@sdd-method/sdd-cli 0.110.2 → 0.111.0

package/scripts/sync-method-baseline.sh

@@ -1,660 +0,0 @@
-#!/bin/bash
-#
-# sync-method-baseline.sh
-# Apply a built method baseline bundle to a target repository.
-#
-# Usage:
-#   ./orchestration/scripts/sync-method-baseline.sh --bundle dist/platform-baseline/platform-baseline-v0.4.0.tar.gz
-#   ./orchestration/scripts/sync-method-baseline.sh --bundle ... --target-repo /path/to/repo --dry-run
-#
-# Multi-bundle lock model (lock_version: 3):
-#   The target repo holds one method-baseline.lock file with a `bundles:`
-#   list. Each entry records a synced bundle (forward base or additive
-#   extension) with its own managed_paths. Re-syncing a bundle replaces
-#   that bundle's entry; other bundles' entries are preserved. Removal
-#   logic is scoped per-bundle so a forward-base sync never deletes
-#   files owned by an extension bundle, and vice versa.
-#
-#   Forward bases (platform-baseline, app-baseline, integration-baseline)
-#   set .sdd-repo-kind. Additive layers (reverse-extension-baseline) do
-#   not, and require a forward base entry already in the lock. See ADR 0135.
-
-set -euo pipefail
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-NC='\033[0m'
-REPO_KIND_FILE=".sdd-repo-kind"
-PROTECTED_PREFIXES=("content/")
-# lock_version 3 adds a per-path sha256 to each managed_paths entry
-# (`- <digest>  <path>`), so a consumer can tell "pristine but older" from
-# "locally edited" without needing the previously-applied bundle. Bumped in
-# lockstep with sdd-cli: a script still writing version 2 would DOWNGRADE a v3
-# lock on its next run and destroy those digests.
-LOCK_VERSION=3
-
-log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
-log_fail() { echo -e "${RED}[FAIL]${NC} $1"; }
-log_pass() { echo -e "${GREEN}[PASS]${NC} $1"; }
-log_section() {
-  echo -e "\n${BLUE}═══════════════════════════════════════════════════════════${NC}"
-  echo -e "${BLUE}  $1${NC}"
-  echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}\n"
-}
-
-usage() {
-  cat <<USAGE
-Usage: $(basename "$0") --bundle <path.tar.gz> [--target-repo <dir>] [--dry-run] [--allow-overwrite] [--no-delete]
-
-Options:
-  --bundle           Required bundle archive generated by build-method-baseline-bundle.sh
-  --target-repo      Target repository root (default: current working directory)
-  --dry-run          Report plan only; do not modify files
-  --allow-overwrite  Overwrite conflicting managed files (default: fail on conflict)
-  --no-delete        Do not delete previously managed files removed from the incoming bundle
-USAGE
-}
-
-BUNDLE=""
-TARGET_REPO="$(pwd)"
-DRY_RUN=0
-ALLOW_OVERWRITE=0
-NO_DELETE=0
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --bundle)
-      BUNDLE="${2:-}"
-      shift 2
-      ;;
-    --target-repo)
-      TARGET_REPO="${2:-}"
-      shift 2
-      ;;
-    --dry-run)
-      DRY_RUN=1
-      shift
-      ;;
-    --allow-overwrite)
-      ALLOW_OVERWRITE=1
-      shift
-      ;;
-    --no-delete)
-      NO_DELETE=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      log_fail "Unknown argument: $1"
-      usage
-      exit 1
-      ;;
-  esac
-done
-
-if [[ -z "$BUNDLE" ]]; then
-  log_fail "--bundle is required"
-  usage
-  exit 1
-fi
-
-if [[ ! -f "$BUNDLE" ]]; then
-  log_fail "Bundle not found: $BUNDLE"
-  exit 1
-fi
-
-if [[ ! -d "$TARGET_REPO" ]]; then
-  log_fail "Target repo not found: $TARGET_REPO"
-  exit 1
-fi
-
-log_section "Sync Method Baseline"
-
-TMP_DIR="$(mktemp -d)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-tar -xzf "$BUNDLE" -C "$TMP_DIR"
-BUNDLE_ROOT="$(find "$TMP_DIR" -mindepth 1 -maxdepth 1 -type d | head -n 1)"
-if [[ -z "$BUNDLE_ROOT" ]]; then
-  log_fail "Could not find extracted bundle root"
-  exit 1
-fi
-
-MANAGED_PATHS_FILE="$BUNDLE_ROOT/MANAGED_PATHS.txt"
-PAYLOAD_DIR="$BUNDLE_ROOT/payload"
-MANIFEST_FILE="$BUNDLE_ROOT/BUNDLE_MANIFEST.yaml"
-LOCK_FILE="$TARGET_REPO/method-baseline.lock"
-
-if [[ ! -f "$MANAGED_PATHS_FILE" || ! -d "$PAYLOAD_DIR" || ! -f "$MANIFEST_FILE" ]]; then
-  log_fail "Bundle missing required files (MANAGED_PATHS.txt, payload/, or BUNDLE_MANIFEST.yaml)"
-  exit 1
-fi
-
-BUNDLE_VERSION="$(awk -F': ' '/^bundle_version:/{gsub(/"/,"",$2); print $2}' "$MANIFEST_FILE")"
-SOURCE_COMMIT="$(awk -F': ' '/^source_commit:/{gsub(/"/,"",$2); print $2}' "$MANIFEST_FILE")"
-BUNDLE_NAME="$(awk -F': ' '/^bundle_name:/{gsub(/"/,"",$2); print $2}' "$MANIFEST_FILE")"
-MIN_SDD_CLI_VERSION="$(awk -F': ' '/^minimum_sdd_cli_version:/{gsub(/"/,"",$2); print $2}' "$MANIFEST_FILE")"
-
-# If the bundle declares a minimum sdd-cli version, enforce it before
-# applying any payload. Relevant since v0.9.0, when catalogue-schema.yaml
-# was relocated from forward bundles to sdd-cli — adopters whose installed
-# sdd-cli predates the relocation cannot read schema correctly.
-if [[ -n "$MIN_SDD_CLI_VERSION" ]]; then
-  if ! command -v sdd-cli >/dev/null 2>&1; then
-    log_fail "Bundle $BUNDLE_NAME v$BUNDLE_VERSION requires sdd-cli >= $MIN_SDD_CLI_VERSION"
-    log_fail "but sdd-cli is not installed."
-    log_fail "Remediation: npm install -g @sdd-method/sdd-cli@^$MIN_SDD_CLI_VERSION"
-    exit 1
-  fi
-  INSTALLED_SDD_CLI="$(sdd-cli --version 2>/dev/null | awk '{print $NF}' | head -1)"
-  if [[ -z "$INSTALLED_SDD_CLI" ]]; then
-    log_fail "Could not determine installed sdd-cli version (sdd-cli --version returned empty)."
-    exit 1
-  fi
-  # Version sort to compare: if min comes before installed (or equals),
-  # installed satisfies the requirement.
-  LOWEST="$(printf '%s\n%s\n' "$MIN_SDD_CLI_VERSION" "$INSTALLED_SDD_CLI" | sort -V | head -1)"
-  if [[ "$LOWEST" != "$MIN_SDD_CLI_VERSION" ]]; then
-    log_fail "Bundle $BUNDLE_NAME v$BUNDLE_VERSION requires sdd-cli >= $MIN_SDD_CLI_VERSION"
-    log_fail "but installed sdd-cli is $INSTALLED_SDD_CLI."
-    log_fail "Remediation: npm install -g @sdd-method/sdd-cli@^$MIN_SDD_CLI_VERSION"
-    exit 1
-  fi
-  log_info "sdd-cli $INSTALLED_SDD_CLI satisfies bundle minimum $MIN_SDD_CLI_VERSION"
-fi
-
-# Bundle classification table.
-#   IS_FORWARD_BASE=1  → sets .sdd-repo-kind, qualifies as a base for additive layers
-#   REPO_KIND_VALUE     → written to .sdd-repo-kind when IS_FORWARD_BASE=1
-case "$BUNDLE_NAME" in
-  platform-baseline)
-    REPO_KIND_VALUE="platform-product"
-    IS_FORWARD_BASE=1
-    ;;
-  app-baseline)
-    REPO_KIND_VALUE="application-product"
-    IS_FORWARD_BASE=1
-    ;;
-  integration-baseline)
-    REPO_KIND_VALUE="integration-product"
-    IS_FORWARD_BASE=1
-    ;;
-  reverse-extension-baseline)
-    REPO_KIND_VALUE=""
-    IS_FORWARD_BASE=0
-    ;;
-  *)
-    log_fail "Unknown bundle_name in manifest: $BUNDLE_NAME"
-    exit 1
-    ;;
-esac
-
-mapfile -t INCOMING_PATHS < "$MANAGED_PATHS_FILE"
-
-for p in "${INCOMING_PATHS[@]}"; do
-  if [[ ! -f "$PAYLOAD_DIR/$p" ]]; then
-    log_fail "Missing payload file listed in MANAGED_PATHS.txt: $p"
-    exit 1
-  fi
-  for prefix in "${PROTECTED_PREFIXES[@]}"; do
-    if [[ "$p" == "$prefix"* ]]; then
-      log_fail "Incoming bundle attempts to manage protected product-owned path: $p"
-      log_fail "Method baseline bundles must not manage files under: ${PROTECTED_PREFIXES[*]}"
-      exit 1
-    fi
-  done
-done
-
-# ---------------------------------------------------------------------------
-# Parse existing lock file (if any) into a working directory.
-#
-#   $LOCK_WORK/order            ordered list of bundle names
-#   $LOCK_WORK/<name>/meta      key=value pairs (bundle metadata)
-#   $LOCK_WORK/<name>/paths     one path per line
-#
-# Supports lock_version 2 and 3 (multi-bundle) and the legacy single-bundle
-# shape (no lock_version, top-level bundle_version, flat managed_paths).
-# Legacy locks are migrated by inferring the bundle name from
-# .sdd-repo-kind.
-# ---------------------------------------------------------------------------
-
-LOCK_WORK="$TMP_DIR/lock-work"
-mkdir -p "$LOCK_WORK"
-: > "$LOCK_WORK/order"
-
-infer_legacy_bundle_name() {
-  # Map .sdd-repo-kind (or legacy .iteraitive-repo-kind) → bundle name.
-  local marker="$TARGET_REPO/$REPO_KIND_FILE"
-  local legacy_marker="$TARGET_REPO/.iteraitive-repo-kind"
-  local repo_kind=""
-  if [[ -f "$marker" ]]; then
-    repo_kind="$(head -n1 "$marker" | tr -d '[:space:]')"
-  elif [[ -f "$legacy_marker" ]]; then
-    repo_kind="$(head -n1 "$legacy_marker" | tr -d '[:space:]')"
-  fi
-  case "$repo_kind" in
-    platform-product)    echo "platform-baseline" ;;
-    application-product) echo "app-baseline" ;;
-    integration-product) echo "integration-baseline" ;;
-    *)                   echo "" ;;
-  esac
-}
-
-write_bundle_dir() {
-  # write_bundle_dir <name> <version> <source_commit> <sha> <synced_at> <is_forward_base> <paths_file>
-  local name="$1" version="$2" commit="$3" sha="$4" synced="$5" forward="$6" paths_file="$7"
-  local dir="$LOCK_WORK/$name"
-  mkdir -p "$dir"
-  {
-    echo "bundle_version=$version"
-    echo "source_commit=$commit"
-    echo "bundle_sha256=$sha"
-    echo "synced_at_utc=$synced"
-    echo "is_forward_base=$forward"
-  } > "$dir/meta"
-  if [[ -n "$paths_file" && -f "$paths_file" ]]; then
-    cp "$paths_file" "$dir/paths"
-  else
-    : > "$dir/paths"
-  fi
-  # Record order if not already present.
-  if ! grep -qFx "$name" "$LOCK_WORK/order"; then
-    echo "$name" >> "$LOCK_WORK/order"
-  fi
-}
-
-if [[ -f "$LOCK_FILE" ]]; then
-  # Detect shape: new locks have a `lock_version:` line near the top.
-  if grep -q '^lock_version:' "$LOCK_FILE"; then
-    # New shape — parse bundle blocks.
-    awk '
-      function flush_bundle() {
-        if (cur_name != "") {
-          print "BUNDLE_END"
-        }
-      }
-      BEGIN { in_bundles = 0; cur_name = ""; in_paths = 0 }
-      /^bundles:[[:space:]]*$/        { in_bundles = 1; next }
-      in_bundles && /^[^[:space:]]/   { flush_bundle(); in_bundles = 0; next }
-      in_bundles && /^  - name:/ {
-        flush_bundle()
-        sub(/^  - name:[[:space:]]*/, "", $0)
-        gsub(/"/, "", $0)
-        cur_name = $0
-        in_paths = 0
-        print "BUNDLE_BEGIN " cur_name
-        next
-      }
-      in_bundles && cur_name != "" && /^    managed_paths:[[:space:]]*$/ {
-        in_paths = 1
-        next
-      }
-      in_bundles && cur_name != "" && in_paths && /^      - / {
-        sub(/^      - /, "", $0)
-        print "PATH " $0
-        next
-      }
-      in_bundles && cur_name != "" && /^    [a-z0-9_]+:/ {
-        in_paths = 0
-        line = $0
-        sub(/^    /, "", line)
-        # Strip surrounding quotes from the value portion only. Note: the
-        # value may itself contain colons (e.g. ISO timestamps), so we
-        # split on the FIRST colon only, not all of them.
-        n = index(line, ":")
-        key = substr(line, 1, n - 1)
-        val = substr(line, n + 1)
-        sub(/^[[:space:]]+/, "", val)
-        gsub(/"/, "", val)
-        print "META " key " " val
-        next
-      }
-      END { flush_bundle() }
-    ' "$LOCK_FILE" > "$TMP_DIR/lock-parsed.txt"
-
-    cur_name=""
-    cur_version=""; cur_commit=""; cur_sha=""; cur_synced=""; cur_forward=""
-    cur_paths_file=""
-    while IFS= read -r line; do
-      case "$line" in
-        BUNDLE_BEGIN\ *)
-          cur_name="${line#BUNDLE_BEGIN }"
-          cur_version=""; cur_commit=""; cur_sha=""; cur_synced=""; cur_forward="false"
-          cur_paths_file="$TMP_DIR/lock-paths-$cur_name"
-          : > "$cur_paths_file"
-          ;;
-        META\ bundle_version\ *)    cur_version="${line#META bundle_version }" ;;
-        META\ source_commit\ *)     cur_commit="${line#META source_commit }" ;;
-        META\ bundle_sha256\ *)     cur_sha="${line#META bundle_sha256 }" ;;
-        META\ synced_at_utc\ *)     cur_synced="${line#META synced_at_utc }" ;;
-        META\ is_forward_base\ *)   cur_forward="${line#META is_forward_base }" ;;
-        PATH\ *)                    echo "${line#PATH }" >> "$cur_paths_file" ;;
-        BUNDLE_END)
-          if [[ -n "$cur_name" ]]; then
-            write_bundle_dir "$cur_name" "$cur_version" "$cur_commit" "$cur_sha" "$cur_synced" "$cur_forward" "$cur_paths_file"
-          fi
-          cur_name=""
-          ;;
-      esac
-    done < "$TMP_DIR/lock-parsed.txt"
-  else
-    # Legacy shape — single bundle, top-level metadata.
-    legacy_name="$(infer_legacy_bundle_name)"
-    if [[ -z "$legacy_name" ]]; then
-      log_fail "Legacy lock detected but cannot infer bundle name from $REPO_KIND_FILE."
-      log_fail "Expected one of: platform-product, application-product, integration-product."
-      exit 1
-    fi
-    legacy_version="$(awk -F': ' '/^bundle_version:/{gsub(/"/,"",$2); print $2}' "$LOCK_FILE")"
-    legacy_commit="$(awk -F': ' '/^source_commit:/{gsub(/"/,"",$2); print $2}' "$LOCK_FILE")"
-    legacy_sha="$(awk -F': ' '/^bundle_sha256:/{gsub(/"/,"",$2); print $2}' "$LOCK_FILE")"
-    legacy_synced="$(awk -F': ' '/^synced_at_utc:/{gsub(/"/,"",$2); print $2}' "$LOCK_FILE")"
-    legacy_paths="$TMP_DIR/legacy-paths"
-    awk '
-      /^managed_paths:/ {in_list=1; next}
-      in_list && /^  - / {sub(/^  - /, ""); print; next}
-      in_list && !/^  - / {in_list=0}
-    ' "$LOCK_FILE" > "$legacy_paths"
-    write_bundle_dir "$legacy_name" "$legacy_version" "$legacy_commit" "$legacy_sha" "$legacy_synced" "true" "$legacy_paths"
-    log_info "Migrated legacy single-bundle lock → multi-bundle (lock_version: $LOCK_VERSION). Inferred bundle: $legacy_name"
-  fi
-fi
-
-# ---------------------------------------------------------------------------
-# Validate protected prefixes against ALL previously-locked paths.
-# ---------------------------------------------------------------------------
-if [[ -d "$LOCK_WORK" && -s "$LOCK_WORK/order" ]]; then
-  while IFS= read -r b; do
-    if [[ -f "$LOCK_WORK/$b/paths" ]]; then
-      while IFS= read -r p; do
-        for prefix in "${PROTECTED_PREFIXES[@]}"; do
-          if [[ "$p" == "$prefix"* ]]; then
-            log_fail "Existing lock contains protected product-owned path: $p (bundle: $b)"
-            log_fail "Resolve this manually before refreshing the method baseline."
-            exit 1
-          fi
-        done
-      done < "$LOCK_WORK/$b/paths"
-    fi
-  done < "$LOCK_WORK/order"
-fi
-
-# ---------------------------------------------------------------------------
-# requires_forward_base check for additive bundles.
-# An additive bundle (e.g. reverse-extension-baseline) requires that the
-# target repo already have at least one forward-base bundle in its lock.
-# ---------------------------------------------------------------------------
-if [[ "$IS_FORWARD_BASE" -eq 0 ]]; then
-  has_forward_base=0
-  if [[ -s "$LOCK_WORK/order" ]]; then
-    while IFS= read -r b; do
-      if [[ "$b" == "$BUNDLE_NAME" ]]; then continue; fi
-      if [[ -f "$LOCK_WORK/$b/meta" ]] && grep -q '^is_forward_base=true$' "$LOCK_WORK/$b/meta"; then
-        has_forward_base=1
-        break
-      fi
-    done < "$LOCK_WORK/order"
-  fi
-  if [[ "$has_forward_base" -eq 0 ]]; then
-    log_fail "$BUNDLE_NAME is an additive extension. Sync a forward base first."
-    log_fail "Forward bases: platform-baseline, app-baseline, integration-baseline."
-    exit 1
-  fi
-fi
-
-# ---------------------------------------------------------------------------
-# ADR transitions (rename / withdrawal / reassignment).
-#
-# Compare the bundle's ADR_TRANSITIONS.yaml against the previously-applied
-# bundle_version recorded in the lock for THIS bundle. Apply transitions
-# whose introduced_in_version is greater than the previous version.
-# ---------------------------------------------------------------------------
-ADR_TRANSITIONS_FILE="$BUNDLE_ROOT/ADR_TRANSITIONS.yaml"
-RENAMES_TO_APPLY=()
-TRANSITION_WARNINGS=()
-
-if [[ -f "$ADR_TRANSITIONS_FILE" ]]; then
-  if ! command -v yq >/dev/null 2>&1; then
-    log_info "yq not available; skipping ADR transitions (install mikefarah/yq to enable)"
-  else
-    PREV_VERSION=""
-    if [[ -f "$LOCK_WORK/$BUNDLE_NAME/meta" ]]; then
-      PREV_VERSION="$(awk -F= '/^bundle_version=/{print $2}' "$LOCK_WORK/$BUNDLE_NAME/meta")"
-    fi
-
-    semver_lt() {
-      # semver_lt A B → exit 0 if A < B. Normalise a leading 'v': the lock
-      # records bundle_version as "v1.2.0" but ADR_TRANSITIONS.yaml records
-      # introduced_in_version as "1.3.0"; without this, sort -V mis-orders the
-      # v-prefixed operand and every rename transition is silently skipped.
-      local a="${1#v}" b="${2#v}"
-      [[ "$a" == "$b" ]] && return 1
-      [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" == "$a" ]]
-    }
-
-    TRANSITION_COUNT="$(yq e '.transitions | length' "$ADR_TRANSITIONS_FILE")"
-    for ((i=0; i<TRANSITION_COUNT; i++)); do
-      kind="$(yq e ".transitions[$i].kind" "$ADR_TRANSITIONS_FILE")"
-      adr_id="$(yq e ".transitions[$i].adr_id" "$ADR_TRANSITIONS_FILE")"
-      introduced="$(yq e ".transitions[$i].introduced_in_version" "$ADR_TRANSITIONS_FILE")"
-
-      # Only apply transitions newer than the previously synced version.
-      if [[ -n "$PREV_VERSION" ]] && ! semver_lt "$PREV_VERSION" "$introduced"; then
-        continue
-      fi
-
-      case "$kind" in
-        rename)
-          from_path="$(yq e ".transitions[$i].from_path" "$ADR_TRANSITIONS_FILE")"
-          to_path="$(yq e ".transitions[$i].to_path" "$ADR_TRANSITIONS_FILE")"
-          if [[ -f "$TARGET_REPO/$from_path" && -f "$TARGET_REPO/$to_path" ]]; then
-            TRANSITION_WARNINGS+=("[ADR $adr_id rename] both paths exist in adopter repo; manual review needed: $from_path → $to_path")
-          elif [[ -f "$TARGET_REPO/$from_path" ]]; then
-            RENAMES_TO_APPLY+=("$from_path|$to_path|$adr_id")
-          fi
-          ;;
-        withdrawal)
-          withdrawn_path="$(yq e ".transitions[$i].withdrawn_path" "$ADR_TRANSITIONS_FILE")"
-          adopter_action="$(yq e ".transitions[$i].adopter_action" "$ADR_TRANSITIONS_FILE")"
-          if [[ -f "$TARGET_REPO/$withdrawn_path" ]]; then
-            TRANSITION_WARNINGS+=("[ADR $adr_id withdrawal] $withdrawn_path is still present. $adopter_action")
-          fi
-          ;;
-        reassignment)
-          new_decision="$(yq e ".transitions[$i].new_decision_path" "$ADR_TRANSITIONS_FILE")"
-          TRANSITION_WARNINGS+=("[ADR $adr_id reassignment] slot now points to a different decision: $new_decision")
-          ;;
-      esac
-    done
-  fi
-fi
-
-# ---------------------------------------------------------------------------
-# Conflicts: incoming files that exist in the target with different content.
-# ---------------------------------------------------------------------------
-CONFLICTS=()
-for p in "${INCOMING_PATHS[@]}"; do
-  target_file="$TARGET_REPO/$p"
-  incoming_file="$PAYLOAD_DIR/$p"
-  if [[ -f "$target_file" ]] && ! cmp -s "$incoming_file" "$target_file"; then
-    CONFLICTS+=("$p")
-  fi
-done
-
-if [[ ${#CONFLICTS[@]} -gt 0 && "$ALLOW_OVERWRITE" -ne 1 ]]; then
-  log_fail "Found ${#CONFLICTS[@]} conflicting managed file(s). Re-run with --allow-overwrite to apply."
-  printf '%s\n' "${CONFLICTS[@]}" | sed 's/^/  - /'
-  exit 1
-fi
-
-# Cross-bundle ownership conflict: a path managed by another bundle in the
-# lock cannot be claimed by this bundle. Sync must remain federated.
-if [[ -s "$LOCK_WORK/order" ]]; then
-  while IFS= read -r b; do
-    if [[ "$b" == "$BUNDLE_NAME" ]]; then continue; fi
-    if [[ -f "$LOCK_WORK/$b/paths" ]]; then
-      for p in "${INCOMING_PATHS[@]}"; do
-        if grep -qFx "$p" "$LOCK_WORK/$b/paths"; then
-          log_fail "Path '$p' is already managed by bundle '$b'; cannot also be claimed by '$BUNDLE_NAME'."
-          log_fail "Method baselines must not overlap. Fix upstream and rebuild."
-          exit 1
-        fi
-      done
-    fi
-  done < "$LOCK_WORK/order"
-fi
-
-# ---------------------------------------------------------------------------
-# Removals: paths previously managed by THIS bundle that are no longer in
-# the incoming list.
-# ---------------------------------------------------------------------------
-REMOVE_PATHS=()
-PREV_BUNDLE_PATHS_FILE=""
-if [[ -f "$LOCK_WORK/$BUNDLE_NAME/paths" ]]; then
-  PREV_BUNDLE_PATHS_FILE="$LOCK_WORK/$BUNDLE_NAME/paths"
-fi
-
-if [[ "$NO_DELETE" -ne 1 && -n "$PREV_BUNDLE_PATHS_FILE" && -s "$PREV_BUNDLE_PATHS_FILE" ]]; then
-  while IFS= read -r prev; do
-    keep=0
-    for cur in "${INCOMING_PATHS[@]}"; do
-      if [[ "$prev" == "$cur" ]]; then
-        keep=1
-        break
-      fi
-    done
-    if [[ "$keep" -eq 0 ]]; then
-      REMOVE_PATHS+=("$prev")
-    fi
-  done < "$PREV_BUNDLE_PATHS_FILE"
-fi
-
-log_info "Bundle: $BUNDLE_NAME (version: $BUNDLE_VERSION)"
-log_info "Incoming managed files: ${#INCOMING_PATHS[@]}"
-log_info "Conflicts: ${#CONFLICTS[@]}"
-log_info "Removals from previous sync of this bundle: ${#REMOVE_PATHS[@]}"
-log_info "ADR renames to apply: ${#RENAMES_TO_APPLY[@]}"
-log_info "ADR transition warnings: ${#TRANSITION_WARNINGS[@]}"
-log_info "Protected ownership prefixes: ${PROTECTED_PREFIXES[*]}"
-
-if [[ ${#TRANSITION_WARNINGS[@]} -gt 0 ]]; then
-  log_info "ADR transition notices:"
-  printf '%s\n' "${TRANSITION_WARNINGS[@]}" | sed 's/^/  ! /'
-fi
-
-if [[ "$DRY_RUN" -eq 1 ]]; then
-  log_info "Dry run enabled. No files modified."
-  if [[ ${#CONFLICTS[@]} -gt 0 ]]; then
-    log_info "Conflicting files:"
-    printf '%s\n' "${CONFLICTS[@]}" | sed 's/^/  - /'
-  fi
-  if [[ ${#REMOVE_PATHS[@]} -gt 0 ]]; then
-    log_info "Files that would be removed:"
-    printf '%s\n' "${REMOVE_PATHS[@]}" | sed 's/^/  - /'
-  fi
-  if [[ ${#RENAMES_TO_APPLY[@]} -gt 0 ]]; then
-    log_info "ADR renames that would be applied:"
-    for r in "${RENAMES_TO_APPLY[@]}"; do
-      from="${r%%|*}"; rest="${r#*|}"; to="${rest%%|*}"; aid="${rest##*|}"
-      echo "  - [ADR $aid] $from → $to"
-    done
-  fi
-  exit 0
-fi
-
-# ---------------------------------------------------------------------------
-# Apply ADR renames BEFORE the file copy phase so the new path doesn't
-# collide with the old one when both are tracked in git.
-# ---------------------------------------------------------------------------
-for r in "${RENAMES_TO_APPLY[@]}"; do
-  from="${r%%|*}"; rest="${r#*|}"; to="${rest%%|*}"; aid="${rest##*|}"
-  mkdir -p "$TARGET_REPO/$(dirname "$to")"
-  if [[ -d "$TARGET_REPO/.git" ]] && git -C "$TARGET_REPO" ls-files --error-unmatch "$from" >/dev/null 2>&1; then
-    git -C "$TARGET_REPO" mv "$from" "$to"
-    log_info "Renamed (git mv) [ADR $aid]: $from → $to"
-  else
-    mv "$TARGET_REPO/$from" "$TARGET_REPO/$to"
-    log_info "Renamed [ADR $aid]: $from → $to"
-  fi
-done
-
-# ---------------------------------------------------------------------------
-# Apply: copy incoming files, remove stale ones.
-# ---------------------------------------------------------------------------
-for p in "${INCOMING_PATHS[@]}"; do
-  mkdir -p "$TARGET_REPO/$(dirname "$p")"
-  cp "$PAYLOAD_DIR/$p" "$TARGET_REPO/$p"
-done
-
-for p in "${REMOVE_PATHS[@]}"; do
-  rm -f "$TARGET_REPO/$p"
-done
-
-# Forward bases write the repo-kind marker; additive layers don't touch it.
-if [[ "$IS_FORWARD_BASE" -eq 1 ]]; then
-  printf '%s\n' "$REPO_KIND_VALUE" > "$TARGET_REPO/$REPO_KIND_FILE"
-fi
-
-# ---------------------------------------------------------------------------
-# Update lock work-dir for this bundle, then emit merged lock file.
-# ---------------------------------------------------------------------------
-SYNCED_AT_UTC="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
-BUNDLE_SHA="$(sha256sum "$BUNDLE" | awk '{print $1}')"
-INCOMING_PATHS_FILE="$TMP_DIR/incoming-paths.txt"
-printf '%s\n' "${INCOMING_PATHS[@]}" > "$INCOMING_PATHS_FILE"
-if [[ "$IS_FORWARD_BASE" -eq 1 ]]; then
-  forward_str="true"
-else
-  forward_str="false"
-fi
-write_bundle_dir "$BUNDLE_NAME" "$BUNDLE_VERSION" "$SOURCE_COMMIT" "$BUNDLE_SHA" "$SYNCED_AT_UTC" "$forward_str" "$INCOMING_PATHS_FILE"
-
-{
-  echo "method_repo: sdd-method"
-  echo "lock_version: $LOCK_VERSION"
-  echo "bundles:"
-  while IFS= read -r b; do
-    [[ -z "$b" ]] && continue
-    meta="$LOCK_WORK/$b/meta"
-    paths="$LOCK_WORK/$b/paths"
-    bv="$(grep '^bundle_version=' "$meta" | cut -d= -f2-)"
-    sc="$(grep '^source_commit=' "$meta" | cut -d= -f2-)"
-    bsh="$(grep '^bundle_sha256=' "$meta" | cut -d= -f2-)"
-    sa="$(grep '^synced_at_utc=' "$meta" | cut -d= -f2-)"
-    fb="$(grep '^is_forward_base=' "$meta" | cut -d= -f2-)"
-    echo "  - name: $b"
-    echo "    bundle_version: \"$bv\""
-    echo "    source_commit: \"$sc\""
-    echo "    bundle_sha256: \"$bsh\""
-    echo "    synced_at_utc: \"$sa\""
-    echo "    is_forward_base: $fb"
-    echo "    managed_paths:"
-    if [[ -s "$paths" ]]; then
-      while IFS= read -r p; do
-        # lock_version 3: entries are `<sha256>  <path>`. For the bundle being
-        # synced the digest is computed from the PAYLOAD — what this run applies.
-        # Entries for OTHER bundles were parsed out of the existing lock as opaque
-        # strings, so any digest they already carry round-trips untouched; they are
-        # re-emitted verbatim rather than re-hashed against a payload this run does
-        # not have.
-        if [[ "$b" == "$BUNDLE_NAME" && "$p" != *"  "* && -f "$PAYLOAD_DIR/$p" ]]; then
-          echo "      - $(sha256sum "$PAYLOAD_DIR/$p" | awk '{print $1}')  $p"
-        else
-          echo "      - $p"
-        fi
-      done < "$paths"
-    fi
-  done < "$LOCK_WORK/order"
-} > "$LOCK_FILE"
-
-log_pass "Method baseline synced to: $TARGET_REPO"
-log_info "Updated lock file: method-baseline.lock (lock_version: $LOCK_VERSION)"
-if [[ "$IS_FORWARD_BASE" -eq 1 ]]; then
-  log_info "Set repo kind marker: $REPO_KIND_FILE = $REPO_KIND_VALUE"
-else
-  log_info "Additive layer applied; .sdd-repo-kind unchanged."
-fi