@lumenflow/cli 3.18.1 → 3.20.0

package/templates/core/ai/onboarding/release-process.md.template

@@ -30,7 +30,7 @@ pnpm release --release-version 1.3.0 --skip-publish
 
 1. Validates semver version format
 2. Ensures clean working directory on main branch
-3. Syncs templates with source docs (`pnpm sync:templates`)
+3. Syncs templates with source docs (`pnpm lumenflow:sync-templates`)
 4. Bumps all `@lumenflow/*` package versions using micro-worktree isolation
 5. Builds all packages
 6. Creates and pushes git tag `vX.Y.Z`
@@ -79,24 +79,24 @@ CLI templates (`packages/@lumenflow/cli/templates/`) are synced from source docs
 
 ```bash
 # Sync source docs to CLI templates
-pnpm sync:templates
+pnpm lumenflow:sync-templates
 
 # Preview without writing files
-pnpm sync:templates --dry-run
+pnpm lumenflow:sync-templates --dry-run
 ```
 
 ### Check for Drift (CI)
 
 ```bash
 # Check if templates are out of sync with source
-pnpm sync:templates --check-drift
+pnpm lumenflow:sync-templates --check-drift
 ```
 
 The `--check-drift` flag compares templates with their source files. If drift is detected:
 
 - Exit code 1 (fails CI)
 - Lists drifting files
-- Suggests running `pnpm sync:templates`
+- Suggests running `pnpm lumenflow:sync-templates`
 
 ### What Gets Synced
 
@@ -345,12 +345,12 @@ rm packages/@lumenflow/packs/software-delivery/lumenflow-packs-software-delivery
 
 ### Vercel Projects Reference
 
-| Project           | Domain                   | Purpose                 |
-| ----------------- | ------------------------ | ----------------------- |
-| `web`             | registry.lumenflow.dev   | Pack registry + web app |
-| `docs`            | lumenflow.dev            | Starlight documentation |
-| `lumenflow-dev`   | lumenflow-dev.vercel.app | Monorepo preview        |
-| `cloud`           | cloud.lumenflow.dev      | Control plane           |
+| Project         | Domain                   | Purpose                 |
+| --------------- | ------------------------ | ----------------------- |
+| `web`           | registry.lumenflow.dev   | Pack registry + web app |
+| `docs`          | lumenflow.dev            | Starlight documentation |
+| `lumenflow-dev` | lumenflow-dev.vercel.app | Monorepo preview        |
+| `cloud`         | cloud.lumenflow.dev      | Control plane           |
 
 ### Troubleshooting Pack Publishing
 
@@ -379,7 +379,7 @@ The `@lumenflow/docs` package requires `d2` (diagramming tool) which is not avai
 - [ ] All acceptance criteria met
 - [ ] Gates pass (`pnpm gates`)
 - [ ] Pre-release checks pass (`pnpm pre-release:check`)
-- [ ] Templates synced (`pnpm sync:templates` - ensures CLI templates match source docs)
+- [ ] Templates synced (`pnpm lumenflow:sync-templates` - ensures CLI templates match source docs)
 - [ ] CHANGELOG updated (if maintained)
 
 ### Release Steps (Automated)

package/templates/core/ai/onboarding/starting-prompt.md.template

@@ -124,6 +124,7 @@ cat {{DOCS_TASKS_PATH}}/wu/WU-XXXX.yaml
 
 # 2. Claim the WU (creates isolated worktree)
 pnpm wu:claim --id WU-XXXX --lane "Lane Name"
+pnpm wu:brief --id WU-XXXX --client <client>
 
 # 3. IMMEDIATELY cd to worktree (CRITICAL!)
 cd worktrees/<lane>-wu-xxxx
@@ -152,6 +153,7 @@ cat {{DOCS_TASKS_PATH}}/wu/WU-XXXX.yaml
 # 2. Claim in cloud mode (no worktree, sets claimed_mode: branch-pr)
 pnpm wu:claim --id WU-XXXX --lane "Lane Name" --cloud
 # Or: LUMENFLOW_CLOUD=1 pnpm wu:claim --id WU-XXXX --lane "Lane Name"
+pnpm wu:brief --id WU-XXXX --client <client>
 
 # 3. Work on the lane branch (lane/<lane>/wu-xxxx)
 
@@ -201,6 +203,7 @@ These are the mistakes agents make most often. Memorize these before reading any
 5. **State files are auto-generated.** Never manually edit `wu-events.jsonl`, `backlog.md`, or `status.md` — lifecycle commands manage them.
 6. **wu:edit requires a clean worktree.** Commit `wu-events.jsonl` and other changes before running `wu:edit`.
 7. **Don't edit on main then stash to a worktree.** If a hook blocks you on main, that means you need a WU. Create one and work in the worktree from the start.
+8. **Don't modify another agent's WU to free a lane.** `wu:block`, `wu:unblock`, `wu:release`, and `wu:recover` enforce ownership guards (v3.19.0). If you hit a `SESSION OWNERSHIP VIOLATION`, wait for the owning WU to complete or block itself — never use `--override-owner` without explicit human instruction.
 
 ---
 
@@ -476,6 +479,8 @@ pnpm wu:done --id WU-XXX
 
 Use `wu:brief` to create parallel sub-agent handoff prompts for complex WUs. Use `wu:delegate` when you also need explicit lineage recording.
 
+**MANDATORY:** You **must** run `wu:brief` explicitly after `wu:claim`. While `wu:claim` auto-records a stub event (`claim-auto`), this stub does **not** satisfy the `wu:done` evidence gate (WU-2379). Only an explicit `wu:brief` run generates the handoff prompt, checks lane occupation, validates sizing, and records proper evidence. Without it, `wu:done` will block.
+
 **Evidence recording:** `wu:brief` writes a checkpoint event to `.lumenflow/state/wu-events.jsonl` when run in a claimed workspace (worktree mode) or on the claimed lane branch (branch-pr/branch-only mode). This evidence is **required** — `wu:done` blocks feature/bug WUs without it (WU-2132). Running from an unrelated checkout/branch is side-effect-free (WU-2144). **Never delete or revert `wu-events.jsonl` entries** written by lifecycle commands — if evidence is accidentally lost, rerun `wu:brief` to recreate it.
 
 ### When to Use wu:brief
@@ -488,7 +493,7 @@ Use `wu:brief` to create parallel sub-agent handoff prompts for complex WUs. Use
 ### Choose the Correct Flow
 
 - **Delegating to a sub-agent:** Run `wu:brief` (or `wu:delegate` for lineage), then pass the generated prompt to Task tool.
-- **Implementing in current session:** Run `wu:brief --client <client>` to record evidence, then do the WU yourself. `wu:brief` always outputs full context AND records evidence.
+- **Implementing in current session:** Run `wu:brief --client <client>` to satisfy evidence policy. It outputs full WU context and records evidence in a single step.
 
 ### How to Use wu:brief / wu:delegate
 
@@ -496,9 +501,6 @@ Use `wu:brief` to create parallel sub-agent handoff prompts for complex WUs. Use
 # Generate a handoff prompt + evidence (no lineage side effect)
 pnpm wu:brief --id WU-XXXX --client <client-type>
 
-# Self-implementation: wu:brief always outputs full context AND records evidence
-pnpm wu:brief --id WU-XXXX --client <client>
-
 # Generate + record explicit delegation lineage
 pnpm wu:delegate --id WU-XXXX --parent-wu WU-YYYY --client <client-type>
 
@@ -520,14 +522,13 @@ extra project commands, or client-specific overrides.
 
 - New installs get the current defaults automatically.
 - Existing installs get the runtime defaults after `pnpm lumenflow:upgrade --latest`.
-- `pnpm lumenflow:upgrade --latest` already refreshes managed docs, onboarding docs, and configured
-  vendor assets. Use `pnpm docs:sync --vendor <type>` only for an extra targeted refresh.
+- `lumenflow:upgrade` automatically syncs onboarding docs and vendor assets (no separate `docs:sync` step needed).
 
 Default profiles:
 
 - Behavior/logic changes: follow project policy (`methodology.testing`: `tdd`, `test-after`, or `none`).
 - Structured-content-only changes (`.yaml/.yml/.json/.md/.mdx`): use parse/schema/lint/eval evidence; TDD checkpoint is omitted.
-- UI presentation hints: prefer smoke/manual/integration/E2E verification and use unit tests for pure logic or explicitly required checks.
+- UI presentation hints: prefer smoke/manual/integration/E2E verification, never assert inline styles, CSS values, exact copy, or DOM shape, and use unit tests only for pure logic or explicitly required checks.
 
 Common override points include `visual-directive`, `structured-content-directive`,
 `verification-requirements`, and `design-context-ui`.
@@ -550,22 +551,22 @@ Domain-specific commands must come from local configuration, not core framework
 
 ## WU Lifecycle Commands
 
-| Command                                        | Description                                      | When to Use                 |
-| ---------------------------------------------- | ------------------------------------------------ | --------------------------- |
-| `pnpm wu:status --id WU-XXX`                   | Show WU state and valid commands                 | Check current state         |
-| `pnpm wu:claim --id WU-XXX --lane "Lane"`      | Claim WU and create worktree (default)           | Start working (local)       |
-| `pnpm wu:claim --id WU-XXX --lane "L" --cloud` | Claim WU in branch-pr mode (no worktree)         | Start working (cloud)       |
-| `pnpm wu:edit --id WU-XXX --field value`       | Edit WU spec fields                              | Update notes/desc           |
-| `pnpm wu:brief --id WU-XXX --client <client>`  | **MANDATORY after wu:claim.** Generate prompt + evidence | Delegation or self-impl     |
-| `pnpm wu:delegate --id WU-XXX --parent-wu P`   | Generate prompt + record delegation              | Auditable delegation flows  |
-| `pnpm wu:prep --id WU-XXX`                     | Run gates in claimed workspace, prep completion  | Before wu:done              |
-| `pnpm wu:done --id WU-XXX`                     | Complete WU (merge or PR, cleanup)               | After gates pass            |
-| `pnpm wu:cleanup --id WU-XXX`                  | Post-merge cleanup (branch-pr)                   | After PR merge (cloud only) |
-| `pnpm wu:escalate --id WU-XXX`                 | Show or resolve escalation status                | Escalation-triggered WUs    |
-| `pnpm wu:escalate --resolve --id WU-XXX`       | Resolve human escalation                         | Before wu:done (escalation) |
-| `pnpm wu:verify --id WU-XXX`                   | Verify WU completion (stamp, commit, clean tree) | After wu:done               |
-| `pnpm wu:delete --id WU-XXX`                   | Delete WU spec and cleanup                       | Cancel stale/throwaway WUs  |
-| `pnpm wu:recover --id WU-XXX`                  | Fix inconsistent WU state                        | When state is broken        |
+| Command                                        | Description                                      | When to Use                       |
+| ---------------------------------------------- | ------------------------------------------------ | --------------------------------- |
+| `pnpm wu:status --id WU-XXX`                   | Show WU state and valid commands                 | Check current state               |
+| `pnpm wu:claim --id WU-XXX --lane "Lane"`      | Claim WU and create worktree (default)           | Start working (local)             |
+| `pnpm wu:claim --id WU-XXX --lane "L" --cloud` | Claim WU in branch-pr mode (no worktree)         | Start working (cloud)             |
+| `pnpm wu:edit --id WU-XXX --field value`       | Edit WU spec fields                              | Update notes/desc                 |
+| `pnpm wu:brief --id WU-XXX --client X`         | Generate handoff prompt + record evidence        | Delegation or self-implementation |
+| `pnpm wu:delegate --id WU-XXX --parent-wu P`   | Generate prompt + record delegation              | Auditable delegation flows        |
+| `pnpm wu:prep --id WU-XXX`                     | Run gates in claimed workspace, prep completion  | Before wu:done                    |
+| `pnpm wu:done --id WU-XXX`                     | Complete WU (merge or PR, cleanup)               | After gates pass                  |
+| `pnpm wu:cleanup --id WU-XXX`                  | Post-merge cleanup (branch-pr)                   | After PR merge (cloud only)       |
+| `pnpm wu:escalate --id WU-XXX`                 | Show or resolve escalation status                | Escalation-triggered WUs          |
+| `pnpm wu:escalate --resolve --id WU-XXX`       | Resolve human escalation                         | Before wu:done (escalation)       |
+| `pnpm wu:verify --id WU-XXX`                   | Verify WU completion (stamp, commit, clean tree) | After wu:done                     |
+| `pnpm wu:delete --id WU-XXX`                   | Delete WU spec and cleanup                       | Cancel stale/throwaway WUs        |
+| `pnpm wu:recover --id WU-XXX`                  | Fix inconsistent WU state                        | When state is broken              |
 
 ---
 
@@ -670,19 +671,19 @@ When initializing LumenFlow, use the `--client` flag to generate client-specific
 pnpm add -D @lumenflow/cli
 
 # Universal setup (AGENTS.md only)
-pnpm exec lumenflow
+pnpm lumenflow
 
 # Claude-specific setup
-pnpm exec lumenflow --client claude
+pnpm lumenflow --client claude
 
 # Cursor-specific setup
-pnpm exec lumenflow --client cursor
+pnpm lumenflow --client cursor
 
 # Windsurf-specific setup
-pnpm exec lumenflow --client windsurf
+pnpm lumenflow --client windsurf
 
 # All clients
-pnpm exec lumenflow --client all
+pnpm lumenflow --client all
 ```
 
 ### Adding LumenFlow to Existing Projects
@@ -694,10 +695,10 @@ Use `--merge` mode to safely add LumenFlow configuration to existing files witho
 pnpm add -D @lumenflow/cli
 
 # Merge into existing AGENTS.md (preserves your content)
-pnpm exec lumenflow --merge
+pnpm lumenflow --merge
 
 # Merge with client overlay
-pnpm exec lumenflow --merge --client claude
+pnpm lumenflow --merge --client claude
 ```
 
 The merge mode uses bounded markers (`<!-- LUMENFLOW:START -->` and `<!-- LUMENFLOW:END -->`) to safely insert and update the LumenFlow block while preserving everything else.
@@ -717,7 +718,7 @@ cp -rn /tmp/nextjs-scaffold/.* . 2>/dev/null || true
 # 3. Install and initialize LumenFlow
 pnpm install
 pnpm add -D @lumenflow/cli
-pnpm exec lumenflow --client claude --full
+pnpm lumenflow --client claude --full
 
 # 4. Clean up
 rm -rf /tmp/nextjs-scaffold
@@ -733,5 +734,5 @@ rm -rf /tmp/nextjs-scaffold
 - [troubleshooting-wu-done.md](troubleshooting-wu-done.md) - Why agents forget wu:done
 - [first-wu-mistakes.md](first-wu-mistakes.md) - Common mistakes to avoid
 - [quick-ref-commands.md](quick-ref-commands.md) - Command reference
-- [wu-sizing-guide.md](../../wu-sizing-guide.md) - Context safety and WU sizing
+- [wu-sizing-guide.md](wu-sizing-guide.md) - Context safety and WU sizing
 - [initiative-orchestration.md](initiative-orchestration.md) - Initiative orchestration, delegation, recovery

package/templates/vendors/claude/.claude/skills/initiative-management/SKILL.md.template

@@ -134,8 +134,8 @@ pnpm wu:brief --id WU-1501 --client claude-code    # Prompt generation only
 pnpm wu:delegate --id WU-1502 --parent-wu WU-1500  # Prompt + lineage recording
 pnpm wu:delegate --id WU-1503 --parent-wu WU-1500
 
-# For WUs implemented in current session:
-pnpm wu:brief --id WU-1504 --client <client>       # Full context + evidence (self-implementation)
+# For WUs implemented in current session (full context + evidence):
+pnpm wu:brief --id WU-1504 --client claude-code     # Always gives context + records evidence
 ```
 
 ### Orchestration Pattern

package/templates/vendors/claude/.claude/skills/multi-agent-coordination/SKILL.md.template

@@ -35,10 +35,10 @@ pnpm wu:brief --id WU-XXX --client claude-code      # Generate prompt only
 pnpm wu:delegate --id WU-XXX --parent-wu WU-YYY     # Generate prompt + record lineage
 ```
 
-**Use wu:brief** when you are implementing the WU yourself (it always outputs full context AND records evidence):
+**Self-implementation**: `wu:brief` always gives full context AND records evidence — use it even when implementing yourself:
 
 ```bash
-pnpm wu:brief --id WU-XXX --client <client>         # Full context + evidence recording
+pnpm wu:brief --id WU-XXX --client claude-code       # Full context + evidence (always)
 ```
 
 **DON'T use wu:brief/wu:delegate** for helper agents (code-reviewer, test-engineer) on YOUR WU.

package/templates/vendors/claude/.claude/skills/orchestration/SKILL.md.template

@@ -33,8 +33,8 @@ pnpm wu:brief --id WU-XXX --client claude-code
 # ✅ CORRECT: Use wu:delegate for lineage-tracked delegation
 pnpm wu:delegate --id WU-XXX --parent-wu WU-YYY
 
-# ✅ CORRECT: wu:brief always outputs full context AND records evidence
-pnpm wu:brief --id WU-XXX --client <client>
+# ✅ CORRECT: Use wu:brief for self-implementation (gives context + records evidence)
+pnpm wu:brief --id WU-XXX --client claude-code
 ```
 
 **❌ NEVER do this:**
@@ -46,7 +46,7 @@ pnpm wu:brief --id WU-XXX --client <client>
 **Why this matters:**
 
 1. `wu:brief` generates prompts with context loading preamble, TDD directives, and constraints block
-2. `wu:brief` always records evidence AND outputs full context (no separate evidence-only mode)
+2. `wu:brief` always records evidence AND provides full WU context (no silent mode)
 3. Sub-agents need `wu:claim` (inside generated prompts) to create proper lane locks and event tracking
 4. Direct Task spawns bypass all safety mechanisms, coordination signals, and spawn registry tracking
 

package/dist/chunk-2D2VOCA4.js

@@ -1,37 +0,0 @@
-import {
-  TEST_TYPES,
-  WU_TYPES
-} from "./chunk-V6OJGLBA.js";
-
-// ../core/dist/wu-type-helpers.js
-function isNonEmptyArray(value) {
-  return Array.isArray(value) && value.length > 0;
-}
-function isDocumentationType(type) {
-  return typeof type === "string" && type === WU_TYPES.DOCUMENTATION;
-}
-function isProcessType(type) {
-  return typeof type === "string" && type === WU_TYPES.PROCESS;
-}
-function isDocsOrProcessType(type) {
-  return isDocumentationType(type) || isProcessType(type);
-}
-function hasAnyTests(tests) {
-  if (!tests || typeof tests !== "object")
-    return false;
-  const t = tests;
-  return isNonEmptyArray(t[TEST_TYPES.MANUAL]) || isNonEmptyArray(t[TEST_TYPES.UNIT]) || isNonEmptyArray(t[TEST_TYPES.E2E]) || isNonEmptyArray(t[TEST_TYPES.INTEGRATION]);
-}
-function hasManualTests(tests) {
-  if (!tests || typeof tests !== "object")
-    return false;
-  const t = tests;
-  return isNonEmptyArray(t[TEST_TYPES.MANUAL]);
-}
-
-export {
-  isDocumentationType,
-  isDocsOrProcessType,
-  hasAnyTests,
-  hasManualTests
-};

package/dist/chunk-2D5KFYGX.js

@@ -1,284 +0,0 @@
-import {
-  DomainPackManifestSchema,
-  PACK_MANIFEST_FILE_NAME,
-  UTF8_ENCODING,
-  computeDeterministicPackHash,
-  isBroadWildcardScopePattern,
-  resolvePackToolEntryPath,
-  validateDomainPackToolSafety,
-  validatePackImportBoundaries
-} from "./chunk-HANJXVKW.js";
-import {
-  WU_OPTIONS,
-  createWUParser,
-  runCLI
-} from "./chunk-2GXVIN57.js";
-
-// src/pack-validate.ts
-import { readFile } from "fs/promises";
-import { join, resolve } from "path";
-import YAML from "yaml";
-var LOG_PREFIX = "[pack:validate]";
-var DEFAULT_PACKS_ROOT = "packages/@lumenflow/packs";
-var HTTPS_PROTOCOL = "https:";
-var NETWORK_URL_PROPERTY = "url";
-var SECURITY_LINT_ERROR = {
-  PERMISSION_SCOPE_READ_WRITE: "permission/scope mismatch: read-permission tool cannot request write path access.",
-  PERMISSION_SCOPE_WRITE_MISSING: "permission/scope mismatch: write-permission tool must include at least one write path scope.",
-  WILDCARD_WRITE: "forbidden wildcard write scope. Replace with constrained path pattern (for example reports/**/*.md).",
-  NETWORK_URL_REQUIRED: "network-scoped tools must constrain input_schema.properties.url via const/enum https URL allow-list.",
-  NETWORK_URL_INVALID: "network-scoped tool has invalid URL in input_schema.properties.url.",
-  NETWORK_URL_SCHEME: "network-scoped tool URL must use https:// in input_schema.properties.url."
-};
-async function validatePack(options) {
-  const { packRoot, hashExclusions } = options;
-  const absolutePackRoot = resolve(packRoot);
-  let manifest;
-  const manifestResult = await validateManifest(absolutePackRoot);
-  if (manifestResult.status === "pass" && manifestResult.manifest) {
-    manifest = manifestResult.manifest;
-  }
-  const toolEntriesResult = manifest ? validateToolEntries(absolutePackRoot, manifest) : { status: "skip", error: "Skipped: manifest validation failed" };
-  const importBoundariesResult = await checkImportBoundaries(absolutePackRoot, hashExclusions);
-  const securityLintResult = manifest ? runSecurityLint(manifest) : { status: "skip", error: "Skipped: manifest validation failed" };
-  const integrityResult = await computeIntegrity(absolutePackRoot, hashExclusions);
-  const allPassed = manifestResult.status === "pass" && toolEntriesResult.status === "pass" && importBoundariesResult.status === "pass" && securityLintResult.status === "pass" && integrityResult.status === "pass";
-  return {
-    manifest: manifestResult,
-    importBoundaries: importBoundariesResult,
-    toolEntries: toolEntriesResult,
-    securityLint: securityLintResult,
-    integrity: integrityResult,
-    allPassed
-  };
-}
-async function validateManifest(packRoot) {
-  try {
-    const manifestPath = join(packRoot, PACK_MANIFEST_FILE_NAME);
-    const manifestRaw = await readFile(manifestPath, UTF8_ENCODING);
-    const parsed = YAML.parse(manifestRaw);
-    const manifest = DomainPackManifestSchema.parse(parsed);
-    return { status: "pass", manifest };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { status: "fail", error: message };
-  }
-}
-function validateToolEntries(packRoot, manifest) {
-  try {
-    for (const tool of manifest.tools) {
-      resolvePackToolEntryPath(packRoot, tool.entry);
-    }
-    return { status: "pass" };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { status: "fail", error: message };
-  }
-}
-async function checkImportBoundaries(packRoot, hashExclusions) {
-  try {
-    await validatePackImportBoundaries(packRoot, hashExclusions);
-    return { status: "pass" };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { status: "fail", error: message };
-  }
-}
-async function computeIntegrity(packRoot, hashExclusions) {
-  try {
-    const hash = await computeDeterministicPackHash({
-      packRoot,
-      exclusions: hashExclusions
-    });
-    return { status: "pass", hash };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { status: "fail", error: message };
-  }
-}
-function isObjectRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function extractNetworkUrls(tool) {
-  const inputSchema = tool.input_schema;
-  if (!isObjectRecord(inputSchema)) {
-    return [];
-  }
-  const properties = inputSchema.properties;
-  if (!isObjectRecord(properties)) {
-    return [];
-  }
-  const urlSchema = properties[NETWORK_URL_PROPERTY];
-  if (!isObjectRecord(urlSchema)) {
-    return [];
-  }
-  if (typeof urlSchema.const === "string") {
-    return [urlSchema.const];
-  }
-  if (!Array.isArray(urlSchema.enum)) {
-    return [];
-  }
-  return urlSchema.enum.filter((candidate) => typeof candidate === "string");
-}
-function lintPermissionScopeConsistency(tool) {
-  const pathScopes = tool.required_scopes.filter(
-    (scope) => scope.type === "path"
-  );
-  const hasWritePathScope = pathScopes.some((scope) => scope.access === "write");
-  const issues = [];
-  if (tool.permission === "read" && hasWritePathScope) {
-    issues.push(SECURITY_LINT_ERROR.PERMISSION_SCOPE_READ_WRITE);
-  }
-  if (tool.permission === "write" && pathScopes.length > 0 && !hasWritePathScope) {
-    issues.push(SECURITY_LINT_ERROR.PERMISSION_SCOPE_WRITE_MISSING);
-  }
-  return issues;
-}
-function runSecurityLint(manifest) {
-  const issues = /* @__PURE__ */ new Set();
-  for (const tool of manifest.tools) {
-    for (const issue of lintPermissionScopeConsistency(tool)) {
-      issues.add(`Tool "${tool.name}": ${issue}`);
-    }
-    for (const issue of validateDomainPackToolSafety(tool)) {
-      issues.add(`Tool "${tool.name}": ${issue}`);
-    }
-    const hasNetworkScope = tool.required_scopes.some((scope) => scope.type === "network");
-    for (const scope of tool.required_scopes) {
-      if (scope.type !== "path") {
-        continue;
-      }
-      if ((tool.permission === "write" || tool.permission === "admin") && scope.access === "write" && isBroadWildcardScopePattern(scope.pattern)) {
-        issues.add(`Tool "${tool.name}": ${SECURITY_LINT_ERROR.WILDCARD_WRITE}`);
-      }
-    }
-    if (!hasNetworkScope) {
-      continue;
-    }
-    const allowedUrls = extractNetworkUrls(tool);
-    if (allowedUrls.length === 0) {
-      issues.add(`Tool "${tool.name}": ${SECURITY_LINT_ERROR.NETWORK_URL_REQUIRED}`);
-      continue;
-    }
-    for (const allowedUrl of allowedUrls) {
-      let parsedUrl;
-      try {
-        parsedUrl = new URL(allowedUrl);
-      } catch {
-        issues.add(
-          `Tool "${tool.name}" URL "${allowedUrl}": ${SECURITY_LINT_ERROR.NETWORK_URL_INVALID}`
-        );
-        continue;
-      }
-      if (parsedUrl.protocol !== HTTPS_PROTOCOL) {
-        issues.add(
-          `Tool "${tool.name}" URL "${allowedUrl}": ${SECURITY_LINT_ERROR.NETWORK_URL_SCHEME}`
-        );
-      }
-    }
-  }
-  if (issues.size > 0) {
-    return {
-      status: "fail",
-      error: [...issues].join("\n")
-    };
-  }
-  return { status: "pass" };
-}
-var CHECK_LABELS = {
-  manifest: "Manifest schema",
-  importBoundaries: "Import boundaries",
-  toolEntries: "Tool entry resolution",
-  securityLint: "Security lint",
-  integrity: "Integrity hash"
-};
-var STATUS_INDICATORS = {
-  pass: "PASS",
-  fail: "FAIL",
-  skip: "SKIP"
-};
-function formatValidationReport(result) {
-  const lines = [];
-  lines.push("Pack Validation Report");
-  lines.push("=====================");
-  lines.push("");
-  const checks = [
-    ["manifest", result.manifest],
-    ["importBoundaries", result.importBoundaries],
-    ["toolEntries", result.toolEntries],
-    ["securityLint", result.securityLint],
-    ["integrity", result.integrity]
-  ];
-  for (const [key, check] of checks) {
-    const label = CHECK_LABELS[key];
-    const indicator = STATUS_INDICATORS[check.status];
-    lines.push(`  [${indicator}] ${label}`);
-    if (check.status === "fail" && check.error) {
-      lines.push(`         Error: ${check.error}`);
-    }
-    if (key === "integrity" && "hash" in check && check.hash) {
-      lines.push(`         Hash: sha256:${check.hash}`);
-    }
-  }
-  lines.push("");
-  lines.push(`Result: ${result.allPassed ? "ALL CHECKS PASSED" : "VALIDATION FAILED"}`);
-  return lines.join("\n");
-}
-var PACK_VALIDATE_OPTIONS = {
-  packId: {
-    name: "id",
-    flags: "--id <packId>",
-    description: "Pack ID to validate (resolves under --packs-root)"
-  },
-  packsRoot: {
-    name: "packsRoot",
-    flags: "--packs-root <dir>",
-    description: `Root directory containing packs (default: "${DEFAULT_PACKS_ROOT}")`
-  },
-  packRoot: {
-    name: "packRoot",
-    flags: "--pack-root <dir>",
-    description: "Direct path to pack directory (overrides --id and --packs-root)"
-  }
-};
-async function main() {
-  const opts = createWUParser({
-    name: "pack-validate",
-    description: "Validate a LumenFlow domain pack for integrity",
-    options: [
-      PACK_VALIDATE_OPTIONS.packId,
-      PACK_VALIDATE_OPTIONS.packsRoot,
-      PACK_VALIDATE_OPTIONS.packRoot,
-      WU_OPTIONS.force
-    ]
-  });
-  const packId = opts.id;
-  const packsRoot = opts.packsRoot ?? DEFAULT_PACKS_ROOT;
-  const directPackRoot = opts.packRoot;
-  let resolvedPackRoot;
-  if (directPackRoot) {
-    resolvedPackRoot = resolve(directPackRoot);
-  } else if (packId) {
-    resolvedPackRoot = resolve(packsRoot, packId);
-  } else {
-    console.error(`${LOG_PREFIX} Error: Provide --id <packId> or --pack-root <dir>`);
-    process.exit(1);
-  }
-  console.log(`${LOG_PREFIX} Validating pack at: ${resolvedPackRoot}`);
-  const result = await validatePack({ packRoot: resolvedPackRoot });
-  const report = formatValidationReport(result);
-  console.log(report);
-  if (!result.allPassed) {
-    process.exit(1);
-  }
-}
-if (import.meta.main) {
-  void runCLI(main);
-}
-
-export {
-  LOG_PREFIX,
-  validatePack,
-  formatValidationReport,
-  main
-};