@baselane/packs 0.1.0

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+Copyright 2026 Mohammad Omar
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,6 @@
+baselane pack library — third-party attributions
+=================================================
+Some packs adapt content from the following MIT-licensed project:
+  ECC — https://github.com/affaan-m/ECC — © 2026 Affaan Mustafa — MIT License
+Adapted, not copied verbatim. Each adapted pack also carries an `attribution`
+field surfaced in its generated AGENTS.md.

package/README.md

@@ -0,0 +1,15 @@
+# @baselane/packs
+
+WorkflowPack schema, validation (`validatePack`), and render pipeline, plus the
+built-in packs and seed skills shipped by the [`baselane`](https://www.npmjs.com/package/baselane)
+CLI (e.g. `disciplined-workflow`, `frontend-taste`, `security-review`).
+
+## Install
+
+```sh
+npm install @baselane/packs
+```
+
+Used as a library dependency of `baselane` — most users won't install it directly.
+
+Docs: https://baselane.sh

package/dist/ai-merge.d.ts

@@ -0,0 +1,26 @@
+export interface MergeInput {
+    path: string;
+    existing: string;
+    managedBody: string;
+    packId: string;
+    version: string;
+}
+export interface MergeResult {
+    path: string;
+    merged: string;
+    rationale: string;
+    usedAi: boolean;
+}
+export interface AiConfig {
+    apiKey: string | null;
+    model?: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Merge a pack's managed region into an existing file, preferring an AI-assisted merge
+ * that can reconcile the team's surrounding content more gracefully than the mechanical
+ * region merge — but never at the risk of corrupting or leaking anything. Any failure
+ * (no key, network error, bad response, failed validation) falls back to
+ * `mergeManagedRegion`. This function never throws.
+ */
+export declare function aiMergeFile(input: MergeInput, cfg: AiConfig): Promise<MergeResult>;

package/dist/ai-merge.js

@@ -0,0 +1,165 @@
+import { END_MARKER, buildStartMarker, mergeManagedRegion } from "./merge-region.js";
+const API_URL = "https://api.anthropic.com/v1/messages";
+const ANTHROPIC_VERSION = "2023-06-01";
+const DEFAULT_MODEL = "claude-sonnet-5";
+const MAX_TOKENS = 8192;
+// The marker literals come from merge-region.ts (single source of truth). The AI is
+// instructed to use these exact strings so mergeManagedRegion can still find the region
+// on the next mechanical pass, and so we can validate the AI didn't invent its own.
+function mechanicalFallback(input, rationale) {
+    const merged = mergeManagedRegion(input.existing, input.managedBody, input.packId, input.version);
+    return { path: input.path, merged, rationale, usedAi: false };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function buildRequestBody(input, model, startMarker) {
+    const system = [
+        `You adopt a baselane workflow-pack into a repo's existing ${input.path}.`,
+        "Preserve ALL of the team's existing project-specific content verbatim (entities, conventions, env vars, service notes) — do not summarize, reformat, or drop any of it.",
+        "Add the baselane standard inside exactly one managed region, delimited by these EXACT markers. Do not alter them, and do not invent your own:",
+        `Opening marker: ${startMarker}`,
+        `Closing marker: ${END_MARKER}`,
+        'Return STRICT JSON and nothing else, matching this shape: {"merged": string, "rationale": string}. "merged" is the full resulting file content; "rationale" is one sentence explaining what you did.',
+    ].join("\n");
+    const user = [
+        "Existing file content (preserve verbatim outside the managed region):",
+        "---",
+        input.existing,
+        "---",
+        "",
+        "Managed region body to insert between the markers:",
+        "---",
+        input.managedBody,
+        "---",
+    ].join("\n");
+    return { model, max_tokens: MAX_TOKENS, system, messages: [{ role: "user", content: user }] };
+}
+function extractResponseText(data) {
+    if (typeof data !== "object" || data === null)
+        return null;
+    const content = data.content;
+    if (!Array.isArray(content))
+        return null;
+    for (const block of content) {
+        if (typeof block !== "object" || block === null)
+            continue;
+        const { type, text } = block;
+        if (type === "text" && typeof text === "string")
+            return text;
+    }
+    return null;
+}
+// Models sometimes wrap the JSON in prose or a markdown fence despite instructions;
+// try a straight parse first, then fall back to the outermost {...} slice.
+function extractJson(text) {
+    const trimmed = text.trim();
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        // fall through to the brace-slice attempt below
+    }
+    const start = trimmed.indexOf("{");
+    const end = trimmed.lastIndexOf("}");
+    if (start === -1 || end === -1 || end <= start)
+        return null;
+    try {
+        return JSON.parse(trimmed.slice(start, end + 1));
+    }
+    catch {
+        return null;
+    }
+}
+function parseAiPayload(text) {
+    const raw = extractJson(text);
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    const { merged, rationale } = raw;
+    if (typeof merged !== "string" || merged.length === 0)
+        return null;
+    return { merged, rationale: typeof rationale === "string" ? rationale : "AI merge applied." };
+}
+// Strip every baselane managed region (start-marker … end-marker) from a body, leaving only the
+// developer's own content. Used so the preservation check compares dev-content against dev-content
+// and never counts the pack's freshly-inserted region as "preserving" a deleted line.
+const MANAGED_REGION_RE = /<!-- baselane:start [^\n]*?-->[\s\S]*?<!-- baselane:end -->/g;
+// The merged output must not have dropped ANY of the team's existing content. We check every
+// non-blank line of `existing` survives (as a trimmed substring) in the merged output — but only
+// in the part OUTSIDE the managed region on both sides. Bug #22: without stripping the region, a
+// developer line the model DELETED that ALSO happens to appear in the pack's inserted body (common
+// for house rules like "use parameterized queries") would count as preserved even though the
+// original was removed. Comparing dev-content-to-dev-content closes that. Strict is the SAFE
+// direction: a false negative just falls back to the deterministic mechanical merge, whereas a
+// false positive silently destroys customer content — we err toward the fallback.
+function preservesExisting(existing, merged) {
+    const devOnly = (text) => text.replace(MANAGED_REGION_RE, "");
+    const mergedDev = devOnly(merged);
+    const existingLines = devOnly(existing)
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    return existingLines.every((line) => mergedDev.includes(line));
+}
+function validationFailure(payload, input, startMarker) {
+    if (!payload.merged.includes(startMarker) || !payload.merged.includes(END_MARKER)) {
+        return "AI response did not include the required markers";
+    }
+    if (!preservesExisting(input.existing, payload.merged)) {
+        return "AI response dropped existing content";
+    }
+    return null;
+}
+/**
+ * Merge a pack's managed region into an existing file, preferring an AI-assisted merge
+ * that can reconcile the team's surrounding content more gracefully than the mechanical
+ * region merge — but never at the risk of corrupting or leaking anything. Any failure
+ * (no key, network error, bad response, failed validation) falls back to
+ * `mergeManagedRegion`. This function never throws.
+ */
+export async function aiMergeFile(input, cfg) {
+    if (!cfg.apiKey) {
+        return mechanicalFallback(input, "Mechanical merge (no AI key configured).");
+    }
+    const startMarker = buildStartMarker(input.packId, input.version);
+    const model = cfg.model ?? process.env.BASELANE_MERGE_MODEL ?? DEFAULT_MODEL;
+    const fetchImpl = cfg.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetchImpl(API_URL, {
+            method: "POST",
+            headers: {
+                "x-api-key": cfg.apiKey,
+                "anthropic-version": ANTHROPIC_VERSION,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(buildRequestBody(input, model, startMarker)),
+        });
+    }
+    catch (error) {
+        return mechanicalFallback(input, `Mechanical merge (AI request failed: ${errorMessage(error)}).`);
+    }
+    if (!response.ok) {
+        return mechanicalFallback(input, `Mechanical merge (AI request failed: HTTP ${response.status}).`);
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        return mechanicalFallback(input, "Mechanical merge (AI response was not valid JSON).");
+    }
+    const text = extractResponseText(data);
+    if (text === null) {
+        return mechanicalFallback(input, "Mechanical merge (AI response had no text content).");
+    }
+    const payload = parseAiPayload(text);
+    if (payload === null) {
+        return mechanicalFallback(input, "Mechanical merge (AI response was not valid JSON).");
+    }
+    const failure = validationFailure(payload, input, startMarker);
+    if (failure !== null) {
+        return mechanicalFallback(input, `Mechanical merge (${failure}).`);
+    }
+    return { path: input.path, merged: payload.merged, rationale: payload.rationale, usedAi: true };
+}

package/dist/aliases.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Retired pack ids that still resolve to their successor, so existing assignments,
+ * bundles, and open PRs that reference the old id keep working. The map IS the
+ * migration: a retired pack's directory and goldens are deleted, and this entry
+ * redirects the id to its successor's content.
+ */
+export declare const PACK_ALIASES: Record<string, string>;

package/dist/aliases.js

@@ -0,0 +1,9 @@
+/**
+ * Retired pack ids that still resolve to their successor, so existing assignments,
+ * bundles, and open PRs that reference the old id keep working. The map IS the
+ * migration: a retired pack's directory and goldens are deleted, and this entry
+ * redirects the id to its successor's content.
+ */
+export const PACK_ALIASES = {
+    "test-loop": "software-engineer-harness",
+};

package/dist/compose-draft.d.ts

@@ -0,0 +1,19 @@
+import type { AnalysisProfile } from "@baselane/analyze";
+import type { ConventionsReport } from "@baselane/analyze";
+import type { WorkflowPack } from "./types.ts";
+export interface DraftPackInput {
+    profile: AnalysisProfile;
+    conventions: ConventionsReport;
+    /** "owner/name" or a dir basename; drives id/title/summary. */
+    repoName?: string;
+}
+export interface DraftPackResult {
+    /** Already validatePack-checked — never returned unvalidated. */
+    pack: WorkflowPack;
+    /** The measured-conventions ruleset, reused verbatim as the emitted rules-component payload. */
+    rulesMarkdown: string;
+}
+/** Deterministic composer: an analysis report -> a validatePack-checked WorkflowPack draft. The
+ * measured conventions become the pack's context markdown AND are returned separately so the caller
+ * can emit them as a reusable library `rules` component. */
+export declare function composeDraftPack(input: DraftPackInput): DraftPackResult;

package/dist/compose-draft.js

@@ -0,0 +1,170 @@
+import { validatePack } from "./validate.js";
+const UI_FRAMEWORK = /react|next|vue|svelte|angular/i;
+// Test runners are surfaced in `profile.frameworks` alongside UI/backend frameworks, but they're
+// tooling, not architecture — excluded from the stack label so titles/summaries read like
+// "React + TypeScript" instead of getting diluted with "Vitest".
+const TEST_FRAMEWORKS = new Set(["vitest", "jest", "mocha", "@playwright/test"]);
+const DISPLAY_NAMES = {
+    typescript: "TypeScript",
+    javascript: "JavaScript",
+    react: "React",
+    next: "Next.js",
+    vue: "Vue",
+    svelte: "Svelte",
+    express: "Express",
+    fastify: "Fastify",
+    "@nestjs/core": "NestJS",
+};
+function displayName(id) {
+    const known = DISPLAY_NAMES[id];
+    if (known)
+        return known;
+    const bare = id.replace(/^@[^/]+\//, "");
+    return bare.charAt(0).toUpperCase() + bare.slice(1);
+}
+/** Notable frameworks (UI/backend, not test tooling) followed by languages, deduped
+ * case-insensitively. This is "the stack" for titles/summaries — e.g. ["React", "TypeScript"]. */
+function stackParts(profile) {
+    const names = [
+        ...profile.frameworks.filter((f) => !TEST_FRAMEWORKS.has(f.name)).map((f) => displayName(f.name)),
+        ...profile.languages.map(displayName),
+    ];
+    const seen = new Set();
+    return names.filter((name) => {
+        const key = name.toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function lastSegment(repoName) {
+    return (repoName ?? "").split("/").pop() ?? "";
+}
+function slugifyRepo(repoName) {
+    const slug = lastSegment(repoName)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return slug.length > 0 ? slug : "drafted-pack";
+}
+function pct(consistency) {
+    return Math.round(consistency * 100);
+}
+function ruleBullet(r) {
+    const prefix = r.enforced ? "" : "**Unwritten rule** — ";
+    return `- ${prefix}${r.statement} (${pct(r.consistency)}%)`;
+}
+function buildRulesMarkdown(conventions) {
+    const toolingLine = conventions.lintConfigs.length > 0
+        ? `Configured tooling: ${conventions.lintConfigs.map((c) => `${c.tool} (${c.path})`).join(", ")}.`
+        : "No lint/format tooling configured — every convention below is unwritten.";
+    const bullets = conventions.rules.length > 0
+        ? conventions.rules.map(ruleBullet)
+        : ["- No strongly consistent conventions were detected."];
+    if (conventions.fileLength) {
+        bullets.push(`- File length: p50 ${conventions.fileLength.p50} lines, p90 ${conventions.fileLength.p90} lines`);
+    }
+    const parts = [
+        "## Conventions",
+        "",
+        `Measured from this repository's own code (${conventions.sampledFiles} files sampled). Rules marked "unwritten" are followed consistently but not enforced by any linter — encode them so agents keep following them.`,
+        "",
+        toolingLine,
+        "",
+        ...bullets,
+    ];
+    if (conventions.mixed.length > 0) {
+        parts.push("", "### Measured but inconsistent", "", "Present in the code but below the auto-encode threshold — surfaced for humans, not encoded as rules:");
+        for (const m of conventions.mixed) {
+            parts.push(`- ${m.statement} — measured but inconsistent, not auto-encoded (${pct(m.consistency)}%)`);
+        }
+    }
+    return parts.join("\n");
+}
+function commandBlocks(profile) {
+    const specs = [
+        { name: "build", cmd: profile.commands.build },
+        { name: "test", cmd: profile.commands.test },
+        { name: "lint", cmd: profile.commands.lint },
+    ];
+    return specs
+        .filter((s) => s.cmd !== null)
+        .map((s) => ({
+        name: s.name,
+        description: `Run \`${s.cmd}\` and report failures.`,
+        argument_hint: "[extra args]",
+        prompt: `Run \`${s.cmd}\` and report any failures with file:line.`,
+    }));
+}
+function pluralize(n, word) {
+    return `${n} ${word}${n === 1 ? "" : "s"}`;
+}
+/** Total conventions found is rules + mixed (see @baselane/analyze's RULE_THRESHOLD): `rules` are
+ * consistency >= 90% (auto-encoded), `mixed` are below that (measured but not auto-encoded). Both
+ * count as "found" — a summary that only counts `rules` undercounts what the draft actually surfaces. */
+function conventionsClause(conventions) {
+    const total = conventions.rules.length + conventions.mixed.length;
+    return `${pluralize(total, "convention")} measured (${conventions.rules.length} consistent, ${conventions.mixed.length} inconsistent)`;
+}
+function capabilityBlocks(profile) {
+    const caps = [{ type: "system-map", store: "repo", method: "analyze" }];
+    if (profile.languages.length > 0)
+        caps.push({ type: "graph", store: "repo", method: "imports" });
+    if (profile.frameworks.some((f) => UI_FRAMEWORK.test(f.name))) {
+        caps.push({ type: "design", store: "repo", method: "author" });
+    }
+    return caps;
+}
+/** Two *enforcing* gate hooks — unlike reminder hooks (which only print), these exit non-zero to
+ * actually block. The secret-scan gate runs before a Bash tool call and blocks it while gitleaks
+ * finds an unredacted secret; the test gate blocks ending the session on a red suite. `settingsJson`
+ * passes these commands into `.claude/settings.json` byte-for-byte, so the exit code reaches Claude
+ * Code's hook runner intact. Commands are single-line (the `line()` validator rejects newlines). */
+function hookBlocks(profile) {
+    const hooks = [
+        {
+            event: "PreToolUse",
+            matcher: "Bash",
+            description: "Block shell commands while gitleaks finds an unredacted secret in the working tree.",
+            action: "run-command",
+            command: "if command -v gitleaks >/dev/null 2>&1; then gitleaks detect --no-git --no-banner --redact >/dev/null 2>&1 || exit 1; fi",
+        },
+    ];
+    if (profile.commands.test) {
+        hooks.push({
+            event: "Stop",
+            matcher: "",
+            description: "Do not end the session while the test suite is failing.",
+            action: "run-command",
+            command: `${profile.commands.test} || exit 1`,
+        });
+    }
+    return hooks;
+}
+/** Deterministic composer: an analysis report -> a validatePack-checked WorkflowPack draft. The
+ * measured conventions become the pack's context markdown AND are returned separately so the caller
+ * can emit them as a reusable library `rules` component. */
+export function composeDraftPack(input) {
+    const { profile, conventions, repoName } = input;
+    const rulesMarkdown = buildRulesMarkdown(conventions);
+    const label = lastSegment(repoName) || "this repo";
+    const stack = stackParts(profile);
+    const commands = commandBlocks(profile);
+    const capabilities = capabilityBlocks(profile);
+    // Package manager rides along in the summary's stack list (more identifying detail than the
+    // title needs) but not the title itself, which stays to "React + TypeScript"-style branding.
+    const summaryStack = profile.packageManager ? [...stack, profile.packageManager] : stack;
+    const candidate = {
+        id: slugifyRepo(repoName),
+        version: "0.1.0",
+        title: stack.length > 0 ? `${label} — ${stack.join(" + ")} conventions` : `${label} starter pack`,
+        summary: `Conventions and starter blocks for ${label}${summaryStack.length > 0 ? ` — ${summaryStack.join(", ")}` : ""}: ${conventionsClause(conventions)}, ${pluralize(commands.length, "command")}, plus ${pluralize(capabilities.length, "capability block")}.`,
+        context: { markdown: rulesMarkdown },
+        capabilities,
+        agents: [],
+        commands,
+        hooks: hookBlocks(profile),
+    };
+    return { pack: validatePack(candidate), rulesMarkdown };
+}

package/dist/drift-detect.d.ts

@@ -0,0 +1,8 @@
+export type DriftKind = "version" | "content" | "missing" | "none";
+/**
+ * Worst-of drift across every entry file this pack actually renders — missing (the region is gone)
+ * outranks a stale version, which outranks a hand-edited body, which outranks no drift at all. Pure:
+ * the caller supplies the repo's current entry-file contents and the pack's freshly rendered FileMap,
+ * so this has no I/O and no dependency on how either was obtained.
+ */
+export declare function detectPackDrift(entryFiles: Record<string, string>, packId: string, currentVersion: string, renderedFiles: Record<string, string>): DriftKind;

package/dist/drift-detect.js

@@ -0,0 +1,21 @@
+import { ENTRY_FILES, extractManagedRegions } from "./merge-region.js";
+const DRIFT_RANK = { none: 0, content: 1, version: 2, missing: 3 };
+/**
+ * Worst-of drift across every entry file this pack actually renders — missing (the region is gone)
+ * outranks a stale version, which outranks a hand-edited body, which outranks no drift at all. Pure:
+ * the caller supplies the repo's current entry-file contents and the pack's freshly rendered FileMap,
+ * so this has no I/O and no dependency on how either was obtained.
+ */
+export function detectPackDrift(entryFiles, packId, currentVersion, renderedFiles) {
+    let worst = "none";
+    for (const path of ENTRY_FILES) {
+        const rendered = renderedFiles[path];
+        if (rendered === undefined)
+            continue; // this pack doesn't render this entry file at all
+        const region = extractManagedRegions(entryFiles[path] ?? "").find((r) => r.packId === packId);
+        const kind = !region ? "missing" : region.version !== currentVersion ? "version" : region.body !== rendered.trim() ? "content" : "none";
+        if (DRIFT_RANK[kind] > DRIFT_RANK[worst])
+            worst = kind;
+    }
+    return worst;
+}