@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/scripts/build-vendored-sbom.js

@@ -0,0 +1,325 @@
+"use strict";
+// Build a CycloneDX 1.6 SBOM covering lib/vendor/* bundles.
+//
+// Run via:
+//   node scripts/build-vendored-sbom.js > sbom.vendored.cdx.json
+//
+// Wired into .github/workflows/npm-publish.yml. The primary SBOM
+// (sbom.cdx.json) describes the npm package's (empty) runtime deps;
+// this doc describes the actual code shipping inside the tarball.
+
+var fs       = require("node:fs");
+var path     = require("node:path");
+var crypto   = require("node:crypto");
+
+var manifestPath = path.resolve(__dirname, "..", "lib", "vendor", "MANIFEST.json");
+var manifest;
+try {
+  var raw = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  // MANIFEST.json shape: { _comment, packages: { key: entry, ... } }
+  manifest = raw.packages || raw;
+} catch (e) {
+  process.stderr.write("[build-vendored-sbom] failed to read MANIFEST.json: " + e.message + "\n");
+  process.exit(1);
+}
+
+var rootPkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, "..", "package.json"), "utf8"));
+
+// CycloneDX 1.6 §4.2 requires serialNumber to be a UUID
+// uniquely identifying the BOM artifact. Deriving the UUID from the
+// rootPkg.version made every rebuild of the SAME version produce the
+// same serialNumber — BOM-diff tools (Dependency-Track, Snyk SBOM
+// Monitor) couldn't distinguish rebuilds that should be independent
+// artifacts (different timestamps, different lifecycles). Switch to
+// crypto.randomUUID() per invocation; downstream consumers rely on
+// serialNumber-per-build identity, not version-stable identity.
+var serialNumber = "urn:uuid:" + crypto.randomUUID();
+
+// CycloneDX 1.6 §4.4 (metadata.supplier) + SLSA v1.0
+// provenance attestation require a `supplier` block on every BOM the
+// build pipeline emits. `gh attestation verify` walks the chain and
+// fails closed when the SBOM omits metadata.supplier. The supplier
+// for blamejs framework artifacts is the framework maintainer
+// publisher identity.
+var FRAMEWORK_SUPPLIER = {
+  "name": "blamejs",
+  "url":  ["https://blamejs.com/"],
+};
+
+// CycloneDX 1.6 §4.4.2 — metadata.lifecycles[] entries
+// MAY carry externalReferences pointing at the build pipeline that
+// produced this BOM. Provenance walkers (Sigstore, SLSA verifiers)
+// reach for these when correlating the BOM to its build run.
+// GITHUB_SERVER_URL + GITHUB_REPOSITORY + GITHUB_RUN_ID are populated
+// by Actions; absent locally the externalRef is omitted.
+function _githubActionsRunUrl() {
+  var server = process.env.GITHUB_SERVER_URL;                       // allow:raw-process-env — read by env-driven script
+  var repo   = process.env.GITHUB_REPOSITORY;                       // allow:raw-process-env — read by env-driven script
+  var runId  = process.env.GITHUB_RUN_ID;                           // allow:raw-process-env — read by env-driven script
+  if (typeof server === "string" && server.length > 0 &&
+      typeof repo === "string" && repo.length > 0 &&
+      typeof runId === "string" && runId.length > 0) {
+    return server + "/" + repo + "/actions/runs/" + runId;
+  }
+  return null;
+}
+
+// CycloneDX 1.6 §4.6 — license.id MUST be a valid SPDX
+// license-list identifier. Non-SPDX prose ("BIMI Group / per-issuer")
+// falls into license.name (the free-text fallback) so consumers
+// parsing SBOM-as-SPDX don't reject the whole BOM on an unknown
+// identifier. Keep the validator narrow — full SPDX list has
+// hundreds of entries; we cover the common SPDX identifiers used by
+// the framework's vendored deps, then anything else routes to
+// license.name with `license_is_spdx: false` honoring the manifest's
+// explicit override.
+var SPDX_LICENSE_IDS = Object.freeze({
+  "0BSD": 1, "Apache-2.0": 1, "BSD-2-Clause": 1, "BSD-3-Clause": 1,
+  "CC0-1.0": 1, "CC-BY-3.0": 1, "CC-BY-4.0": 1, "CC-BY-SA-4.0": 1,
+  "GPL-2.0-only": 1, "GPL-2.0-or-later": 1, "GPL-3.0-only": 1,
+  "GPL-3.0-or-later": 1, "LGPL-2.1-only": 1, "LGPL-2.1-or-later": 1,
+  "LGPL-3.0-only": 1, "LGPL-3.0-or-later": 1, "ISC": 1, "MIT": 1,
+  "MIT-0": 1, "MPL-2.0": 1, "Unlicense": 1, "WTFPL": 1, "Zlib": 1,
+});
+
+function _licenseFor(entry) {
+  if (typeof entry.license !== "string" || entry.license.length === 0) return null;
+  // Operator-explicit non-SPDX flag takes precedence.
+  if (entry.license_is_spdx === false) {
+    return [{ license: { name: entry.license } }];
+  }
+  // SPDX identifier check — license-list match goes to `id`, free text
+  // to `name`. Spec-conformant SBOM consumers reject license.id =
+  // "BIMI Group / per-issuer" since it isn't on the SPDX list.
+  if (SPDX_LICENSE_IDS[entry.license]) {
+    return [{ license: { id: entry.license } }];
+  }
+  return [{ license: { name: entry.license } }];
+}
+
+function _purlFor(entry, key) {
+  // Manifest key IS the npm package name for npm-mapped entries.
+  if (/^(@[a-z0-9-_.]+\/)?[a-z0-9-_.]+$/i.test(key) && entry.source && /npm|github\.com\//.test(entry.source)) {
+    // If source looks like a github repo, prefer pkg:github
+    if (/^https?:\/\/github\.com\//.test(entry.source)) {
+      var m = /^https?:\/\/github\.com\/([^/]+)\/([^/]+)/.exec(entry.source);
+      if (m && !/^@/.test(key)) {
+        // Use github purl when not a scoped npm package
+        return "pkg:github/" + m[1] + "/" + m[2].replace(/\.git$/, "") +
+               "@" + entry.version;
+      }
+    }
+    return "pkg:npm/" + key.replace(/^@/, "%40").replace("/", "%2F") +
+           "@" + entry.version;
+  }
+  return "pkg:generic/" + key + "@" + entry.version;
+}
+
+function _hashesFor(entry) {
+  var rv = [];
+  if (entry.sha256) {
+    rv.push({ alg: "SHA-256", content: entry.sha256 });
+    return rv;
+  }
+  // MANIFEST.json shape: hashes: { server: "sha256:<hex>", ... }
+  if (entry.hashes && typeof entry.hashes === "object") {
+    Object.keys(entry.hashes).forEach(function (slot) {
+      var v = entry.hashes[slot];
+      if (typeof v !== "string") return;
+      var m = /^sha256:([a-f0-9]{64})$/i.exec(v);
+      if (m) rv.push({ alg: "SHA-256", content: m[1] });
+    });
+  }
+  return rv;
+}
+
+// CycloneDX 1.6 §4.7 — sub-component dependsOn graph.
+// Entries shaped like `peculiar-pki` carry a `components` map of
+// inner sub-bundles ({ "@peculiar/x509": <vcs-url>, "pkijs": <vcs-url> }).
+// Emit each as its own SBOM component + register the parent's
+// dependsOn so Dependency-Track / Snyk SBOM Monitor see the inner
+// bundle structure (otherwise the peculiar-pki bundle appears as a
+// monolithic component and its sub-vulnerabilities can't be CVE-mapped).
+var _subDeps = [];   // [{ parentRef, childRef }, ...]
+
+function _buildComponent(key, entry) {
+  var c = {
+    "type":      "library",
+    "bom-ref":   key + "@" + entry.version,
+    "name":      key,
+    "version":   entry.version,
+    "purl":      _purlFor(entry, key),
+    "scope":     "required",
+  };
+  if (entry.author) {
+    c.author = entry.author;
+    // CycloneDX 1.6 §4.5.2 — per-component supplier
+    // mirrors metadata.supplier. `gh attestation verify` walks each
+    // component's supplier when reconciling provenance; an absent
+    // per-component supplier falls back to metadata.supplier but
+    // SLSA v1.0 prefers explicit attribution at the component level.
+    c.supplier = { "name": entry.author };
+  }
+  if (entry.description) c.description = entry.description;
+  var licenses = _licenseFor(entry);
+  if (licenses) c.licenses = licenses;
+  // CycloneDX 1.6 §4.5 — cpe field. CISA/NVD CVE-matching
+  // pipelines rely on the CPE 2.3 identifier; absent it, ~30% of NVD
+  // entries (CPE-only feed; no purl mirror) miss the match. MANIFEST
+  // entries supply `cpe: "cpe:2.3:a:vendor:product:version:..."` per
+  // CPE 2.3 Naming Specification (NIST IR 7695).
+  if (typeof entry.cpe === "string" && entry.cpe.length > 0) {
+    c.cpe = entry.cpe;
+  }
+  if (entry.source) {
+    c.externalReferences = [{ type: "vcs", url: entry.source }];
+  }
+  var hashes = _hashesFor(entry);
+  if (hashes.length > 0) c.hashes = hashes;
+  if (entry.bundledAt) {
+    c.properties = [{ name: "blamejs:bundledAt", value: entry.bundledAt }];
+  }
+  return c;
+}
+
+var components = [];
+Object.keys(manifest).filter(function (key) {
+  // Skip MANIFEST.json's _comment and any other underscore-prefixed metadata
+  if (key.charAt(0) === "_") return false;
+  var entry = manifest[key];
+  return entry && typeof entry === "object" && typeof entry.version === "string";
+}).forEach(function (key) {
+  var entry = manifest[key];
+  var parent = _buildComponent(key, entry);
+  components.push(parent);
+
+  // sub-component expansion. `entry.components` is a map keyed by
+  // sub-component name. Each value is EITHER:
+  //   - a bare string `"<vcs-url>"` (legacy form; sub inherits the
+  //     parent's version), OR
+  //   - an object `{ url, version }` where `version` is the actual
+  //     upstream version of the sub-component (preferred form for
+  //     meta-bundles whose parent version is a composite tag like
+  //     `2.0.0+pkijs-3.4.0` — the parent version doesn't match
+  //     ANY sub-component's real upstream version, so a CVE matcher
+  //     keying off component version produces false negatives on
+  //     the children unless we report each sub-component's real
+  //     version here).
+  // Each becomes a child component sharing the parent's license +
+  // bundledAt context, with its own purl + externalReferences +
+  // bom-ref so downstream CVE walkers see the inner structure.
+  if (entry.components && typeof entry.components === "object" && !Array.isArray(entry.components)) {
+    var subKeys = Object.keys(entry.components);
+    for (var si = 0; si < subKeys.length; si++) {
+      var subName  = subKeys[si];
+      var subValue = entry.components[subName];
+      var subUrl;
+      var subVersion;
+      if (typeof subValue === "string") {
+        subUrl     = subValue;
+        subVersion = entry.version;   // legacy form — inherit parent
+      } else if (subValue && typeof subValue === "object" &&
+                 typeof subValue.url === "string") {
+        subUrl     = subValue.url;
+        subVersion = typeof subValue.version === "string" && subValue.version.length > 0
+                     ? subValue.version
+                     : entry.version;
+      } else {
+        continue;
+      }
+      if (subUrl.length === 0) continue;
+      // Sub-component inherits parent license + bundledAt; uses its
+      // own version (when supplied) or falls back to parent.
+      // bom-ref namespaced under the parent so two parents that bundle
+      // the same sub-name don't collide.
+      var subEntry = {
+        version:    subVersion,
+        license:    entry.license,
+        license_is_spdx: entry.license_is_spdx,
+        author:     entry.author,
+        source:     subUrl,
+        bundledAt:  entry.bundledAt,
+      };
+      var subKey = key + "/" + subName;
+      var sub = _buildComponent(subKey, subEntry);
+      components.push(sub);
+      _subDeps.push({ parentRef: parent["bom-ref"], childRef: sub["bom-ref"] });
+    }
+  }
+});
+
+// CycloneDX 1.6 §4.4.2 — metadata.lifecycles[].externalReferences[]
+// points at the GH Actions run URL when the build ran in CI. Provenance
+// walkers (Sigstore, SLSA verifiers) reach for this when correlating
+// the BOM to its build run. Locally-generated SBOMs omit (no run id).
+var _buildLifecycle = { "phase": "build" };
+var _runUrl = _githubActionsRunUrl();
+if (_runUrl) {
+  _buildLifecycle.externalReferences = [{ type: "build-meta", url: _runUrl }];
+}
+
+// assemble the dependency graph. Top-level entries depend
+// on the framework's vendored-bundle; sub-components depend on their
+// parent component. Result is a directed graph downstream tools walk
+// to reach every inner sub-bundle CVE.
+//
+// Top-level refs are derived by exclusion: a component is top-level
+// iff its bom-ref never appears as a child in _subDeps. The earlier
+// substring-heuristic on "/" misclassified scoped packages like
+// `@peculiar/x509` and any future sub-component naming scheme.
+var _childRefs = Object.create(null);
+for (var di = 0; di < _subDeps.length; di++) _childRefs[_subDeps[di].childRef] = true;
+var _topLevelRefs = components
+  .map(function (c) { return c["bom-ref"]; })
+  .filter(function (ref) { return !_childRefs[ref]; });
+
+var _dependencies = [
+  {
+    "ref":       "@blamejs/core@" + rootPkg.version + "/vendored-bundle",
+    "dependsOn": _topLevelRefs,
+  },
+];
+// Aggregate sub-deps per parent so each parent emits a single
+// dependencies[] entry with its full child list.
+var _byParent = Object.create(null);
+for (var pi = 0; pi < _subDeps.length; pi++) {
+  var pd = _subDeps[pi];
+  if (!_byParent[pd.parentRef]) _byParent[pd.parentRef] = [];
+  _byParent[pd.parentRef].push(pd.childRef);
+}
+var _parents = Object.keys(_byParent);
+for (var pj = 0; pj < _parents.length; pj++) {
+  _dependencies.push({ ref: _parents[pj], dependsOn: _byParent[_parents[pj]] });
+}
+
+var doc = {
+  "$schema":      "http://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat":    "CycloneDX",
+  "specVersion":  "1.6",
+  "serialNumber": serialNumber,
+  "version":      1,
+  "metadata": {
+    "timestamp": new Date().toISOString(),
+    "lifecycles": [_buildLifecycle],
+    "supplier":  FRAMEWORK_SUPPLIER,
+    "tools": [
+      {
+        "vendor":  "blamejs",
+        "name":    "build-vendored-sbom.js",
+        "version": rootPkg.version,
+      },
+    ],
+    "component": {
+      "bom-ref":     "@blamejs/core@" + rootPkg.version + "/vendored-bundle",
+      "type":        "library",
+      "name":        "blamejs-vendored-bundle",
+      "version":     rootPkg.version,
+      "description": "Vendored runtime deps bundled inside @blamejs/core (CommonJS rollups under lib/vendor/).",
+      "supplier":    FRAMEWORK_SUPPLIER,
+    },
+  },
+  "components":   components,
+  "dependencies": _dependencies,
+};
+
+process.stdout.write(JSON.stringify(doc, null, 2) + "\n");

package/lib/vendor/blamejs/scripts/check-api-snapshot.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * scripts/check-api-snapshot.js
+ *
+ * CI gate. Captures the current framework surface and compares it to
+ * the committed api-snapshot.json baseline. Fails on breaking changes
+ * (removed members, type changes); logs additive changes for visibility.
+ *
+ * Exit codes:
+ *   0  — no breaking changes (additive changes printed but not failing)
+ *   1  — breaking changes detected
+ *   2  — script-level error (missing baseline, IO failure, etc.)
+ *
+ * Operators see this gate in the SECURITY.md checklist as a CI promise:
+ * "removed methods or changed signatures fail the build before they
+ * reach a published release."
+ *
+ * Usage:
+ *   node scripts/check-api-snapshot.js
+ */
+var path = require("path");
+var b = require("../index.js");
+var pkg = require("../package.json");
+
+try {
+  var baselinePath = path.join(__dirname, "..", "api-snapshot.json");
+  var baseline;
+  try {
+    baseline = b.apiSnapshot.read(baselinePath);
+  } catch (e) {
+    console.error("[check-api-snapshot] baseline missing or unreadable: " +
+      ((e && e.message) || String(e)));
+    console.error("[check-api-snapshot] generate one with `node scripts/refresh-api-snapshot.js` " +
+      "and commit it.");
+    process.exit(2);
+  }
+
+  var current = b.apiSnapshot.capture(b, {
+    frameworkVersion: pkg.version,
+  });
+  var diff = b.apiSnapshot.compare(baseline, current);
+
+  console.log(b.apiSnapshot.formatDiff(diff));
+
+  if (diff.breaking.length > 0) {
+    console.error("[check-api-snapshot] BREAKING changes detected. If intentional, " +
+      "regenerate the baseline with `node scripts/refresh-api-snapshot.js` and commit it " +
+      "alongside a major-version bump per the LTS calendar.");
+    process.exit(1);
+  }
+
+  if (diff.additive.length > 0) {
+    console.log("[check-api-snapshot] " + diff.additive.length +
+      " additive change(s) — refresh the baseline at the next release " +
+      "(`node scripts/refresh-api-snapshot.js`) so the new surfaces " +
+      "are tracked.");
+  }
+  process.exit(0);
+} catch (e) {
+  console.error("[check-api-snapshot] error: " + ((e && e.stack) || e));
+  process.exit(2);
+}

package/lib/vendor/blamejs/scripts/check-changelog-extract.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Pre-push static gate — exercise the awk-extract that
+ * `.github/workflows/npm-publish.yml` runs at release time to pull
+ * the current version's CHANGELOG section into `release-notes.md`.
+ *
+ * Same logic as the workflow's `Extract release notes from CHANGELOG.md`
+ * step. Running it locally before tag-push means CHANGELOG format
+ * drift (e.g. a new entry that doesn't match the canonical
+ * `- vX.Y.Z (YYYY-MM-DD) — <summary>` shape) fails locally rather
+ * than 20 min into the workflow run.
+ *
+ * Exit codes:
+ *   0  — extract produced ≥ 1 lines AND the first line matches the
+ *        canonical entry shape
+ *   1  — no entry found OR entry shape malformed
+ *
+ * Usage:
+ *   node scripts/check-changelog-extract.js          # uses package.json version
+ *   node scripts/check-changelog-extract.js 0.11.7   # explicit version
+ */
+
+var fs   = require("node:fs");
+var path = require("node:path");
+
+var ROOT          = path.resolve(__dirname, "..");
+var CHANGELOG     = path.join(ROOT, "CHANGELOG.md");
+var PACKAGE_JSON  = path.join(ROOT, "package.json");
+
+function readPackageVersion() {
+  var raw = fs.readFileSync(PACKAGE_JSON, "utf8");
+  var pkg = JSON.parse(raw);
+  return pkg.version;
+}
+
+function extractSection(text, version) {
+  var lines = text.split(/\r?\n/);
+  var out = [];
+  var capturing = false;
+  // Each version entry begins with `- vX.Y.Z (...) — ...` and ends
+  // at the next `- v...` line OR a `## v0.x.x` section break.
+  var entryStartRe = /^- v(\d+\.\d+\.\d+) \(/;
+  var sectionBreakRe = /^## v\d/;
+  for (var i = 0; i < lines.length; i += 1) {
+    var ln = lines[i];
+    var startMatch = ln.match(entryStartRe);
+    if (startMatch) {
+      if (startMatch[1] === version) {
+        capturing = true;
+        out.push(ln);
+        continue;
+      }
+      if (capturing) break;
+    }
+    if (capturing && sectionBreakRe.test(ln)) break;
+    if (capturing) out.push(ln);
+  }
+  return out;
+}
+
+function main() {
+  var version = process.argv[2] || readPackageVersion();
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    console.error("[check-changelog-extract] FAIL: bad version arg: " +
+      JSON.stringify(version) +
+      " (expected `MAJOR.MINOR.PATCH`)");
+    process.exit(1);
+  }
+
+  var text;
+  try { text = fs.readFileSync(CHANGELOG, "utf8"); }
+  catch (e) {
+    console.error("[check-changelog-extract] FAIL: cannot read CHANGELOG.md: " +
+      (e && e.message || e));
+    process.exit(1);
+  }
+
+  var section = extractSection(text, version);
+  if (section.length === 0) {
+    console.error("[check-changelog-extract] FAIL: no CHANGELOG entry found for v" + version);
+    console.error("[check-changelog-extract] Expected a line matching `- v" + version +
+      " (YYYY-MM-DD) — <summary>`");
+    console.error("[check-changelog-extract] The workflow's release-notes extract will produce 0 lines and refuse to publish.");
+    process.exit(1);
+  }
+
+  // The first line must match the canonical shape — `- vX.Y.Z (date) — summary`.
+  var firstLine = section[0];
+  var canonical = new RegExp(
+    "^- v" + version.replace(/\./g, "\\.") +
+    " \\(\\d{4}-\\d{2}-\\d{2}\\) — \\S.+$"
+  );
+  if (!canonical.test(firstLine)) {
+    console.error("[check-changelog-extract] FAIL: v" + version +
+      " entry's first line does not match the canonical shape:");
+    console.error("[check-changelog-extract]   expected: `- v" + version +
+      " (YYYY-MM-DD) — <summary>`");
+    console.error("[check-changelog-extract]   got:       " + JSON.stringify(firstLine));
+    console.error("[check-changelog-extract] The workflow's release title build will fail to strip the prefix.");
+    process.exit(1);
+  }
+
+  console.log("[check-changelog-extract] OK — v" + version + " entry extracts cleanly (" +
+    section.length + " line(s)); first line shape canonical.");
+}
+
+main();

package/lib/vendor/blamejs/scripts/check-pack-against-gitignore.js

@@ -0,0 +1,83 @@
+"use strict";
+// prepack guard — fail the publish if any packed path is gitignored
+// (repo + global). `--ignore-scripts` on the inner pack call avoids
+// re-triggering this hook.
+
+var cp = require("node:child_process");
+
+function _run(cmd, args, opts) {
+  return cp.spawnSync(cmd, args, Object.assign({ encoding: "utf8" }, opts || {}));
+}
+
+function main() {
+  // shell-form: Node 22+ rejects spawning npm.cmd directly on Windows,
+  // and `shell: true` with a separate args array trips DEP0190.
+  var pack = _run("npm pack --dry-run --ignore-scripts --json", [], { shell: true });
+  if (pack.status !== 0) {
+    process.stderr.write("[prepack-guard] npm pack --dry-run failed:\n");
+    process.stderr.write(pack.stderr || "");
+    process.exit(1);
+  }
+  var info;
+  try { info = JSON.parse(pack.stdout); }
+  catch (_e) {
+    process.stderr.write("[prepack-guard] could not parse npm pack output\n");
+    process.exit(1);
+  }
+  var entry = Array.isArray(info) ? info[0] : info;
+  var files = (entry && entry.files) || [];
+  if (files.length === 0) {
+    process.stderr.write("[prepack-guard] npm pack reported zero files\n");
+    process.exit(1);
+  }
+  // Generated artifacts intended to ship in the tarball — these are
+  // gitignored on purpose (so a stray local generation doesn't pollute
+  // the repo) but are listed in package.json `files` because the CI
+  // workflow generates them just-in-time before publish. Skip the guard
+  // for these specific paths.
+  var GENERATED_ALLOWED = new Set([
+    "sbom.cdx.json",
+  ]);
+  var paths = files.map(function (f) { return f.path; })
+    .filter(function (p) { return !GENERATED_ALLOWED.has(p); });
+
+  var check = _run("git", ["check-ignore", "--verbose", "--no-index", "--stdin"], {
+    input: paths.join("\n") + "\n",
+  });
+
+  if (check.status === 1) {
+    process.stdout.write(
+      "[prepack-guard] ok — " + paths.length + " paths checked, none gitignored\n"
+    );
+    return;
+  }
+  if (check.status !== 0) {
+    process.stderr.write("[prepack-guard] git check-ignore failed:\n");
+    process.stderr.write(check.stderr || "");
+    process.exit(1);
+  }
+
+  // `git check-ignore -v` reports the LAST matching gitignore line,
+  // including negation (`!`) rules — but the command exits 0 even
+  // when the matching line UNIGNORES the path. A `!`-prefixed pattern
+  // means the file is NOT actually ignored, so it's safe to ship in
+  // the tarball. Output format: `.gitignore:LINE:PATTERN<TAB>PATH`.
+  var lines = (check.stdout || "").split("\n").filter(Boolean);
+  var actuallyIgnored = lines.filter(function (l) {
+    var m = l.match(/^[^:]+:\d+:([^\t]*)\t/);
+    if (!m) return true;
+    return m[1].charAt(0) !== "!";
+  });
+  if (actuallyIgnored.length === 0) {
+    process.stdout.write(
+      "[prepack-guard] ok — " + paths.length + " paths checked, " +
+      lines.length + " matched a `!`-negation rule (allowed)\n"
+    );
+    return;
+  }
+  process.stderr.write("[prepack-guard] gitignored paths in tarball:\n");
+  actuallyIgnored.forEach(function (l) { process.stderr.write("  " + l + "\n"); });
+  process.exit(1);
+}
+
+main();