@sdd-method/maintain-cli 0.0.0-stage → 0.1.0

package/dist/lib/mcp-seed/merge.js

@@ -0,0 +1,99 @@
+/**
+ * Merge logic for the method-managed portion of `.claude/settings.json`.
+ *
+ * Ownership model: the method owns specific server ids (listed in
+ * `METHOD_MANAGED_SERVER_IDS`). On upsert, those ids are rewritten
+ * with the method-supplied entry; any other server ids the adopter
+ * has added under `mcpServers` survive untouched, as do all other
+ * top-level keys (hooks, permissions, env, …).
+ *
+ * The merge is conservative: if a method id exists with a value that
+ * is byte-identical to the method's current seed, we return the
+ * original object unmodified (stable output → no spurious writes).
+ */
+export function upsertMethodManagedServers(existing, owned) {
+    const added = [];
+    const updated = [];
+    const unchanged = [];
+    const currentServers = isPlainObject(existing["mcpServers"])
+        ? existing["mcpServers"]
+        : {};
+    const nextServers = { ...currentServers };
+    for (const [id, entry] of Object.entries(owned)) {
+        const prior = currentServers[id];
+        if (prior === undefined) {
+            nextServers[id] = entry;
+            added.push(id);
+        }
+        else if (!entriesEqual(prior, entry)) {
+            nextServers[id] = entry;
+            updated.push(id);
+        }
+        else {
+            unchanged.push(id);
+        }
+    }
+    const changed = added.length > 0 || updated.length > 0;
+    if (!changed) {
+        return {
+            settings: existing,
+            added,
+            updated,
+            unchanged,
+            changed: false,
+        };
+    }
+    const nextSettings = {
+        ...existing,
+        mcpServers: nextServers,
+    };
+    return {
+        settings: nextSettings,
+        added,
+        updated,
+        unchanged,
+        changed: true,
+    };
+}
+/**
+ * Detect adopter-edited method-managed entries. Returns the ids whose
+ * current value differs from the method-supplied seed — these are the
+ * ones that a refuse-or-overwrite sync should flag unless
+ * `--allow-overwrite` is passed.
+ */
+export function detectManagedDrift(existing, owned) {
+    const currentServers = isPlainObject(existing["mcpServers"])
+        ? existing["mcpServers"]
+        : {};
+    const drifted = [];
+    for (const [id, entry] of Object.entries(owned)) {
+        const prior = currentServers[id];
+        if (prior !== undefined && !entriesEqual(prior, entry)) {
+            drifted.push(id);
+        }
+    }
+    return drifted;
+}
+function entriesEqual(a, b) {
+    // Stable-order JSON comparison. The entry shape is small and flat
+    // enough that stringifying is cheaper than writing a structural
+    // walker.
+    return stableStringify(a) === stableStringify(b);
+}
+function stableStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return "[" + value.map((v) => stableStringify(v)).join(",") + "]";
+    }
+    const keys = Object.keys(value).sort();
+    return ("{" +
+        keys
+            .map((k) => JSON.stringify(k) + ":" + stableStringify(value[k]))
+            .join(",") +
+        "}");
+}
+function isPlainObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+//# sourceMappingURL=merge.js.map

package/dist/lib/mcp-seed/types.js

@@ -0,0 +1,13 @@
+/**
+ * Types for the MCP settings-seed library. Mirrors the shape Claude
+ * Code expects at `.claude/settings.json`, restricted to the fields
+ * we read or write.
+ */
+/**
+ * Server ids owned by this method plan. Sync upserts these and leaves
+ * everything else alone. When Phases 3+4 ship adopter servers, extend
+ * the list — or better, let each plan contribute its own list and
+ * combine at merge time.
+ */
+export const METHOD_MANAGED_SERVER_IDS = ["sdd-mcp"];
+//# sourceMappingURL=types.js.map

package/dist/lib/pack/builder.js

@@ -0,0 +1,303 @@
+import { execFile as execFileCb } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { promisify } from "node:util";
+import { checkLeakage } from "./leakage.js";
+import { applyPublishTransform } from "./publish-transform.js";
+import { checkReferenceClosure, } from "./reference-closure.js";
+const execFile = promisify(execFileCb);
+export async function buildPack(opts) {
+    const packName = opts.packName ?? derivePackName(opts.seed.sourcePath);
+    const outDir = opts.outDir ?? join(opts.producerRepo, "dist", packName);
+    // 1. Resolve globs against producer repo
+    const resolvedPaths = await resolveManagedPaths(opts.seed.managedPaths, opts.producerRepo);
+    // 2. Producer-side leakage check
+    const leakage = await checkLeakage({
+        seed: { ...opts.seed, managedPaths: resolvedPaths },
+        ...(opts.forwardBaseManagedPathsFile && {
+            forwardBaseManagedPathsFile: opts.forwardBaseManagedPathsFile,
+        }),
+        producerRepo: opts.producerRepo,
+    });
+    if (!leakage.ok) {
+        const summary = leakage.violations
+            .map((v) => `  - ${v.path}  (conflicts with ${v.conflictWith}: ${v.conflictSource})`)
+            .join("\n");
+        throw new Error(`Producer-side leakage check failed for ${packName}@${opts.seed.version}:\n${summary}`);
+    }
+    // 3. Stage payload
+    const stage = await mkdtemp(join(tmpdir(), "sdd-cli-pack-build-"));
+    const rootName = `${packName}-v${opts.seed.version}`;
+    const root = join(stage, rootName);
+    const payload = join(root, "payload");
+    await mkdir(payload, { recursive: true });
+    try {
+        for (const p of resolvedPaths) {
+            const src = join(opts.producerRepo, p);
+            const dest = join(payload, p);
+            await mkdir(dirname(dest), { recursive: true });
+            await copyFile(src, dest);
+        }
+        // 3b. Publish transform (ADR 0183/0184) — method-baseline builds only.
+        // Produces the point-in-time / producer-agnostic published payload and
+        // fails closed on any published-surface leak, before anything is hashed
+        // or tarred. Non-Accepted ADRs are dropped from the payload.
+        let publishedPaths = resolvedPaths;
+        if (opts.publishTransform) {
+            const transform = await applyPublishTransform(payload, resolvedPaths, {
+                mAdrPrefix: opts.mAdrPrefix ?? false,
+            });
+            if (transform.violations.length > 0) {
+                const summary = transform.violations
+                    .slice(0, 20)
+                    .map((v) => `  ${v.path}:${v.line} [${v.cls}] /${v.pattern}/ → ${v.text}`)
+                    .join("\n");
+                const more = transform.violations.length > 20
+                    ? `\n  …and ${transform.violations.length - 20} more`
+                    : "";
+                throw new Error(`Published-surface lint failed for ${packName}@${opts.seed.version} ` +
+                    `(${transform.violations.length} leak(s)):\n${summary}${more}`);
+            }
+            publishedPaths = transform.keptPaths;
+        }
+        // 3c. Reference closure (M-ADR 0151 §4.6) — reporting-only, by design:
+        // a subset pack cannot satisfy closure without ceasing to be a subset,
+        // so it declares its unresolvable-reference count instead of gating.
+        const referenceClosure = await checkReferenceClosure(payload, publishedPaths);
+        // 4. Checksums (over the published payload)
+        const checksums = await computeChecksums(payload, publishedPaths);
+        // 5. Manifest + managed_paths + checksums files
+        const gitInfo = await readGitInfo(opts.producerRepo);
+        await writeFile(join(root, "MANAGED_PATHS.txt"), publishedPaths.join("\n") + "\n");
+        await writeFile(join(root, "CHECKSUMS.sha256"), checksums);
+        await writeFile(join(root, "BUNDLE_MANIFEST.yaml"), renderManifest({
+            packName,
+            seed: opts.seed,
+            producerRepo: opts.producerRepo,
+            managedPathCount: publishedPaths.length,
+            sourceCommit: gitInfo.commit,
+            sourceBranch: gitInfo.branch,
+        }));
+        // 6. tar -czf
+        await mkdir(outDir, { recursive: true });
+        const tarballName = `${rootName}.tar.gz`;
+        const tarballPath = join(outDir, tarballName);
+        await execFile("tar", ["-czf", tarballPath, "-C", stage, rootName]);
+        // Also emit a sidecar checksum file for the tarball itself
+        const tarballHash = await sha256File(tarballPath);
+        const sidecar = `${tarballHash}  ${tarballName}\n`;
+        const checksumPath = join(outDir, `${rootName}.sha256`);
+        await writeFile(checksumPath, sidecar);
+        return {
+            tarballPath,
+            checksumPath,
+            packName,
+            bundleVersion: `v${opts.seed.version}`,
+            managedPathCount: publishedPaths.length,
+            leakage,
+            referenceClosure,
+        };
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+    }
+}
+function derivePackName(seedPath) {
+    // .../{pack-name}-seed.yaml → {pack-name}
+    const base = seedPath.split("/").pop() ?? seedPath;
+    return base.replace(/-seed\.yaml$/, "").replace(/\.yaml$/, "");
+}
+async function resolveManagedPaths(patterns, producerRepo) {
+    const out = [];
+    const seen = new Set();
+    for (const pattern of patterns) {
+        if (pattern.includes("*")) {
+            const matches = await expandGlob(pattern, producerRepo);
+            for (const m of matches) {
+                if (!seen.has(m)) {
+                    seen.add(m);
+                    out.push(m);
+                }
+            }
+        }
+        else {
+            const abs = join(producerRepo, pattern);
+            try {
+                await stat(abs);
+            }
+            catch {
+                throw new Error(`managed_paths entry does not exist in producer repo: ${pattern}`);
+            }
+            if (!seen.has(pattern)) {
+                seen.add(pattern);
+                out.push(pattern);
+            }
+        }
+    }
+    out.sort();
+    return out;
+}
+async function expandGlob(pattern, producerRepo) {
+    // Minimal glob: split on first `*`, walk directory, match.
+    // Supports `**` (any depth) and `*` (any non-slash chars).
+    const re = globToRegex(pattern);
+    const out = [];
+    async function walk(dir, rel) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childRel = rel === "" ? e.name : `${rel}/${e.name}`;
+            const childAbs = join(dir, e.name);
+            if (e.isDirectory()) {
+                await walk(childAbs, childRel);
+            }
+            else if (e.isFile() && re.test(childRel)) {
+                out.push(childRel);
+            }
+        }
+    }
+    await walk(producerRepo, "");
+    return out;
+}
+function globToRegex(pattern) {
+    let regex = "";
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            if (pattern[i + 1] === "*") {
+                regex += ".*";
+                i += 2;
+            }
+            else {
+                regex += "[^/]*";
+                i += 1;
+            }
+        }
+        else if (/[.+?^${}()|[\]\\]/.test(ch)) {
+            regex += `\\${ch}`;
+            i += 1;
+        }
+        else {
+            regex += ch;
+            i += 1;
+        }
+    }
+    return new RegExp(`^${regex}$`);
+}
+async function computeChecksums(payloadRoot, paths) {
+    const lines = [];
+    for (const p of paths) {
+        const abs = join(payloadRoot, p);
+        const hash = await sha256File(abs);
+        lines.push(`${hash}  payload/${p}`);
+    }
+    return lines.join("\n") + "\n";
+}
+async function sha256File(path) {
+    const buf = await readFile(path);
+    return createHash("sha256").update(buf).digest("hex");
+}
+function renderManifest(ctx) {
+    // Direct YAML emission — matches the shape declared in
+    // sdd-method/orchestration/templates/bundle/BUNDLE_MANIFEST.yaml.hbs.
+    // We don't go through a Handlebars engine because that would be the
+    // only template-rendered file in sdd-cli; everything else is direct.
+    const generatedAt = new Date().toISOString();
+    const sourceRepo = deriveSourceRepoName(ctx.producerRepo);
+    const lines = [];
+    lines.push(`bundle_name: "${ctx.packName}"`);
+    lines.push(`bundle_version: "v${ctx.seed.version}"`);
+    lines.push(`scope: "${ctx.seed.scope}"`);
+    lines.push(`source_repo: "${sourceRepo}"`);
+    lines.push(`source_branch: "${ctx.sourceBranch}"`);
+    lines.push(`source_commit: "${ctx.sourceCommit}"`);
+    lines.push(`generated_at_utc: "${generatedAt}"`);
+    lines.push(``);
+    lines.push(`# Bundle topology (per ADR 0151 §4)`);
+    lines.push(`is_forward_base: false`);
+    lines.push(`produced_by_adopter: "${sourceRepo}"`);
+    if (ctx.seed.forwardBase) {
+        lines.push(`requires_forward_base:`);
+        lines.push(`  bundle: "${ctx.seed.forwardBase.bundle}"`);
+        lines.push(`  minimum_version: "${ctx.seed.forwardBase.minimumVersion}"`);
+        lines.push(`  source_repo: "${ctx.seed.forwardBase.sourceRepo}"`);
+    }
+    if (ctx.seed.scaffoldSourcePaths && ctx.seed.scaffoldSourcePaths.length > 0) {
+        lines.push(`scaffold_source_paths:`);
+        for (const sp of ctx.seed.scaffoldSourcePaths) {
+            lines.push(`  - "${sp}"`);
+        }
+    }
+    if (ctx.seed.requiresPack) {
+        lines.push(`requires_pack:`);
+        lines.push(`  name: "${ctx.seed.requiresPack.name}"`);
+        lines.push(`  version: "${ctx.seed.requiresPack.version}"`);
+    }
+    lines.push(``);
+    lines.push(`# Payload references`);
+    lines.push(`managed_path_count: ${ctx.managedPathCount}`);
+    lines.push(`managed_paths_file: "MANAGED_PATHS.txt"`);
+    lines.push(`checksums_file: "CHECKSUMS.sha256"`);
+    lines.push(``);
+    lines.push(`# Consumer compatibility`);
+    lines.push(`minimum_sdd_cli_version: "${ctx.seed.minimumSddCliVersion}"`);
+    lines.push(``);
+    lines.push(`description: |`);
+    for (const dl of ctx.seed.description.split("\n")) {
+        lines.push(`  ${dl}`);
+    }
+    return lines.join("\n") + "\n";
+}
+/**
+ * Read git provenance from the producer working tree. Mirrors the
+ * behaviour of sdd-method/orchestration/scripts/build-method-baseline-
+ * bundle.sh which embeds HEAD commit + current branch into BUNDLE_MANIFEST.yaml.
+ *
+ * Falls back to safe non-empty sentinels when the producer is not a
+ * git working tree (e.g. building from a tarball or a CI artifact
+ * dir). source_commit MUST be non-empty for the consumer-side
+ * parseManifest check to pass.
+ */
+async function readGitInfo(producerRepo) {
+    let commit = "uncommitted";
+    let branch = "";
+    try {
+        const { stdout } = await execFile("git", ["-C", producerRepo, "rev-parse", "HEAD"]);
+        commit = stdout.trim() || commit;
+    }
+    catch {
+        // Not a git working tree; keep sentinel.
+    }
+    try {
+        const { stdout } = await execFile("git", [
+            "-C",
+            producerRepo,
+            "rev-parse",
+            "--abbrev-ref",
+            "HEAD",
+        ]);
+        branch = stdout.trim();
+        if (branch === "HEAD")
+            branch = ""; // detached
+    }
+    catch {
+        // Not a git working tree.
+    }
+    return { commit, branch };
+}
+function deriveSourceRepoName(producerRepo) {
+    // Last path segment of producerRepo (e.g. "/.../example-platform" → "example-platform")
+    const segs = producerRepo.split("/").filter((s) => s.length > 0);
+    return segs[segs.length - 1] ?? "unknown-adopter";
+}
+// Re-export so callers can use the relative path utility
+export { relative as relativePath };
+//# sourceMappingURL=builder.js.map

package/dist/lib/pack/index.js

@@ -0,0 +1,87 @@
+import { buildPack } from "./builder.js";
+import { validateSeed } from "./schema.js";
+import { loadSeed } from "./seed.js";
+import { getSddCliVersion } from "../package-version.js";
+import { fail, info, pass, section } from "./log.js";
+export { runPackValidate, } from "./validate.js";
+export async function runPackBuild(opts, stdout = (s) => process.stdout.write(s)) {
+    stdout(section("Pack build"));
+    let seed;
+    try {
+        seed = await loadSeed(opts.seedPath);
+    }
+    catch (err) {
+        stdout(fail(`Seed load failed: ${err.message}`));
+        return { exitCode: 1 };
+    }
+    // A seed key this build does not know is REPORTED rather than dropped in silence.
+    // Not fatal: an older sdd-cli must still build a seed that declares something newer
+    // than itself, exactly as for `.sdd/sdd-manifest.yaml`. Silence here is what let an
+    // adopter follow the schema and get a clean validation with no effect.
+    if (seed.unknownKeys && seed.unknownKeys.length > 0) {
+        stdout(info(`${seed.unknownKeys.length} seed key(s) not understood by sdd-cli ${getSddCliVersion()} ` +
+            `and therefore IGNORED: ${seed.unknownKeys.join(", ")}. If the seed follows a newer ` +
+            `context-pack-seed-schema than this build, upgrade sdd-cli; otherwise remove or correct the key.`));
+    }
+    const validation = validateSeed(seed);
+    if (!validation.ok) {
+        stdout(fail("Seed validation failed:"));
+        for (const e of validation.errors) {
+            stdout(fail(`  ${e.field}: ${e.message}`));
+        }
+        return { exitCode: 1 };
+    }
+    stdout(info(`Seed loaded: ${seed.scope} v${seed.version}`));
+    stdout(info(seed.forwardBase
+        ? `Forward base: ${seed.forwardBase.bundle} >= ${seed.forwardBase.minimumVersion}`
+        : "Forward base: none (profile-agnostic pack, ADR 0176 §4.6)"));
+    stdout(info(`Managed paths declared: ${seed.managedPaths.length}`));
+    // Origin-prefix implies the publish transform: the ADR rename lives inside it,
+    // so the flag would be a silent no-op otherwise.
+    const publishTransform = opts.publishTransform === true || opts.originPrefix === true;
+    if (publishTransform) {
+        stdout(info(`Publish transform: ON${opts.originPrefix ? " + origin-prefix (M-ADR/RA-ADR by band)" : ""}`));
+    }
+    let result;
+    try {
+        result = await buildPack({
+            seed,
+            producerRepo: opts.producerRepo,
+            ...(opts.outDir && { outDir: opts.outDir }),
+            ...(opts.forwardBaseManagedPathsFile && {
+                forwardBaseManagedPathsFile: opts.forwardBaseManagedPathsFile,
+            }),
+            ...(publishTransform && { publishTransform: true }),
+            ...(opts.originPrefix === true && { mAdrPrefix: true }),
+        });
+    }
+    catch (err) {
+        stdout(fail(err.message));
+        return { exitCode: 1 };
+    }
+    stdout(pass(`Built ${result.packName}@${result.bundleVersion}`));
+    stdout(info(`Tarball: ${result.tarballPath}`));
+    stdout(info(`Checksum: ${result.checksumPath}`));
+    stdout(info(`Managed paths in bundle: ${result.managedPathCount}`));
+    // Reference closure (M-ADR 0151 §4.6): stated at every cut so the pack
+    // DECLARES what resolves only in the producer, instead of a consumer
+    // discovering it by resolving the corpus after distribution.
+    const rc = result.referenceClosure;
+    if (rc.unresolvable === 0) {
+        stdout(pass(`Reference closure: all ${rc.totalReferences} payload reference(s) resolve within the pack`));
+    }
+    else {
+        stdout(info(`Reference closure (M-ADR 0151 §4.6): ${rc.unresolvable} of ${rc.totalReferences} ` +
+            `payload reference(s) resolve only in the producer, across ${rc.unresolvableTargets.length} ` +
+            `distinct target(s) — informational in member repos by policy, not a defect. ` +
+            `Expand the seeds to shrink this figure.`));
+        for (const t of rc.unresolvableTargets.slice(0, 10)) {
+            stdout(info(`  → ${t}`));
+        }
+        if (rc.unresolvableTargets.length > 10) {
+            stdout(info(`  … and ${rc.unresolvableTargets.length - 10} more`));
+        }
+    }
+    return { exitCode: 0, build: result };
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/pack/leakage.js

@@ -0,0 +1,144 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+export async function checkLeakage(opts) {
+    const violations = [];
+    // 1. Disjointness with the forward base. Profile-agnostic packs
+    // (no forward_base, ADR 0176 §4.6) compare against an explicitly
+    // supplied MANAGED_PATHS.txt when given; with neither declared nor
+    // supplied, the forward-base half of the check is skipped (the
+    // forbidden-paths half below still runs).
+    if (opts.seed.forwardBase || opts.forwardBaseManagedPathsFile) {
+        const forwardBasePaths = await loadForwardBaseManagedPaths(opts);
+        const forwardBaseSet = new Set(forwardBasePaths);
+        const sourceLabel = opts.seed.forwardBase?.bundle ??
+            opts.forwardBaseManagedPathsFile ??
+            "forward-base";
+        for (const p of opts.seed.managedPaths) {
+            if (forwardBaseSet.has(p)) {
+                violations.push({
+                    path: p,
+                    conflictWith: "forward-base",
+                    conflictSource: sourceLabel,
+                });
+            }
+        }
+    }
+    // 2. Disjointness with declared forbidden_paths globs (seed self-contract).
+    if (opts.seed.forbiddenPaths) {
+        for (const p of opts.seed.managedPaths) {
+            for (const pattern of opts.seed.forbiddenPaths) {
+                if (matchesGlob(p, pattern)) {
+                    violations.push({
+                        path: p,
+                        conflictWith: "forbidden-pattern",
+                        conflictSource: pattern,
+                    });
+                }
+            }
+        }
+    }
+    return { ok: violations.length === 0, violations };
+}
+async function loadForwardBaseManagedPaths(opts) {
+    if (opts.forwardBaseManagedPathsFile) {
+        const raw = await readFile(opts.forwardBaseManagedPathsFile, "utf8");
+        return raw
+            .split("\n")
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0 && !l.startsWith("#"));
+    }
+    if (opts.producerRepo) {
+        const lockPath = join(opts.producerRepo, "method-baseline.lock");
+        try {
+            const raw = await readFile(lockPath, "utf8");
+            // Reachable only when seed.forwardBase is set (callers guard);
+            // the non-null assertion keeps the lock-derived path working.
+            return extractManagedPathsForBundle(raw, opts.seed.forwardBase.bundle);
+        }
+        catch (err) {
+            throw new Error(`Cannot read forward-base managed_paths: ${lockPath} unreadable ` +
+                `(${err.message}). Pass --forward-base-managed-paths ` +
+                `to provide MANAGED_PATHS.txt directly.`);
+        }
+    }
+    throw new Error("Cannot resolve forward-base managed_paths: provide either " +
+        "--producer-repo (with method-baseline.lock present) or " +
+        "--forward-base-managed-paths (path to MANAGED_PATHS.txt).");
+}
+/**
+ * Extract managed_paths for the named bundle from a method-baseline.lock
+ * file. Minimal parser — the lock file is line-oriented YAML and we
+ * only need a single nested list per named bundle.
+ */
+export function extractManagedPathsForBundle(lockYaml, bundleName) {
+    const lines = lockYaml.split("\n");
+    let inBundles = false;
+    let inTargetBundle = false;
+    let inManagedPaths = false;
+    const paths = [];
+    for (const line of lines) {
+        if (line.startsWith("bundles:")) {
+            inBundles = true;
+            continue;
+        }
+        if (!inBundles)
+            continue;
+        if (/^\s*-\s*name:\s*(.+)$/.test(line)) {
+            const m = /^\s*-\s*name:\s*(.+)$/.exec(line);
+            inTargetBundle = m !== null && m[1]?.trim() === bundleName;
+            inManagedPaths = false;
+            continue;
+        }
+        if (inTargetBundle && /^\s+managed_paths:\s*$/.test(line)) {
+            inManagedPaths = true;
+            continue;
+        }
+        if (inManagedPaths) {
+            const m = /^\s+-\s+(.+)$/.exec(line);
+            if (m && m[1]) {
+                paths.push(m[1].trim());
+            }
+            else if (/^\s+\w+:/.test(line) || /^\s*-\s*name:/.test(line)) {
+                // End of managed_paths list (either next field or next bundle)
+                inManagedPaths = false;
+            }
+        }
+    }
+    return paths;
+}
+/**
+ * Simple glob matcher supporting `*` (any non-slash chars) and `**`
+ * (any chars including slashes). Used for forbidden_paths.
+ */
+export function matchesGlob(path, pattern) {
+    const re = globToRegex(pattern);
+    return re.test(path);
+}
+function globToRegex(pattern) {
+    // Escape regex metachars except *, then translate * and **.
+    let regex = "";
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            if (pattern[i + 1] === "*") {
+                regex += ".*";
+                i += 2;
+            }
+            else {
+                regex += "[^/]*";
+                i += 1;
+            }
+        }
+        else if (/[.+?^${}()|[\]\\]/.test(ch)) {
+            regex += `\\${ch}`;
+            i += 1;
+        }
+        else {
+            regex += ch;
+            i += 1;
+        }
+    }
+    return new RegExp(`^${regex}$`);
+}
+//# sourceMappingURL=leakage.js.map

package/dist/lib/pack/log.js

@@ -0,0 +1,18 @@
+// Output helpers shared by `pack build` and `pack validate`. Split out so
+// `pack validate` can be imported without pulling in the builder — the
+// verify-only CLI ships validation and must not ship the code that writes
+// a pack (M-ADR 0212 §4.3b).
+export const SECTION_RULE = "═".repeat(59);
+export function section(title) {
+    return `\n${SECTION_RULE}\n  ${title}\n${SECTION_RULE}\n\n`;
+}
+export function info(msg) {
+    return `[INFO] ${msg}\n`;
+}
+export function pass(msg) {
+    return `[PASS] ${msg}\n`;
+}
+export function fail(msg) {
+    return `[FAIL] ${msg}\n`;
+}
+//# sourceMappingURL=log.js.map