.toString('utf8');
+  const inputs = Object.keys(result.metafile?.inputs ?? {})
+    .map((path) => path.split('\\').join('/'))
+    .sort();
+
+  // The compiler/authoring vocabulary. esbuild minifies identifiers, so this
+  // is a token audit over the actual text plus the module paths below; it is
+  // not a proof against an obfuscated dynamic reach. The module-path audit is
+  // the stronger half: the compile driver entry and every animader authoring
+  // module must be absent from the bundle's own import graph.
+  const authoringTokens = [
+    'PieceHost',
+    'animader.wasm',
+    'animader/piece.js',
+    'piece.js',
+    'devProfile',
+    '/project/',
+    '/runtime/',
+    '/app/lib/',
+    '/examples/hello/',
+    'loadDerivedShow',
+    'Pacer.load',
+    'score.sjon',
+    'pacer.wasm',
+    'vendor/pacer/index.js',
+  ];
+  for (const banned of authoringTokens) {
+    if (text.includes(banned)) {
+      throw new DemoError('release_authoring_leak', `the release bundle retains authoring/compiler token ${banned}`, {
+        exitCode: 4,
+        stage: 'bundle',
+        remedy: 'Remove the import that reaches the dev/compiler graph; release output must not include the compile driver or its source score.',
+      });
+    }
+  }
+
+  // The authoring/compiler module audit is toolchain-relative: the banned
+  // compile driver and the required playback runtime have one path each in
+  // the toolchain descriptor (the vendored bundle in contributor mode, the
+  // installed packages otherwise), so the audit names the exact module
+  // instead of guessing a directory layout.
+  const playbackRuntime = chain.runtime.path('pacer/rt.js');
+  const compileDriver = chain.pacer.index;
+  const inputPaths = inputs.map((path) => resolve(PKG, path));
+  if (inputPaths.includes(resolve(compileDriver)) || inputs.includes('vendor/pacer/index.js')) {
+    throw new DemoError('release_authoring_leak', 'the release bundle imports the pacer compile driver', {
+      exitCode: 4,
+      stage: 'bundle',
+      remedy: 'Import the playback runtime (pacer/rt) and the static release entry only; the compiler closure must not be reachable.',
+    });
+  }
+  for (const banned of ['vendor/animader/', 'player/page.mjs']) {
+    const hit = inputs.find((path) => path.includes(banned));
+    if (hit) {
+      throw new DemoError('release_authoring_leak', `the release bundle imports the compiler/authoring module ${hit}`, {
+        exitCode: 4,
+        stage: 'bundle',
+        remedy: 'Import the playback runtime (pacer/rt) and the static release entry only; the compiler closure must not be reachable.',
+      });
+    }
+  }
+
+  if (!text.includes('restartSettled')) {
+    throw new DemoError('release_bundle_stale', 'the release bundle does not carry the owner restartSettled verb', {
+      exitCode: 4,
+      stage: 'bundle',
+      remedy: 'Re-vendor pngine with node demo/prepare.mjs from the current owner build.',
+    });
+  }
+  if (entry === RELEASE_ENTRY && !inputPaths.includes(resolve(playbackRuntime))) {
+    throw new DemoError('release_bundle_stale', 'the release bundle does not import the playback-only pacer runtime', {
+      exitCode: 4,
+      stage: 'bundle',
+      remedy: 'The release entry must import the toolchain playback runtime (pacer/rt), never the compile driver.',
+    });
+  }
+  return { bytes, esbuildVersion: esbuild.version, text, inputs };
+}
+
+function licenses({ pngineVersion, pacerVersion, licenseText }) {
+  return [
+    'Animader Meridian standalone release',
+    '',
+    'This export contains:',
+    `- pngine ${pngineVersion} viewer (CC0-1.0)`,
+    `- pacer ${pacerVersion} runtime JS and pacer-rt.wasm (CC0-1.0)`,
+    '- the Animader demo/player core and this authored content (CC0-1.0)',
+    '',
+    'The bundled music is the project soundtrack, kept byte-identical; it is not',
+    'a new licensed recording produced by this export.',
+    '',
+    'The full CC0 1.0 Universal text follows.',
+    '',
+    licenseText,
+  ].join('\n');
+}
+
+/**
+ * Refuse export output or staging paths that alias the authored project.
+ * Resolution walks to each target's nearest existing ancestor and reads it
+ * through `realpath`, so symlinked paths are judged by where they actually
+ * land. Refused: the target is the project folder itself, the project
+ * folder lives inside the target, or the target resolves inside an authored
+ * folder of the project (the nearest existing ancestor below the project
+ * root is deeper than the root — `kernels/…`, for example). A fresh
+ * `dist` directly beside the authored files stays allowed.
+ *
+ * @param {Object} options
+ * @param {string} options.folder the real project folder
+ * @param {{outDir: string, stageDir: string}} options.paths
+ */
+export async function assertSafeExportPaths({ folder, paths }) {
+  const projectReal = await fsp.realpath(folder);
+  for (const label of ['outDir', 'stageDir']) {
+    const target = resolve(paths[label]);
+    let probe = target;
+    let rest = '';
+    for (;;) {
+      let exists = true;
+      try {
+        await fsp.stat(probe);
+      } catch (error) {
+        if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error;
+        exists = false;
+      }
+      if (exists) break;
+      const parent = dirname(probe);
+      if (parent === probe) break;
+      rest = rest === '' ? basename(probe) : `${basename(probe)}/${rest}`;
+      probe = parent;
+    }
+    const anchorReal = await fsp.realpath(probe);
+    const targetReal = rest === '' ? anchorReal : `${anchorReal}/${rest}`;
+    const refused = (detail, remedy) => projectError(
+      'output_aliases_input',
+      `the export ${label} aliases the authored project: ${paths[label]} ${detail}`.trim(),
+      remedy,
+    );
+    if (targetReal === projectReal) {
+      throw refused(
+        'is the project folder itself',
+        'Choose a fresh output folder; the project folder itself is never an export target.',
+      );
+    }
+    if (projectReal.startsWith(`${targetReal}/`)) {
+      throw refused(
+        'contains the project folder',
+        'Choose a fresh output folder that does not contain the project; publishing it would replace the project.',
+      );
+    }
+    if (targetReal.startsWith(`${projectReal}/`)) {
+      // The target itself exists: it is an in-project path, and the honest
+      // refusal is the staged-write rule's own output_exists /
+      // staging_exists, not an aliasing claim. Aliasing is about a fresh
+      // path whose nearest existing ancestor is an authored folder.
+      const anchorRel = relative(projectReal, anchorReal);
+      if (rest !== '' && anchorRel !== '' && anchorRel !== '..') {
+        throw refused(
+          `resolves inside the authored ${anchorRel}/ folder`,
+          `Choose a fresh output folder directly beside the authored files (for example --out dist), not inside ${anchorRel}/.`,
+        );
+      }
+    }
+  }
+}
+
+/**
+ * Produce the exact minimal release file set from the actual project. Every
+ * byte comes from a real producer; the source project is never modified.
+ * The bake, derivation, reflection, pack and the playable-by-this-host
+ * audit are the shared pipeline (`lib/pipeline.mjs`) over this export's own
+ * input snapshot — the same stages `animader build` and dev's preflight
+ * run — and the audit runs BEFORE the player bundle, so a packed score this
+ * host cannot play never reaches a release. The producers (and, for tests,
+ * the native adapter) are injected.
+ */
+export async function prepareRelease({
+  project,
+  seconds,
+  paths,
+  toolchain = null,
+  roots,
+  vendorRoot,
+  workRoot,
+  producers,
+  native,
+}) {
+  const chain = toolchain ?? contributorToolchain({
+    roots: roots ?? resolveRoots(),
+    vendorRoot: vendorRoot ?? join(REPO, 'demo', 'vendor'),
+  });
+  const io = createNodeIo();
+  const nativeAdapter = native ?? createPngineNative({ binary: chain.pngine.cli });
+  const { work, workProject } = await snapshotProject({ project, paths, workRoot });
+  try {
+    // The snapshot filter already excludes the generated directory; this
+    // removes any stale copy in the owned work folder defensively.
+    await fsp.rm(join(workProject, GENERATED_DIR), { recursive: true, force: true });
+
+    const copied = await inspectProject({ folder: workProject, io });
+    await assertProjectSnapshotsMatch({ original: project, copied, what: 'export' });
+
+    const runtime = await chain.verifyRuntime();
+    const built = await buildProject({
+      project: copied,
+      seconds,
+      paths: {
+        folder: workProject,
+        outDir: join(workProject, GENERATED_DIR),
+        payload: join(workProject, GENERATED_DIR, BAKED_PAYLOAD),
+        score: join(paths.stageDir, 'assets', PACKED_SCORE),
+        receipt: join(workProject, GENERATED_DIR, BUILD_RECEIPT),
+        workDir: work,
+        projectName: project.folder.split('/').at(-1) || 'project',
+        payloadRelative: `${GENERATED_DIR}/${BAKED_PAYLOAD}`,
+        scoreRelative: `assets/${PACKED_SCORE}`,
+        receiptRelative: `${GENERATED_DIR}/${BUILD_RECEIPT}`,
+      },
+      io,
+      runtime: { verify: async () => runtime },
+      native: nativeAdapter,
+      hashBytes,
+      inputFiles: await listSnapshotInputFiles({ workProject, paths }),
+      producers,
+    });
+
+    const payloadBytes = await fsp.readFile(join(workProject, GENERATED_DIR, BAKED_PAYLOAD));
+    if (hashBytes(payloadBytes) !== built.receipt.outputs.payload.sha256) {
+      throw buildError('export_payload_drift', 'the fresh bake does not match its own receipt', 'Re-run the native preflight and inspect pngine.');
+    }
+
+    const pacerRtWasm = await fsp.readFile(chain.runtime.path('pacer/pacer-rt.wasm'));
+
+    const bundled = bundleRelease({ toolchain: chain });
+    const indexHtml = await releaseIndexHtml();
+    const css = await fsp.readFile(CSS);
+    const audioName = selectedSoundtrack(project);
+    const soundtrack = await fsp.readFile(join(project.folder, audioName));
+    const soundtrackDigest = hashBytes(soundtrack);
+    if (soundtrackDigest !== project.files.soundtrack.sha256 || project.files.soundtrack.bytes !== soundtrack.byteLength) {
+      throw buildError('export_soundtrack_drift', `${audioName} changed while the export was preparing`, 'Re-run the export from a quiet project folder.');
+    }
+
+    const pngineVersion = await chain.producerVersion('pngine');
+    const pacerVersion = await chain.producerVersion('pacer');
+    const licenseText = await chain.licenseText();
+    const files = {
+      'index.html': indexHtml,
+      'player.css': css,
+      'app.mjs': bundled.bytes,
+      'config.json': Buffer.from(releasePlayerConfig({ seconds, soundtrackName: audioName })),
+      'pacer-rt.wasm': pacerRtWasm,
+      'assets/show.png': payloadBytes,
+      'assets/score.pacb': built.scoreBytes,
+      [`assets/${audioName}`]: soundtrack,
+      'LICENSES.txt': Buffer.from(licenses({
+        pngineVersion,
+        pacerVersion,
+        licenseText,
+      })),
+    };
+
+    return {
+      files,
+      meta: {
+        payload: { bytes: payloadBytes.byteLength, sha256: hashBytes(payloadBytes) },
+        score: { bytes: built.scoreBytes.byteLength, sha256: hashBytes(built.scoreBytes) },
+        soundtrack: { name: audioName, bytes: soundtrack.byteLength, sha256: soundtrackDigest },
+        pacerRtWasm: { bytes: pacerRtWasm.byteLength, sha256: hashBytes(pacerRtWasm) },
+        bundle: {
+          bytes: bundled.bytes.byteLength,
+          sha256: hashBytes(bundled.bytes),
+          esbuild: bundled.esbuildVersion,
+          inputs: bundled.inputs,
+        },
+        build: {
+          stages: built.stages,
+          join: built.join,
+          toolchain: built.receipt.toolchain,
+        },
+        reflection: built.reflection,
+        join: built.join,
+        runtimeDigest: runtime.digest,
+        payloadReceipt: built.receipt.outputs.payload.sha256,
+      },
+    };
+  } finally {
+    // The disposal guard (lib/rmtree.mjs): a completed export must not fail
+    // on a transient ENOTEMPTY while the work tree settles.
+    await removeTree(work);
+  }
+}