@nimiplatform/nimi-coding 0.3.1 → 0.4.0

package/cli/lib/internal/governance/config.mjs

@@ -23,49 +23,13 @@ function normalizeGovernanceConfig(parsed) {
   }
 
   const profileId = typeof parsed.profile_id === "string" ? parsed.profile_id.trim() : null;
-  const specGovernance = isPlainObject(parsed.spec_governance) ? parsed.spec_governance : {};
   const aiGovernance = isPlainObject(parsed.ai_governance) ? parsed.ai_governance : {};
   const agentsFreshness = isPlainObject(aiGovernance.agents_freshness)
     ? aiGovernance.agents_freshness
     : {};
 
-  function normalizeCommandMap(section) {
-    if (!isPlainObject(section)) {
-      return {};
-    }
-
-    const output = {};
-    for (const [key, value] of Object.entries(section)) {
-      if (Array.isArray(value)) {
-        output[key] = value.map((entry) => String(entry || "").trim()).filter(Boolean);
-      } else if (typeof value === "string" && value.trim().length > 0) {
-        output[key] = [value.trim()];
-      }
-    }
-    return output;
-  }
-
   const normalized = {
     profileId,
-    specGovernance: {
-      canonicalRoot: typeof specGovernance.canonical_root === "string"
-        ? specGovernance.canonical_root.trim()
-        : ".nimi/spec",
-      domainChecks: isPlainObject(specGovernance.domain_checks)
-        ? specGovernance.domain_checks
-        : {},
-      validateCommands: normalizeCommandMap(specGovernance.validate_commands),
-      generateCommands: normalizeCommandMap(specGovernance.generate_commands),
-      singleSource: isPlainObject(specGovernance.single_source)
-        ? specGovernance.single_source
-        : {},
-      realmAlignment: isPlainObject(specGovernance.realm_alignment)
-        ? specGovernance.realm_alignment
-        : {},
-      legacyVocabulary: isPlainObject(specGovernance.legacy_vocabulary)
-        ? specGovernance.legacy_vocabulary
-        : {},
-    },
     aiGovernance: {
       agentsFreshness: {
         targets: Array.isArray(agentsFreshness.targets)

package/cli/lib/shared.mjs

@@ -1,22 +1,16 @@
 export {
-  buildBlueprintAuditPayload,
-  formatBlueprintAuditPayload,
-  writeBlueprintAuditArtifact,
-} from "./blueprint-audit.mjs";
-export {
+  appendGitattributesEntries,
   appendGitignoreEntries,
+  hasExactGitignoreRule,
+  hasExactTextLine,
+  ManagedPathError,
+  ManagedTextError,
+  normalizeTextToLf,
   pathExists,
+  preflightManagedProjectPaths,
   readTextIfFile,
+  readUtf8FileFatal,
 } from "./fs-helpers.mjs";
-export {
-  mergeOrderedPaths,
-  parsePathRequirements,
-  parseSkillSection,
-  parseYamlText,
-  readTopLevelKeys,
-  readYamlList,
-  readYamlScalar,
-} from "./yaml-helpers.mjs";
 export {
   integrateEntrypoints,
   previewEntrypointIntegration,
@@ -24,18 +18,11 @@ export {
   removeManagedEntrypoints,
 } from "./entrypoints.mjs";
 export {
-  inspectBootstrapCompatibility,
   previewBootstrapRemoval,
   previewBootstrapWrites,
   removeManagedBootstrapFiles,
   writeMissingBootstrapFiles,
 } from "./bootstrap.mjs";
-export {
-  loadBlueprintReference,
-  loadSpecGenerationAuditContract,
-  loadSpecGenerationInputsConfig,
-  loadSpecGenerationInputsContract,
-} from "./contracts.mjs";
 export {
   formatDoctorResult,
   inspectDoctorState,

package/cli/lib/sync.mjs

@@ -1,8 +1,9 @@
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { getBootstrapSeedEntries } from "../seeds/bootstrap.mjs";
-import { pathExists, readTextIfFile } from "./fs-helpers.mjs";
+import { getBootstrapSeedEntries, loadSeedPolicy } from "../seeds/bootstrap.mjs";
+import { inspectEntrypointIntegration, integrateEntrypoints } from "./entrypoints.mjs";
+import { normalizeTextToLf, pathExists, preflightManagedProjectPaths } from "./fs-helpers.mjs";
 
 export const SYNC_MODE = {
   DRY_RUN: "dry_run",
@@ -16,88 +17,91 @@ const STATUS = {
   UPDATED: "updated",
   WOULD_CREATE: "would_create",
   WOULD_UPDATE: "would_update",
-  DRIFTED_PRESERVED: "drifted_preserved",
   MISSING_PACKAGE_CANONICAL: "missing_package_canonical",
-  MISSING_HOST_STATE_SEED: "missing_host_state_seed",
   DRIFTED_PACKAGE_CANONICAL: "drifted_package_canonical",
+  MANAGED_BLOCK_DRIFT: "managed_block_drift",
+  DEPRECATED_PROJECTION_PATH: "deprecated_projection_path",
 };
 
-const HOST_OWNED_SEED_OWNERSHIPS = new Set(["host_state_seed", "host_profile_override"]);
-
-async function evaluateSeedEntry(projectRoot, entry, mode) {
+async function inspectProjection(projectRoot, entry) {
   const absolutePath = path.join(projectRoot, entry.outputRelativePath);
+  const projectionContent = normalizeTextToLf(entry.content);
   const info = await pathExists(absolutePath);
-  const fileExists = Boolean(info && info.isFile());
+  if (!info) return { ...entry, absolutePath, projectionContent, state: "missing" };
+  const actual = await readFile(absolutePath);
+  return { ...entry, absolutePath, projectionContent, state: actual.equals(Buffer.from(projectionContent, "utf8")) ? "in_sync" : "drifted" };
+}
 
-  if (!fileExists) {
-    if (mode === SYNC_MODE.APPLY) {
-      await mkdir(path.dirname(absolutePath), { recursive: true });
-      await writeFile(absolutePath, entry.content, "utf8");
-      return {
-        outputRelativePath: entry.outputRelativePath,
-        ownership: entry.ownership,
-        status: STATUS.CREATED,
-        detail: "missing host file was seeded from package source",
-      };
-    }
-    return {
-      outputRelativePath: entry.outputRelativePath,
-      ownership: entry.ownership,
-      status: HOST_OWNED_SEED_OWNERSHIPS.has(entry.ownership)
-        ? STATUS.MISSING_HOST_STATE_SEED
-        : STATUS.MISSING_PACKAGE_CANONICAL,
-      detail: mode === SYNC_MODE.CHECK
-        ? "host file is missing"
-        : "host file is missing and would be seeded on --apply",
-    };
+function projectionResult(entry, mode, applied = false) {
+  if (entry.state === "in_sync") {
+    return { outputRelativePath: entry.outputRelativePath, ownership: entry.ownership, status: STATUS.IN_SYNC, detail: "projection matches LF-normalized package canonical text" };
   }
-
-  const actual = await readTextIfFile(absolutePath);
-  if (actual === entry.content) {
+  if (applied) {
     return {
       outputRelativePath: entry.outputRelativePath,
       ownership: entry.ownership,
-      status: STATUS.IN_SYNC,
-      detail: "host file matches package source byte-for-byte",
+      status: entry.state === "missing" ? STATUS.CREATED : STATUS.UPDATED,
+      detail: entry.state === "missing" ? "created LF-normalized package-owned projection" : "restored LF-normalized package-owned projection",
     };
   }
+  const status = entry.state === "missing"
+    ? mode === SYNC_MODE.CHECK ? STATUS.MISSING_PACKAGE_CANONICAL : STATUS.WOULD_CREATE
+    : mode === SYNC_MODE.CHECK ? STATUS.DRIFTED_PACKAGE_CANONICAL : STATUS.WOULD_UPDATE;
+  return { outputRelativePath: entry.outputRelativePath, ownership: entry.ownership, status, detail: entry.state === "missing" ? "LF-normalized package-owned projection is missing" : "projection diverges from LF-normalized package canonical text" };
+}
 
-  if (HOST_OWNED_SEED_OWNERSHIPS.has(entry.ownership)) {
-    return {
-      outputRelativePath: entry.outputRelativePath,
-      ownership: entry.ownership,
-      status: STATUS.DRIFTED_PRESERVED,
-      detail: `${entry.ownership}: host owns canonical content; sync preserves host copy`,
-    };
-  }
+async function applyProjection(entry) {
+  await mkdir(path.dirname(entry.absolutePath), { recursive: true });
+  await writeFile(entry.absolutePath, normalizeTextToLf(entry.projectionContent ?? entry.content), "utf8");
+}
 
-  if (mode === SYNC_MODE.APPLY) {
-    await writeFile(absolutePath, entry.content, "utf8");
-    return {
-      outputRelativePath: entry.outputRelativePath,
-      ownership: entry.ownership,
-      status: STATUS.UPDATED,
-      detail: "drifted package_canonical file rewritten to package source",
-    };
+function managedBlockResult(state, mode, applied = false) {
+  if (!state.changed) {
+    return { outputRelativePath: `${state.relativePath}#nimicoding-managed-block`, ownership: "package_managed_block", status: STATUS.IN_SYNC, detail: "managed block matches package instructions" };
   }
-
   return {
-    outputRelativePath: entry.outputRelativePath,
-    ownership: entry.ownership,
-    status: mode === SYNC_MODE.CHECK
-      ? STATUS.DRIFTED_PACKAGE_CANONICAL
-      : STATUS.WOULD_UPDATE,
-    detail: "host file diverges from package_canonical source",
+    outputRelativePath: `${state.relativePath}#nimicoding-managed-block`,
+    ownership: "package_managed_block",
+    status: applied ? STATUS.UPDATED : mode === SYNC_MODE.CHECK ? STATUS.MANAGED_BLOCK_DRIFT : STATUS.WOULD_UPDATE,
+    detail: "managed block is missing or drifted; host-owned text outside the block is not inspected",
   };
 }
 
-export async function runSeedSync(projectRoot, mode = SYNC_MODE.DRY_RUN) {
-  const entries = await getBootstrapSeedEntries();
+async function inspectDeprecatedPaths(projectRoot) {
+  const policy = await loadSeedPolicy();
   const results = [];
-  for (const entry of entries) {
-    results.push(await evaluateSeedEntry(projectRoot, entry, mode));
+  for (const ref of policy.deprecatedProjections) {
+    if (await pathExists(path.join(projectRoot, ref))) {
+      results.push({
+        outputRelativePath: ref,
+        ownership: "deprecated_package_projection",
+        status: STATUS.DEPRECATED_PROJECTION_PATH,
+        detail: "deprecated package projection must be removed by the host; sync does not delete host files",
+      });
+    }
+  }
+  return results;
+}
+
+export async function runSeedSync(projectRoot, mode = SYNC_MODE.DRY_RUN) {
+  await preflightManagedProjectPaths(projectRoot);
+  const seedEntries = await getBootstrapSeedEntries();
+  const projectionStates = [];
+  for (const entry of seedEntries) projectionStates.push(await inspectProjection(projectRoot, entry));
+  const blockStates = await inspectEntrypointIntegration(projectRoot);
+  const deprecatedResults = await inspectDeprecatedPaths(projectRoot);
+
+  const mayApply = mode === SYNC_MODE.APPLY && deprecatedResults.length === 0;
+  if (mayApply) {
+    for (const state of projectionStates) if (state.state !== "in_sync") await applyProjection(state);
+    if (blockStates.some((state) => state.changed)) await integrateEntrypoints(projectRoot);
   }
 
+  const results = [
+    ...projectionStates.map((state) => projectionResult(state, mode, mayApply && state.state !== "in_sync")),
+    ...blockStates.map((state) => managedBlockResult(state, mode, mayApply && state.changed)),
+    ...deprecatedResults,
+  ];
   const summary = {
     total: results.length,
     in_sync: 0,
@@ -105,39 +109,24 @@ export async function runSeedSync(projectRoot, mode = SYNC_MODE.DRY_RUN) {
     updated: 0,
     would_create: 0,
     would_update: 0,
-    drifted_preserved: 0,
-    missing_host_state_seed: 0,
     missing_package_canonical: 0,
     drifted_package_canonical: 0,
+    managed_block_drift: 0,
+    deprecated_projection_path: 0,
   };
-
-  for (const result of results) {
-    summary[result.status] = (summary[result.status] ?? 0) + 1;
-  }
-
-  // Re-derive dry-run status counters when no apply happened.
-  if (mode === SYNC_MODE.DRY_RUN) {
-    summary.would_create = results.filter((r) =>
-      r.status === STATUS.MISSING_HOST_STATE_SEED || r.status === STATUS.MISSING_PACKAGE_CANONICAL,
-    ).length;
-    summary.would_update = results.filter((r) => r.status === STATUS.WOULD_UPDATE).length;
-  }
-
-  const checkFailures = mode === SYNC_MODE.CHECK
-    ? results.filter((r) =>
-      r.status === STATUS.MISSING_PACKAGE_CANONICAL
-      || r.status === STATUS.MISSING_HOST_STATE_SEED
-      || r.status === STATUS.DRIFTED_PACKAGE_CANONICAL,
-    )
-    : [];
-
-  return {
-    mode,
-    summary,
-    results,
-    ok: mode === SYNC_MODE.CHECK ? checkFailures.length === 0 : true,
-    checkFailures,
-  };
+  for (const result of results) summary[result.status] = (summary[result.status] ?? 0) + 1;
+
+  const checkFailureStatuses = new Set([
+    STATUS.MISSING_PACKAGE_CANONICAL,
+    STATUS.DRIFTED_PACKAGE_CANONICAL,
+    STATUS.MANAGED_BLOCK_DRIFT,
+    STATUS.DEPRECATED_PROJECTION_PATH,
+  ]);
+  const checkFailures = results.filter((result) =>
+    result.status === STATUS.DEPRECATED_PROJECTION_PATH
+    || (mode === SYNC_MODE.CHECK && checkFailureStatuses.has(result.status)),
+  );
+  return { mode, summary, results, ok: checkFailures.length === 0, checkFailures };
 }
 
 export const SYNC_RESULT_STATUS = STATUS;

package/cli/lib/value-helpers.mjs

@@ -1,29 +1,3 @@
-export function arraysEqual(left, right) {
-  return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-
 export function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-
-export function isIsoUtcTimestamp(value) {
-  if (typeof value !== "string") {
-    return false;
-  }
-
-  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value)) {
-    return false;
-  }
-
-  const parsed = new Date(value);
-  const canonicalValue = value.includes(".") ? value : value.replace("Z", ".000Z");
-  return !Number.isNaN(parsed.getTime()) && parsed.toISOString() === canonicalValue;
-}
-
-export function toStringArray(value) {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-
-  return value.map((entry) => String(entry));
-}

package/cli/lib/yaml-helpers.mjs

@@ -1,133 +1,10 @@
-import { readFile } from "node:fs/promises";
-
 import YAML from "yaml";
 
-import { pathExists } from "./fs-helpers.mjs";
-import { isPlainObject, toStringArray } from "./value-helpers.mjs";
-
-function findFirstMatchingKey(node, targetKey) {
-  if (Array.isArray(node)) {
-    for (const entry of node) {
-      const found = findFirstMatchingKey(entry, targetKey);
-      if (found !== undefined) {
-        return found;
-      }
-    }
-    return undefined;
-  }
-
-  if (!isPlainObject(node)) {
-    return undefined;
-  }
-
-  if (Object.prototype.hasOwnProperty.call(node, targetKey)) {
-    return node[targetKey];
-  }
-
-  for (const value of Object.values(node)) {
-    const found = findFirstMatchingKey(value, targetKey);
-    if (found !== undefined) {
-      return found;
-    }
-  }
-
-  return undefined;
-}
-
 export function parseYamlText(text) {
-  if (!text) {
-    return null;
-  }
-
+  if (!text) return null;
   try {
     return YAML.parse(text);
   } catch {
     return null;
   }
 }
-
-export async function loadYamlFile(filePath) {
-  const info = await pathExists(filePath);
-  if (!info || !info.isFile()) {
-    return null;
-  }
-
-  try {
-    return YAML.parse(await readFile(filePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-export function readYamlScalar(text, key) {
-  const parsed = parseYamlText(text);
-  const value = findFirstMatchingKey(parsed, key);
-
-  if (value === undefined || value === null || isPlainObject(value) || Array.isArray(value)) {
-    return null;
-  }
-
-  return String(value);
-}
-
-export function readYamlList(text, key) {
-  const parsed = parseYamlText(text);
-  const value = findFirstMatchingKey(parsed, key);
-  return toStringArray(value);
-}
-
-export function mergeOrderedPaths(...groups) {
-  const merged = [];
-
-  for (const group of groups) {
-    for (const entry of group) {
-      if (entry && !merged.includes(entry)) {
-        merged.push(entry);
-      }
-    }
-  }
-
-  return merged;
-}
-
-export function parseSkillSection(text, sectionKey) {
-  const parsed = parseYamlText(text);
-  const section = parsed?.[sectionKey];
-
-  if (!Array.isArray(section)) {
-    return [];
-  }
-
-  return section.map((entry) => ({
-    ...entry,
-    id: typeof entry?.id === "string" ? entry.id : null,
-    inputs: Array.isArray(entry?.inputs) ? entry.inputs.map((item) => String(item)) : [],
-    required: entry?.required === undefined ? undefined : String(entry.required),
-    source: entry?.source === undefined ? undefined : String(entry.source),
-    purpose: entry?.purpose === undefined ? undefined : String(entry.purpose),
-    result_contract_ref: entry?.result_contract_ref === undefined ? undefined : String(entry.result_contract_ref),
-  })).filter((entry) => entry.id);
-}
-
-export function parsePathRequirements(text, sectionKey) {
-  const parsed = parseYamlText(text);
-  const section = parsed?.[sectionKey];
-
-  if (!Array.isArray(section)) {
-    return [];
-  }
-
-  return section
-    .filter((entry) => isPlainObject(entry) && typeof entry.path === "string")
-    .map((entry) => ({
-      path: entry.path,
-      required_top_level_keys: Array.isArray(entry.required_top_level_keys)
-        ? entry.required_top_level_keys.map((item) => String(item))
-        : [],
-    }));
-}
-
-export function readTopLevelKeys(text) {
-  const parsed = parseYamlText(text);
-  return isPlainObject(parsed) ? Object.keys(parsed) : [];
-}

package/cli/seeds/bootstrap.mjs

@@ -1,4 +1,4 @@
-import { readFile, readdir } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -6,96 +6,46 @@ import YAML from "yaml";
 
 const PACKAGE_ROOT = fileURLToPath(new URL("../..", import.meta.url));
 const POLICY_PATH = fileURLToPath(new URL("./seed-policy.yaml", import.meta.url));
-
-const SUPPORTED_OWNERSHIP = new Set(["package_canonical", "host_state_seed", "host_profile_override"]);
-
 let cachedPolicy = null;
 
-function toPortableRelativePath(filePath) {
-  return filePath.split(path.sep).join("/");
+function portable(value) {
+  return value.split(path.sep).join(path.posix.sep);
 }
 
-async function loadPolicy() {
-  if (cachedPolicy) {
-    return cachedPolicy;
-  }
-
-  const text = await readFile(POLICY_PATH, "utf8");
-  const parsed = YAML.parse(text);
-
-  if (!parsed || typeof parsed !== "object") {
-    throw new Error(`seed policy at ${POLICY_PATH} is not a valid YAML object`);
+function admittedRelativePath(value, label) {
+  if (typeof value !== "string" || !value || path.posix.isAbsolute(value) || value.startsWith("./") || value.split("/").includes("..") || path.posix.normalize(value) !== value) {
+    throw new Error(`seed policy ${label} must be a portable relative path`);
   }
+  return value;
+}
 
-  if (!Array.isArray(parsed.projections) || parsed.projections.length === 0) {
-    throw new Error("seed policy is missing required `projections` list");
+async function loadPolicy() {
+  if (cachedPolicy) return cachedPolicy;
+  const parsed = YAML.parse(await readFile(POLICY_PATH, "utf8"));
+  if (parsed?.policy_id !== "nimicoding.seed-projection.v3" || !Array.isArray(parsed.projections) || parsed.projections.length !== 1) {
+    throw new Error("seed policy must declare the v3 exact projection registry");
   }
 
-  const projections = parsed.projections.map((projection) => {
-    if (!projection || typeof projection.source_dir !== "string" || typeof projection.output_dir !== "string") {
-      throw new Error("seed policy projection entries must declare source_dir and output_dir strings");
-    }
-    return { sourceDir: projection.source_dir, outputDir: projection.output_dir };
+  const seenOutput = new Set();
+  const projections = parsed.projections.map((entry) => {
+    const sourceRelativePath = admittedRelativePath(entry?.source, "source");
+    const outputRelativePath = admittedRelativePath(entry?.output, "output");
+    if (!outputRelativePath.startsWith(".nimi/")) throw new Error(`seed policy output must stay below .nimi: ${outputRelativePath}`);
+    if (entry?.ownership !== "package_canonical") throw new Error(`seed policy ownership is unsupported: ${entry?.ownership}`);
+    if (typeof entry?.downstream_consumer !== "string" || !entry.downstream_consumer.trim()) throw new Error(`seed policy entry requires a downstream consumer: ${sourceRelativePath}`);
+    if (seenOutput.has(outputRelativePath)) throw new Error(`seed policy contains duplicate output: ${outputRelativePath}`);
+    seenOutput.add(outputRelativePath);
+    return { sourceRelativePath, outputRelativePath, ownership: entry.ownership, downstreamConsumer: entry.downstream_consumer };
   });
 
-  const defaultOwnership = parsed.default_ownership ?? "package_canonical";
-  if (!SUPPORTED_OWNERSHIP.has(defaultOwnership)) {
-    throw new Error(`seed policy declares unsupported default_ownership: ${defaultOwnership}`);
-  }
-
-  const excludedRaw = Array.isArray(parsed.excluded_projection) ? parsed.excluded_projection : [];
-  const excludedSourceRelativePaths = new Set(excludedRaw.map((entry) => String(entry)));
-
-  const overrideEntries = Array.isArray(parsed.ownership_overrides) ? parsed.ownership_overrides : [];
-  const ownershipByOutputPath = new Map();
-  for (const entry of overrideEntries) {
-    if (!entry || typeof entry.path !== "string" || typeof entry.ownership !== "string") {
-      throw new Error("seed policy ownership_overrides entries must declare path and ownership strings");
-    }
-    if (!SUPPORTED_OWNERSHIP.has(entry.ownership)) {
-      throw new Error(`seed policy ownership override at ${entry.path} declares unsupported ownership: ${entry.ownership}`);
-    }
-    ownershipByOutputPath.set(entry.path, entry.ownership);
+  const deprecatedProjections = (parsed.deprecated_projections ?? []).map((entry) => admittedRelativePath(entry, "deprecated projection"));
+  if (new Set(deprecatedProjections).size !== deprecatedProjections.length || deprecatedProjections.some((entry) => seenOutput.has(entry))) {
+    throw new Error("seed policy deprecated projections must be unique and disjoint from current projections");
   }
-
-  cachedPolicy = {
-    policyId: parsed.policy_id ?? null,
-    projections,
-    defaultOwnership,
-    excludedSourceRelativePaths,
-    ownershipByOutputPath,
-  };
+  cachedPolicy = { policyId: parsed.policy_id, projections, deprecatedProjections: deprecatedProjections.sort() };
   return cachedPolicy;
 }
 
-async function collectProjectedEntries(policy, projection, rootPath, currentPath, entries) {
-  const directoryEntries = await readdir(currentPath, { withFileTypes: true });
-  for (const entry of directoryEntries) {
-    const absolutePath = path.join(currentPath, entry.name);
-    if (entry.isDirectory()) {
-      await collectProjectedEntries(policy, projection, rootPath, absolutePath, entries);
-      continue;
-    }
-
-    const relativeFromSourceRoot = toPortableRelativePath(path.relative(rootPath, absolutePath));
-    const sourceRelativePath = `${projection.sourceDir}/${relativeFromSourceRoot}`;
-    if (policy.excludedSourceRelativePaths.has(sourceRelativePath)) {
-      continue;
-    }
-
-    const outputRelativePath = `${projection.outputDir}/${relativeFromSourceRoot}`;
-    const ownership = policy.ownershipByOutputPath.get(outputRelativePath) ?? policy.defaultOwnership;
-    const content = await readFile(absolutePath, "utf8");
-    entries.push({
-      outputRelativePath,
-      sourceRelativePath,
-      sourceAbsolutePath: absolutePath,
-      content,
-      ownership,
-    });
-  }
-}
-
 export async function loadSeedPolicy() {
   return loadPolicy();
 }
@@ -103,21 +53,15 @@ export async function loadSeedPolicy() {
 export async function getBootstrapSeedEntries() {
   const policy = await loadPolicy();
   const entries = [];
-
   for (const projection of policy.projections) {
-    const sourceRoot = path.join(PACKAGE_ROOT, projection.sourceDir);
-    await collectProjectedEntries(policy, projection, sourceRoot, sourceRoot, entries);
+    const sourceAbsolutePath = path.resolve(PACKAGE_ROOT, projection.sourceRelativePath);
+    if (portable(path.relative(PACKAGE_ROOT, sourceAbsolutePath)) !== projection.sourceRelativePath) throw new Error(`seed source escapes package: ${projection.sourceRelativePath}`);
+    entries.push({ ...projection, sourceAbsolutePath, content: await readFile(sourceAbsolutePath, "utf8") });
   }
-
-  entries.sort((a, b) => a.outputRelativePath.localeCompare(b.outputRelativePath));
   return entries;
 }
 
 export async function createBootstrapSeedFileMap() {
   const entries = await getBootstrapSeedEntries();
-  const seedMap = new Map();
-  for (const entry of entries) {
-    seedMap.set(entry.outputRelativePath, entry.content);
-  }
-  return seedMap;
+  return new Map(entries.map((entry) => [entry.outputRelativePath, entry.content]));
 }