@sdd-method/maintain-cli 0.0.0-stage → 0.1.0

package/dist/lib/context-pull/resolve.js

@@ -0,0 +1,70 @@
+/**
+ * Code-repo SDD-source resolution for `sdd-cli context pull` (M-ADR 0128 §1,
+ * M-ADR 0150 §4.4 Phase D).
+ *
+ * A code repository has no `.sdd-repo-kind`, no lock and no bundle, so nothing
+ * in it names the SDD that specifies it. The SDD names the code repository
+ * instead: every repository it owns is a row in its own
+ * `catalogues/repositories.csv`, keyed by id. Resolution is therefore a lookup
+ * in that direction: find the SDD whose catalogue lists this repository.
+ *
+ * Only the SDD's OWN catalogue counts, never `catalogues-aggregated/`: a
+ * platform root's aggregate lists every member's repositories too, so reading
+ * it would make every code repo resolve to two SDDs.
+ */
+import { access } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import { basename, dirname, join, resolve } from "node:path";
+import { readCatalogueCsv } from "../catalogue/csv-reader.js";
+import { discoverSddRepos } from "../list/discover.js";
+import { readRepoKind } from "../repo-kind.js";
+export const REPOSITORIES_CATALOGUE = "catalogues/repositories.csv";
+/** The code repository's id: `--repo` when given, else its git top-level's directory name. */
+export function resolveCodeRepoName(codeRepo, override) {
+    if (override !== undefined && override.trim() !== "")
+        return override.trim();
+    const top = spawnSync("git", ["-C", codeRepo, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    if (top.status === 0 && top.stdout.trim() !== "")
+        return basename(top.stdout.trim());
+    return basename(resolve(codeRepo));
+}
+/** Does this SDD's own repositories catalogue list `repoName`? */
+export async function catalogueListsRepo(sddRoot, repoName) {
+    const path = join(sddRoot, REPOSITORIES_CATALOGUE);
+    try {
+        await access(path);
+    }
+    catch {
+        return false;
+    }
+    const { rows } = await readCatalogueCsv(path);
+    return rows.some((r) => r["id"] === repoName);
+}
+export async function resolveSdd(opts) {
+    if (opts.sddPath !== undefined) {
+        const root = resolve(opts.sddPath);
+        if ((await readRepoKind(root)) === null)
+            return { kind: "not-an-sdd", path: root };
+        // An explicit --sdd is the caller's assertion, so an uncatalogued repository is reported
+        // (the caller may be wiring a repository the SDD has not catalogued yet), not refused.
+        return { kind: "resolved", sddRoot: root, catalogued: await catalogueListsRepo(root, opts.repoName) };
+    }
+    const self = resolve(opts.codeRepo);
+    const found = await discoverSddRepos(opts.searchRoots);
+    const searched = found.map((r) => r.path).filter((p) => resolve(p) !== self);
+    const matches = [];
+    for (const p of searched) {
+        if (await catalogueListsRepo(p, opts.repoName))
+            matches.push(p);
+    }
+    if (matches.length === 1)
+        return { kind: "resolved", sddRoot: matches[0], catalogued: true };
+    if (matches.length === 0)
+        return { kind: "not-found", searched };
+    return { kind: "ambiguous", candidates: matches };
+}
+/** Default discovery root: the directory holding the code repository. */
+export function defaultSearchRoots(codeRepo) {
+    return [dirname(resolve(codeRepo))];
+}
+//# sourceMappingURL=resolve.js.map

package/dist/lib/generate-briefing/index.js

@@ -0,0 +1,77 @@
+/**
+ * `sdd-cli generate-briefing` — regenerate `agent-instructions.md` +
+ * the harness wrapper for an existing SDD repo without pulling a
+ * bundle. Reuses the briefing-merge sync helpers so behaviour matches
+ * what `sdd-cli sync` writes (the templates already on disk are the
+ * source of truth).
+ *
+ * Replaces the v0.3.0 `generate-claude-md` verb whose rich-content
+ * output diverges from the ADR 0148 thin-pointer shape.
+ */
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { AGENT_INSTRUCTIONS_REL_PATH, BRIEFING_TEMPLATE_ROOT, harnessWrapperOutputPath, } from "../briefing/index.js";
+import { syncBriefingFiles } from "../sync/briefing-merge.js";
+import { DEFAULT_AGENT_HARNESS, resolveAgentHarness, } from "../agent-harness.js";
+import { readRepoKind } from "../repo-kind.js";
+import { readLockFile } from "../lock-file.js";
+export async function runGenerateBriefing(opts, stdout = (line) => process.stdout.write(line)) {
+    const repoKind = await readRepoKind(opts.targetDir);
+    if (repoKind === null) {
+        stdout(fail(`Not an SDD repo: no .sdd-repo-kind marker in ${opts.targetDir}`));
+        return { exitCode: 1 };
+    }
+    const lock = await readLockFile(opts.targetDir);
+    if (!lock) {
+        stdout(fail(`Cannot regenerate briefing: method-baseline.lock missing at ${opts.targetDir}. Run sdd-cli sync first.`));
+        return { exitCode: 1 };
+    }
+    const forwardBase = lock.bundles.find((b) => b.isForwardBase);
+    if (!forwardBase) {
+        stdout(fail(`Cannot regenerate briefing: no forward-base bundle in method-baseline.lock at ${opts.targetDir}.`));
+        return { exitCode: 1 };
+    }
+    // Templates ship in the bundle and land here on sync. Refusing
+    // up-front when they're absent gives a clearer error than the
+    // graceful skip downstream.
+    const templatesPresent = await fileExists(join(opts.targetDir, BRIEFING_TEMPLATE_ROOT, "agent-instructions.md.hbs"));
+    if (!templatesPresent) {
+        stdout(fail(`Briefing templates not found under ${BRIEFING_TEMPLATE_ROOT}/ — sync against a baseline that ships ADR 0148 templates first.`));
+        return { exitCode: 1 };
+    }
+    const result = await syncBriefingFiles({
+        targetRepo: opts.targetDir,
+        repoKind,
+        baselineVersion: forwardBase.bundleVersion,
+        agentHarness: opts.agentHarness ?? DEFAULT_AGENT_HARNESS,
+        allowOverwrite: opts.allowOverwrite,
+    });
+    if (result.refused) {
+        stdout(fail(`${result.refused} has adopter edits outside the method-managed markers. Re-run with --allow-overwrite to replace the file.`));
+        return { exitCode: 1 };
+    }
+    for (const line of result.log)
+        stdout(info(line));
+    if (result.log.length === 0) {
+        stdout(info(`Briefing files already match templates — no changes (${AGENT_INSTRUCTIONS_REL_PATH}, ${harnessWrapperOutputPath(opts.agentHarness ?? DEFAULT_AGENT_HARNESS)}).`));
+    }
+    return { exitCode: 0 };
+}
+// Re-export so the verb layer can use the validator without an extra import line.
+export { resolveAgentHarness };
+async function fileExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function info(msg) {
+    return `[INFO] ${msg}\n`;
+}
+function fail(msg) {
+    return `[FAIL] ${msg}\n`;
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/hooks-seed/copilot.js

@@ -0,0 +1,167 @@
+/**
+ * Builders + drift detection for the method-managed GitHub Copilot CLI
+ * hooks, per `docs/method/methods/hook-contracts.md` (Hook 1, Hook 2)
+ * and the portable contracts in `hook-portable-contract-schema.yaml`.
+ *
+ * The Copilot CLI surface differs from Claude Code in three ways
+ * (per ADR 0141 §4.3 + hook-contracts.md):
+ *
+ *   1. Hook configs live in per-event JSON files (`.github/hooks/<event>.json`),
+ *      not a single settings.json.
+ *   2. No per-tool matcher — every `preToolUse` hook fires for every
+ *      tool, with in-script filtering instead.
+ *   3. Approval semantic is declarative (`approval: deny-on-nonzero`)
+ *      rather than exit-code based.
+ *
+ * Ownership is sentinel-based, same as Claude Code: the `bash` and
+ * `powershell` command strings carry `# sdd-method-managed:true`.
+ * Adopter-added events in the same `events[]` array lack the sentinel
+ * and survive sync.
+ */
+import { METHOD_MANAGED_SENTINEL } from "./types.js";
+import { nativeEventName } from "./lifecycle-mapping.js";
+const HARNESS = "github-copilot-cli";
+/** Filename per portable lifecycle class. */
+const HOOK_FILE_BY_PORTABLE = {
+    pre_tool_use: "pre-tool-use.json",
+    session_start: "session-start.json",
+};
+export function copilotHookFilePath(portable) {
+    const name = HOOK_FILE_BY_PORTABLE[portable];
+    if (!name) {
+        throw new Error(`No Copilot CLI hook file mapped for portable class "${portable}"`);
+    }
+    return `.github/hooks/${name}`;
+}
+function withSentinel(command) {
+    if (command.includes(METHOD_MANAGED_SENTINEL))
+        return command;
+    return `${command} ${METHOD_MANAGED_SENTINEL}`;
+}
+/**
+ * Hook 1 — `block-edits-to-method-managed-paths` (pre_tool_use).
+ * Copilot CLI has no per-tool matcher, so the script
+ * (orchestration/scripts/copilot-method-guard.{sh,ps1}) does the
+ * filtering on tool name in addition to the path check. Method-side
+ * authors the scripts; we just emit the wiring.
+ */
+export function buildCopilotPreToolUseEvent() {
+    return {
+        type: nativeEventName(HARNESS, "pre_tool_use"),
+        command: {
+            bash: withSentinel("./orchestration/scripts/copilot-method-guard.sh"),
+            powershell: withSentinel("./orchestration/scripts/copilot-method-guard.ps1"),
+        },
+        timeout_ms: 5000,
+        approval: "deny-on-nonzero",
+    };
+}
+/**
+ * Hook 2 — `validate-adr-structure-on-session-start` (session_start).
+ * Output is surfaced as session-baseline context; non-blocking
+ * (`approval: always-allow`) to match the portable contract's `warn`
+ * exit-code semantic.
+ */
+export function buildCopilotSessionStartEvent() {
+    return {
+        type: nativeEventName(HARNESS, "session_start"),
+        command: {
+            bash: withSentinel("sdd-cli validate --validator adr-structure 2>&1 | head -20"),
+            powershell: withSentinel("sdd-cli validate --validator adr-structure 2>&1 | Select-Object -First 20"),
+        },
+        timeout_ms: 30000,
+        approval: "always-allow",
+    };
+}
+export function buildMethodManagedCopilotHooks() {
+    return {
+        pre_tool_use: {
+            filePath: copilotHookFilePath("pre_tool_use"),
+            events: [buildCopilotPreToolUseEvent()],
+        },
+        session_start: {
+            filePath: copilotHookFilePath("session_start"),
+            events: [buildCopilotSessionStartEvent()],
+        },
+    };
+}
+/**
+ * An event entry is method-managed iff its `command.bash` (or
+ * `command.powershell`) carries the sentinel.
+ */
+export function isMethodManagedEvent(event) {
+    const bash = typeof event.command?.bash === "string" ? event.command.bash : "";
+    const ps = typeof event.command?.powershell === "string"
+        ? event.command.powershell
+        : "";
+    return (bash.includes(METHOD_MANAGED_SENTINEL) ||
+        ps.includes(METHOD_MANAGED_SENTINEL));
+}
+/**
+ * Strip the sentinel and trailing whitespace from a command string so
+ * two commands can be compared modulo ownership marker. Symmetric to
+ * the Claude Code merge logic.
+ */
+function normaliseCommandString(command) {
+    return command.replace(METHOD_MANAGED_SENTINEL, "").trimEnd();
+}
+function eventsEquivalentExcludingSentinel(a, b) {
+    if (a.type !== b.type)
+        return false;
+    if (a.approval !== b.approval)
+        return false;
+    if (a.timeout_ms !== b.timeout_ms)
+        return false;
+    const aBash = a.command?.bash ?? "";
+    const bBash = b.command?.bash ?? "";
+    const aPs = a.command?.powershell ?? "";
+    const bPs = b.command?.powershell ?? "";
+    return (normaliseCommandString(aBash) === normaliseCommandString(bBash) &&
+        normaliseCommandString(aPs) === normaliseCommandString(bPs));
+}
+/**
+ * Upsert method-managed events into an existing hook file. Adopter-
+ * added events (no sentinel) survive. An unmarked adopter event that
+ * is equivalent (modulo sentinel) to a method-managed event we're
+ * adding gets de-duped — same safety net as the Claude Code merge
+ * post-v0.12.2.
+ */
+export function upsertCopilotHookFile(existing, owned) {
+    const currentEvents = existing?.events ?? [];
+    let dedupedAny = false;
+    const adopterEvents = currentEvents.filter((evt) => {
+        if (isMethodManagedEvent(evt))
+            return false;
+        const equivalent = owned.some((o) => eventsEquivalentExcludingSentinel(evt, o));
+        if (equivalent) {
+            dedupedAny = true;
+            return false;
+        }
+        return true;
+    });
+    const before = currentEvents.filter((e) => isMethodManagedEvent(e));
+    const after = owned;
+    const methodChanged = JSON.stringify(before) !== JSON.stringify(after);
+    const nextFile = {
+        version: 1,
+        events: [...adopterEvents, ...owned],
+    };
+    return {
+        file: nextFile,
+        changed: methodChanged || dedupedAny,
+    };
+}
+/**
+ * Detect adopter drift: an event still carrying the sentinel but whose
+ * content no longer matches the canonical version we'd write. Returns
+ * `true` iff drift is present.
+ */
+export function detectCopilotHookDrift(existing, owned) {
+    if (!existing)
+        return false;
+    const existingMethod = existing.events.filter((e) => isMethodManagedEvent(e));
+    if (existingMethod.length === 0)
+        return false;
+    return JSON.stringify(existingMethod) !== JSON.stringify(owned);
+}
+//# sourceMappingURL=copilot.js.map

package/dist/lib/hooks-seed/entries.js

@@ -0,0 +1,47 @@
+/**
+ * Builders for the method-managed hook matchers per ADR 0129 §4.2.
+ *
+ * Every command carries the METHOD_MANAGED_SENTINEL suffix so the
+ * merge path can identify it on refresh. Adopter-added hooks under
+ * the same event survive because they lack the sentinel.
+ */
+import { METHOD_MANAGED_SENTINEL } from "./types.js";
+function withSentinel(command) {
+    if (command.includes(METHOD_MANAGED_SENTINEL))
+        return command;
+    return `${command} ${METHOD_MANAGED_SENTINEL}`;
+}
+export function buildMethodGuardPreToolUse() {
+    return {
+        matcher: "Edit|Write|NotebookEdit",
+        hooks: [
+            {
+                type: "command",
+                command: withSentinel('bash "${CLAUDE_PROJECT_DIR:-$(pwd)}/orchestration/scripts/claude-method-guard.sh"'),
+            },
+        ],
+    };
+}
+export function buildSessionStartValidate() {
+    return {
+        matcher: "startup",
+        hooks: [
+            {
+                type: "command",
+                command: withSentinel('sdd-cli validate --target-repo "${CLAUDE_PROJECT_DIR:-$(pwd)}" --validator adr-structure 2>&1 | head -20'),
+            },
+        ],
+    };
+}
+/**
+ * Full method-managed hooks block. When extending, add a new event
+ * name to the returned object and a corresponding builder above.
+ */
+export function buildMethodManagedHooks() {
+    const hooks = {
+        PreToolUse: [buildMethodGuardPreToolUse()],
+        SessionStart: [buildSessionStartValidate()],
+    };
+    return hooks;
+}
+//# sourceMappingURL=entries.js.map

package/dist/lib/hooks-seed/index.js

@@ -0,0 +1,17 @@
+/**
+ * Public facade for the method-managed hooks seed library.
+ *
+ * Scope: this module owns method-managed entries inside
+ * `.claude/settings.json`'s `hooks` key. Ownership is identified by
+ * the `# sdd-method-managed:true` sentinel in each hook command.
+ *
+ * Integration: `src/lib/sync/settings-merge.ts` conditionally calls
+ * `upsertMethodManagedHooks` after `upsertMethodManagedServers` when
+ * the adopter opted into `--agent-harness claude-code` at init time.
+ */
+export { METHOD_MANAGED_SENTINEL, isMethodManagedMatcher } from "./types.js";
+export { buildMethodManagedHooks } from "./entries.js";
+export { detectHooksDrift, upsertMethodManagedHooks, } from "./merge.js";
+export { buildMethodManagedCopilotHooks, copilotHookFilePath, detectCopilotHookDrift, isMethodManagedEvent, upsertCopilotHookFile, } from "./copilot.js";
+export { nativeEventName, } from "./lifecycle-mapping.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/hooks-seed/lifecycle-mapping.js

@@ -0,0 +1,28 @@
+/**
+ * Portable lifecycle event class → harness-native event mapping per
+ * ADR 0141 §4.3 and the table in `docs/method/foundations/lifecycle-event-classes.yaml`.
+ *
+ * Adding a new harness binding is mechanical: extend `AgentHarness`
+ * in src/lib/agent-harness.ts and add a row here. Hook builders
+ * consume this mapping rather than hand-coding native event names.
+ */
+const MAPPINGS = {
+    "claude-code": {
+        pre_tool_use: "PreToolUse",
+        post_tool_use: "PostToolUse",
+        user_prompt_submit: "UserPromptSubmit",
+        session_start: "SessionStart",
+        session_stop: "Stop",
+    },
+    "github-copilot-cli": {
+        pre_tool_use: "preToolUse",
+        post_tool_use: "postToolUse",
+        user_prompt_submit: "userPromptSubmitted",
+        session_start: "sessionStart",
+        session_stop: "agentStop",
+    },
+};
+export function nativeEventName(harness, portable) {
+    return MAPPINGS[harness][portable];
+}
+//# sourceMappingURL=lifecycle-mapping.js.map

package/dist/lib/hooks-seed/merge.js

@@ -0,0 +1,128 @@
+/**
+ * Merge logic for the method-managed hooks slice of
+ * `.claude/settings.json`. Ownership is sentinel-based: a method-
+ * managed matcher carries `# sdd-method-managed:true` in one of its
+ * commands. Adopter-added matchers lack the sentinel and survive
+ * sync untouched.
+ */
+import { METHOD_MANAGED_SENTINEL, isMethodManagedMatcher } from "./types.js";
+/**
+ * Strip the method-managed sentinel and trailing whitespace from a hook
+ * command so two commands can be compared modulo ownership marker.
+ */
+function normaliseCommand(command) {
+    return command.replace(METHOD_MANAGED_SENTINEL, "").trimEnd();
+}
+/**
+ * Two matchers are equivalent (modulo sentinel) when:
+ *   - their `matcher` strings are equal, AND
+ *   - their `hooks` arrays have the same length, AND
+ *   - each pair of corresponding `hooks[i]` has the same `type` and the
+ *     same normalised `command` (sentinel suffix stripped, trailing
+ *     whitespace trimmed).
+ *
+ * This handles the case where an adopter manually authored the method's
+ * hook before the first managed sync — the resulting entry differs from
+ * the method-supplied one only in the missing sentinel suffix.
+ */
+function matchersEquivalentExcludingSentinel(a, b) {
+    if (a.matcher !== b.matcher)
+        return false;
+    if (a.hooks.length !== b.hooks.length)
+        return false;
+    for (let i = 0; i < a.hooks.length; i++) {
+        const ha = a.hooks[i];
+        const hb = b.hooks[i];
+        if (ha.type !== hb.type)
+            return false;
+        if (normaliseCommand(ha.command) !== normaliseCommand(hb.command)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function upsertMethodManagedHooks(existing, owned) {
+    const current = isHooksObject(existing["hooks"])
+        ? existing["hooks"]
+        : {};
+    const nextHooks = {};
+    const changedEvents = [];
+    // Start by copying every existing event's adopter-owned matchers.
+    // Drop adopter matchers that are equivalent (modulo sentinel) to a
+    // method-managed matcher we're about to add — otherwise we'd leave
+    // a duplicated entry. This handles two cases:
+    //   (a) Adopter authored the method's hook by hand before the first
+    //       managed sync (no sentinel on their entry).
+    //   (b) A historical sync that already produced the duplicate state
+    //       (one marked entry + one unmarked equivalent); the unmarked
+    //       twin is auto-cleaned on next merge.
+    let dedupedAny = false;
+    for (const [event, matchers] of Object.entries(current)) {
+        if (!matchers)
+            continue;
+        const ownedForEvent = owned[event] ?? [];
+        const adopterMatchers = matchers.filter((m) => {
+            if (isMethodManagedMatcher(m))
+                return false;
+            const equivalent = ownedForEvent.some((o) => matchersEquivalentExcludingSentinel(m, o));
+            if (equivalent) {
+                dedupedAny = true;
+                return false;
+            }
+            return true;
+        });
+        if (adopterMatchers.length > 0)
+            nextHooks[event] = [...adopterMatchers];
+    }
+    // Layer method-managed matchers on top.
+    for (const [event, ownedMatchers] of Object.entries(owned)) {
+        if (!ownedMatchers || ownedMatchers.length === 0)
+            continue;
+        const before = current[event]?.filter((m) => isMethodManagedMatcher(m)) ?? [];
+        const after = ownedMatchers;
+        if (JSON.stringify(before) !== JSON.stringify(after)) {
+            changedEvents.push(event);
+        }
+        const bucket = nextHooks[event] ?? [];
+        bucket.push(...ownedMatchers);
+        nextHooks[event] = bucket;
+    }
+    const changed = changedEvents.length > 0 || dedupedAny;
+    if (!changed &&
+        Object.keys(nextHooks).length === Object.keys(current).length) {
+        // No method-managed changes AND no adopter matchers reshuffled.
+        return { settings: existing, changedEvents: [], changed: false };
+    }
+    const nextSettings = {
+        ...existing,
+        hooks: nextHooks,
+    };
+    return { settings: nextSettings, changedEvents, changed };
+}
+/**
+ * Detect adopter drift inside a method-managed matcher — i.e., an
+ * entry that still carries the sentinel but whose content differs
+ * from what we would write now. Returns the list of events where drift
+ * is present.
+ */
+export function detectHooksDrift(existing, owned) {
+    const current = isHooksObject(existing["hooks"])
+        ? existing["hooks"]
+        : {};
+    const drifted = [];
+    for (const [event, ownedMatchers] of Object.entries(owned)) {
+        if (!ownedMatchers)
+            continue;
+        const existingMethod = current[event]?.filter((m) => isMethodManagedMatcher(m)) ?? [];
+        if (existingMethod.length === 0)
+            continue; // no drift; freshly adding
+        if (JSON.stringify(existingMethod) !== JSON.stringify(ownedMatchers)) {
+            drifted.push(event);
+        }
+    }
+    return drifted;
+}
+function isHooksObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+//# sourceMappingURL=merge.js.map

package/dist/lib/hooks-seed/types.js

@@ -0,0 +1,20 @@
+/**
+ * Types for the method-managed hooks slice of `.claude/settings.json`.
+ * Mirrors Claude Code's hooks shape, narrowed to the fields we read
+ * and write.
+ */
+/** Sentinel suffix carried by method-managed hook commands. */
+export const METHOD_MANAGED_SENTINEL = "# sdd-method-managed:true";
+/**
+ * A hook entry is method-managed iff at least one of its commands
+ * carries the sentinel.
+ */
+export function isMethodManagedMatcher(entry) {
+    for (const h of entry.hooks) {
+        if (typeof h.command === "string" && h.command.includes(METHOD_MANAGED_SENTINEL)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=types.js.map

package/dist/lib/init/ci-workflow.js

@@ -0,0 +1,98 @@
+/**
+ * Renders .github/workflows/method-validation.yml: the GitHub Actions host wrapper (M-ADR 0219
+ * §4.4), which installs the pinned Dagger CLI and calls the Method Validation module. The job
+ * itself is defined once, in ../ci-binding/module.ts; the other hosts' wrappers are in
+ * ../ci-binding/index.ts.
+ *
+ * Output wraps a `# method-managed: begin` / `# method-managed: end`
+ * block-marker pair so the sync path can preserve adopter-authored
+ * content outside the block.
+ */
+import { DAGGER_VERSION, MODULE_CALL, MODULE_DIR } from "../ci-binding/module.js";
+export const WORKFLOW_REL_PATH = ".github/workflows/method-validation.yml";
+export const BLOCK_BEGIN = "# method-managed: begin";
+export const BLOCK_END = "# method-managed: end";
+/**
+ * Full file content (block + adopter-extension footer). Used by
+ * `sdd-cli init` to write a fresh workflow.
+ */
+export function renderMethodValidationWorkflow(profile, runner) {
+    const methodBlock = buildMethodManagedBlock(profile, runner);
+    return methodBlock + "\n\n# Adopter-specific jobs go in a separate workflow file\n# (e.g. .github/workflows/adopter-validation.yml) — see\n# docs/method/methods/ci-baseline-guide.md.\n";
+}
+/**
+ * Method-managed slice only (begin marker through end marker). Used
+ * by `sdd-cli sync` as the `incomingBlock` argument to
+ * `writeMarkedBlockFile` so adopter content outside the markers is
+ * preserved verbatim.
+ */
+export function renderMethodManagedWorkflowBlock(profile, runner) {
+    return buildMethodManagedBlock(profile, runner);
+}
+/**
+ * `runs-on`: GitHub's hosted runner unless the SDD chose labels (sync --ci-runner), e.g. a
+ * self-hosted runner, where the Dagger engine and its cache persist between runs.
+ */
+function runsOn(runner) {
+    if (runner === undefined || runner.length === 0)
+        return "ubuntu-latest";
+    return runner.length === 1 ? runner[0] : `[${runner.join(", ")}]`;
+}
+function buildMethodManagedBlock(profile, runner) {
+    return [
+        BLOCK_BEGIN,
+        "# Method Validation per M-ADR 0129, run by the method's Dagger module (M-ADR 0219).",
+        "# Refreshed by `sdd-cli sync`; content inside the method-managed",
+        "# markers must not be hand-edited (sync refuses without --allow-overwrite).",
+        `# Profile: ${profile}`,
+        "#",
+        // The DECISION rationale is emitted because its reader is the ADOPTER, who otherwise sees a
+        // bare call and re-opens the question.
+        `# The job is defined once, in ${MODULE_DIR}/, and this file only calls it:`,
+        "# the same module runs on GitHub Actions, GitLab CI, Jenkins and a laptop,",
+        "# so CI and a local run cannot disagree. The module reads its steps from",
+        "# `sdd-verify validate --list` and runs them on @sdd-method/verify-cli, which",
+        "# ships only the verbs that read (M-ADR 0212), pinned EXACTLY to the version",
+        "# released with the sdd-cli that last synced this repository. The catalogue",
+        "# freshness step (@sdd-method/maintain-cli, pinned the same way) is advisory.",
+        "#",
+        "# Run it locally (needs a container engine):",
+        `#   ${MODULE_CALL}`,
+        "",
+        "name: Method Validation",
+        "",
+        "on:",
+        "  pull_request:",
+        "  push:",
+        "    branches: [main, master]",
+        ...pushPathsIgnore(profile),
+        "  workflow_dispatch:",
+        "",
+        "jobs:",
+        // ONE job: GitHub bills each job rounded UP to a whole minute (adopter measurement, 2026-10-12).
+        "  method-validation:",
+        "    name: Method Validation",
+        `    runs-on: ${runsOn(runner)}`,
+        "    steps:",
+        "      - uses: actions/checkout@v4",
+        "      - name: Install Dagger",
+        `        run: curl -fsSL https://dl.dagger.io/dagger/install.sh | BIN_DIR="$RUNNER_TEMP/dagger" DAGGER_VERSION=${DAGGER_VERSION} sh && echo "$RUNNER_TEMP/dagger" >> "$GITHUB_PATH"`,
+        "      - name: Method Validation",
+        `        run: ${MODULE_CALL}`,
+        BLOCK_END,
+    ].join("\n");
+}
+/**
+ * `paths-ignore` for push, APPLICATION profile only: a push touching nothing but
+ * `catalogues/` (a catalogue rebuild) skips the run. Measured safe only there —
+ * no application validator reads the repo's own catalogues, whereas platform
+ * traceability and cascade-completeness and integration-docs do, so a
+ * catalogue-only change CAN change their verdict and they keep running.
+ * Push only: on pull_request a skipped workflow leaves a required check pending.
+ */
+function pushPathsIgnore(profile) {
+    if (profile !== "application")
+        return [];
+    return [`    paths-ignore:`, `      - "catalogues/**"`];
+}
+//# sourceMappingURL=ci-workflow.js.map