@sdd-method/verify-cli 0.1.0

package/dist/lib/list/format.js

@@ -0,0 +1,84 @@
+import { profileFromRepoKind } from "../repo-kind.js";
+const PROFILE_ORDER = ["platform", "application", "integration"];
+export function format(repos, opts) {
+    const filtered = opts.profileFilter
+        ? repos.filter((r) => profileFromRepoKind(r.kind) === opts.profileFilter)
+        : repos;
+    if (opts.format === "json")
+        return formatJson(filtered);
+    return formatText(filtered, opts.verbose === true);
+}
+function formatJson(repos) {
+    const payload = repos.map((r) => ({
+        path: r.path,
+        profile: profileFromRepoKind(r.kind),
+        kind: r.kind,
+        bundle_version: r.bundleVersion,
+        bundles: r.bundles.map(toJsonBundle),
+    }));
+    return JSON.stringify(payload, null, 2) + "\n";
+}
+function toJsonBundle(b) {
+    const out = {
+        name: b.name,
+        version: b.version,
+        is_forward_base: b.isForwardBase,
+        managed_path_count: b.managedPathCount,
+    };
+    if (b.producedByAdopter)
+        out.produced_by_adopter = b.producedByAdopter;
+    if (b.scope)
+        out.scope = b.scope;
+    if (b.requiresForwardBase)
+        out.requires_forward_base = b.requiresForwardBase;
+    if (b.requiresPack)
+        out.requires_pack = b.requiresPack;
+    return out;
+}
+function formatText(repos, verbose) {
+    if (repos.length === 0)
+        return "No SDD repositories found.\n";
+    const grouped = new Map();
+    for (const repo of repos) {
+        const profile = profileFromRepoKind(repo.kind);
+        const list = grouped.get(profile) ?? [];
+        list.push(repo);
+        grouped.set(profile, list);
+    }
+    const lines = [];
+    for (const profile of PROFILE_ORDER) {
+        const list = grouped.get(profile);
+        if (!list || list.length === 0)
+            continue;
+        lines.push(`${profile} (${list.length}):`);
+        for (const repo of list) {
+            lines.push(formatRepoLine(repo, verbose));
+            // Render non-forward-base bundles (adopter packs) as indented
+            // '+' lines beneath the repo line. Forward-base info is already
+            // in the repo line itself.
+            for (const b of repo.bundles) {
+                if (b.isForwardBase)
+                    continue;
+                lines.push(formatPackLine(b, verbose));
+            }
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+function formatRepoLine(repo, verbose) {
+    const version = repo.bundleVersion ?? "no-lock";
+    const base = `  ${repo.path}  [${version}]`;
+    if (!verbose)
+        return base;
+    const fwd = repo.bundles.find((b) => b.isForwardBase);
+    const count = fwd ? ` (${fwd.managedPathCount} managed paths)` : "";
+    return base + count;
+}
+function formatPackLine(b, verbose) {
+    const producer = b.producedByAdopter ? ` from ${b.producedByAdopter}` : "";
+    const requires = b.requiresPack ? ` requires ${b.requiresPack}` : "";
+    const count = verbose ? ` (${b.managedPathCount} managed paths)` : "";
+    return `    + ${b.name} ${b.version}${producer}${requires}${count}`;
+}
+//# sourceMappingURL=format.js.map

package/dist/lib/list/index.js

@@ -0,0 +1,16 @@
+import { discoverSddRepos } from "./discover.js";
+import { format } from "./format.js";
+export async function runList(inputs, write) {
+    const roots = inputs.workspaceRoots.length > 0
+        ? inputs.workspaceRoots
+        : [process.cwd()];
+    const repos = await discoverSddRepos(roots);
+    const output = format(repos, {
+        format: inputs.format,
+        verbose: inputs.verbose === true,
+        ...(inputs.profileFilter ? { profileFilter: inputs.profileFilter } : {}),
+    });
+    write(output);
+    return { exitCode: 0 };
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/lock-file.js

@@ -0,0 +1,413 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { bundleNameFromRepoKind, isForwardBase, readRepoKind, } from "./repo-kind.js";
+export const LOCK_FILE = "method-baseline.lock";
+/**
+ * lock_version 3 adds a **per-path sha256** to each `managed_paths` entry.
+ *
+ * Why: a dry run could previously say only "N conflicting managed file(s)",
+ * which reads as "you have local edits at risk". Twice the truth was "N files
+ * differ because you are several minors behind and every one is untouched" —
+ * established both times by hand-extracting bundles and diffing. The lock
+ * identified WHICH bundle was applied but nothing about its CONTENT, and the
+ * content is unreachable: forward bases are deliberately not cached
+ * (M-ADR 0176 §4.2), `dist/` is gitignored, and lock_version 2 recorded paths
+ * without digests. Recording the digest of each file AS APPLIED makes the lock
+ * self-verifying: pristine-vs-edited is then decidable from the repo alone —
+ * no network, no bundle store, and it survives a fresh clone and CI, which is
+ * exactly where the answer is needed.
+ *
+ * NOT retroactive, by construction: a repo whose last sync predates v3 has no
+ * digests to compare against. That case must say so explicitly rather than
+ * guess — see `classifyConflicts`.
+ */
+export const LOCK_VERSION = 3;
+/** Lock versions this build can read. Older ones are migrated in-memory on read. */
+const READABLE_LOCK_VERSIONS = [2, 3];
+/** `- <64-hex sha256>  <path>` — the sha256sum convention, one line per path. */
+const DIGEST_ENTRY_RE = /^([0-9a-f]{64})  (.+)$/;
+export async function readLockFile(repoRoot) {
+    let raw;
+    try {
+        raw = await readFile(join(repoRoot, LOCK_FILE), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    if (isVersioned(raw))
+        return parseLockFile(raw);
+    const repoKind = await readRepoKind(repoRoot);
+    if (!repoKind) {
+        throw new Error(`Legacy lock detected but cannot infer bundle name: ${LOCK_FILE} is v1 ` +
+            `and .sdd-repo-kind is missing. Set .sdd-repo-kind manually or ` +
+            `delete the lock file before re-syncing.`);
+    }
+    return parseLockFile(raw, { legacyBundleName: bundleNameFromRepoKind(repoKind) });
+}
+export async function writeLockFile(repoRoot, lock) {
+    await writeFile(join(repoRoot, LOCK_FILE), serialiseLockFile(lock), "utf8");
+}
+export function parseLockFile(raw, opts = {}) {
+    if (isVersioned(raw))
+        return parseVersioned(raw);
+    if (!opts.legacyBundleName) {
+        throw new Error(`Cannot parse legacy v1 lock without legacyBundleName option ` +
+            `(needed to migrate to v2 shape).`);
+    }
+    return migrateV1(raw, opts.legacyBundleName);
+}
+export function serialiseLockFile(lock) {
+    const lines = [
+        `method_repo: ${lock.methodRepo}`,
+        `lock_version: ${lock.lockVersion}`,
+        "bundles:",
+    ];
+    for (const b of lock.bundles) {
+        lines.push(`  - name: ${b.name}`, `    bundle_version: "${b.bundleVersion}"`, `    source_commit: "${b.sourceCommit}"`, `    bundle_sha256: "${b.bundleSha256}"`, `    synced_at_utc: "${b.syncedAtUtc}"`, `    is_forward_base: ${b.isForwardBase}`);
+        if (b.producedByAdopter !== undefined) {
+            lines.push(`    produced_by_adopter: "${b.producedByAdopter}"`);
+        }
+        if (b.scope !== undefined) {
+            lines.push(`    scope: "${b.scope}"`);
+        }
+        if (b.requiresForwardBase) {
+            lines.push(`    requires_forward_base:`, `      bundle: "${b.requiresForwardBase.bundle}"`, `      minimum_version: "${b.requiresForwardBase.minimumVersion}"`, `      source_repo: "${b.requiresForwardBase.sourceRepo}"`);
+        }
+        if (b.requiresPack) {
+            lines.push(`    requires_pack:`, `      name: "${b.requiresPack.name}"`, `      version: "${b.requiresPack.version}"`);
+        }
+        lines.push(`    managed_paths:`);
+        for (const p of b.managedPaths) {
+            // `- <digest>  <path>` where a digest is known, bare `- <path>` otherwise.
+            // A bare entry is a truthful "not recorded", which is what a lock migrated
+            // from version 2 carries until its next sync.
+            const digest = b.pathDigests?.[p];
+            lines.push(digest ? `      - ${digest}  ${p}` : `      - ${p}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/** Declared lock version, or null for a legacy v1 lock (no version line). */
+function lockVersionOf(raw) {
+    const m = /^lock_version: *"?(\d+)"?/m.exec(raw);
+    return m ? Number(m[1]) : null;
+}
+function isVersioned(raw) {
+    return lockVersionOf(raw) !== null;
+}
+function stripQuotes(value) {
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function parseVersioned(raw) {
+    let methodRepo;
+    let lockVersion;
+    const bundles = [];
+    let inBundles = false;
+    let inPaths = false;
+    let inForwardBase = false;
+    let inPack = false;
+    let cur = {
+        managedPaths: [],
+    };
+    let forwardBase = {};
+    let pack = {};
+    const flushNestedObjects = () => {
+        if (inForwardBase && forwardBase.bundle && forwardBase.minimumVersion) {
+            cur.requiresForwardBase = {
+                bundle: forwardBase.bundle,
+                minimumVersion: forwardBase.minimumVersion,
+                sourceRepo: forwardBase.sourceRepo ?? "sdd-method",
+            };
+        }
+        if (inPack && pack.name && pack.version) {
+            cur.requiresPack = { name: pack.name, version: pack.version };
+        }
+        inForwardBase = false;
+        inPack = false;
+        forwardBase = {};
+        pack = {};
+    };
+    const flushBundle = () => {
+        if (cur.name === undefined)
+            return;
+        flushNestedObjects();
+        const required = [
+            "name",
+            "bundleVersion",
+            "sourceCommit",
+            "bundleSha256",
+            "syncedAtUtc",
+            "isForwardBase",
+        ];
+        for (const k of required) {
+            if (cur[k] === undefined) {
+                throw new Error(`${LOCK_FILE} bundle entry "${cur.name}" missing required key: ${k}`);
+            }
+        }
+        bundles.push(cur);
+        cur = { managedPaths: [] };
+        inPaths = false;
+    };
+    for (const rawLine of raw.split("\n")) {
+        const line = rawLine.replace(/\r$/, "");
+        if (!inBundles) {
+            if (line === "bundles:") {
+                inBundles = true;
+                continue;
+            }
+            const top = /^([a-z_][a-z0-9_]*): (.*)$/.exec(line);
+            if (top) {
+                const [, key, value] = top;
+                if (key === "method_repo")
+                    methodRepo = stripQuotes(value);
+                else if (key === "lock_version")
+                    lockVersion = Number(stripQuotes(value));
+            }
+            continue;
+        }
+        // Inside the bundles block.
+        if (line.startsWith("  - name:")) {
+            flushBundle();
+            const name = stripQuotes(line.slice("  - name:".length).trim());
+            cur.name = name;
+            continue;
+        }
+        if (line === "    managed_paths:") {
+            flushNestedObjects();
+            inPaths = true;
+            continue;
+        }
+        if (inPaths && line.startsWith("      - ")) {
+            // Tolerate a double-quoted scalar. The writer emits these unquoted
+            // today, but the entries contain ": " (ADR filenames carry a colon), so
+            // a YAML reader parses 113 of 325 entries in one real lock as MAPPINGS
+            // rather than strings — silently, with no error. Quoting on write is the
+            // fix; reading both forms ships first so no lock can be written that an
+            // older reader cannot parse. See method-open-items §3l.
+            const entry = stripQuotes(line.slice("      - ".length));
+            const withDigest = DIGEST_ENTRY_RE.exec(entry);
+            if (withDigest) {
+                const [, digest, path] = withDigest;
+                cur.managedPaths.push(path);
+                (cur.pathDigests ??= {})[path] = digest;
+            }
+            else {
+                // Bare path: a version-2 entry, or a v3 path whose digest was not
+                // recorded. Left out of pathDigests so it reads as "not recorded".
+                cur.managedPaths.push(entry);
+            }
+            continue;
+        }
+        if (line === "    requires_forward_base:") {
+            flushNestedObjects();
+            inForwardBase = true;
+            continue;
+        }
+        if (line === "    requires_pack:") {
+            flushNestedObjects();
+            inPack = true;
+            continue;
+        }
+        // Two-space-indented nested keys (under requires_forward_base / requires_pack)
+        if (inForwardBase || inPack) {
+            const nested = /^      ([a-z_][a-z0-9_]*): (.*)$/.exec(line);
+            if (nested) {
+                const [, key, rawValue] = nested;
+                const value = stripQuotes(rawValue);
+                if (inForwardBase) {
+                    if (key === "bundle")
+                        forwardBase.bundle = value;
+                    else if (key === "minimum_version")
+                        forwardBase.minimumVersion = value;
+                    else if (key === "source_repo")
+                        forwardBase.sourceRepo = value;
+                }
+                else if (inPack) {
+                    if (key === "name")
+                        pack.name = value;
+                    else if (key === "version")
+                        pack.version = value;
+                }
+                continue;
+            }
+            // A non-nested line ends the object scope.
+            flushNestedObjects();
+        }
+        const meta = /^    ([a-z_][a-z0-9_]*): (.*)$/.exec(line);
+        if (meta) {
+            inPaths = false;
+            const [, key, rawValue] = meta;
+            const value = stripQuotes(rawValue);
+            switch (key) {
+                case "bundle_version":
+                    cur.bundleVersion = value;
+                    break;
+                case "source_commit":
+                    cur.sourceCommit = value;
+                    break;
+                case "bundle_sha256":
+                    cur.bundleSha256 = value;
+                    break;
+                case "synced_at_utc":
+                    cur.syncedAtUtc = value;
+                    break;
+                case "is_forward_base":
+                    cur.isForwardBase = value === "true";
+                    break;
+                case "produced_by_adopter":
+                    cur.producedByAdopter = value;
+                    break;
+                case "scope":
+                    cur.scope = value;
+                    break;
+            }
+            continue;
+        }
+        if (line.length > 0 && !line.startsWith(" ") && !line.startsWith("\t")) {
+            inBundles = false;
+        }
+    }
+    flushBundle();
+    if (methodRepo === undefined) {
+        throw new Error(`${LOCK_FILE} is missing required key: method_repo`);
+    }
+    // Older readable versions migrate in-memory and are upgraded on the next
+    // write; a NEWER version is a hard failure, because this build cannot know
+    // what it would be silently dropping.
+    if (!READABLE_LOCK_VERSIONS.includes(lockVersion)) {
+        throw new Error(`${LOCK_FILE} lock_version is ${lockVersion}; this build reads ` +
+            `${READABLE_LOCK_VERSIONS.join(" or ")} and writes ${LOCK_VERSION}` +
+            (lockVersion !== undefined && lockVersion > LOCK_VERSION
+                ? ` — the lock was written by a newer sdd-cli; upgrade rather than downgrading the lock.`
+                : `.`));
+    }
+    return { methodRepo, lockVersion: LOCK_VERSION, bundles };
+}
+function migrateV1(raw, legacyBundleName) {
+    const scalars = new Map();
+    const managedPaths = [];
+    let inManagedList = false;
+    for (const rawLine of raw.split("\n")) {
+        const line = rawLine.replace(/\r$/, "");
+        if (inManagedList) {
+            if (line.startsWith("  - ")) {
+                managedPaths.push(line.slice(4));
+                continue;
+            }
+            inManagedList = false;
+        }
+        if (line === "managed_paths:") {
+            inManagedList = true;
+            continue;
+        }
+        const m = /^([a-z_][a-z0-9_]*): (.*)$/.exec(line);
+        if (m)
+            scalars.set(m[1], stripQuotes(m[2]));
+    }
+    const required = [
+        "method_repo",
+        "bundle_version",
+        "source_commit",
+        "bundle_sha256",
+        "synced_at_utc",
+    ];
+    for (const key of required) {
+        if (!scalars.has(key)) {
+            throw new Error(`${LOCK_FILE} (legacy) is missing required key: ${key}`);
+        }
+    }
+    return {
+        methodRepo: scalars.get("method_repo"),
+        lockVersion: LOCK_VERSION,
+        bundles: [
+            {
+                name: legacyBundleName,
+                bundleVersion: scalars.get("bundle_version"),
+                sourceCommit: scalars.get("source_commit"),
+                bundleSha256: scalars.get("bundle_sha256"),
+                syncedAtUtc: scalars.get("synced_at_utc"),
+                isForwardBase: isForwardBase(legacyBundleName),
+                managedPaths,
+            },
+        ],
+    };
+}
+// ---------------------------------------------------------------------------
+// Convenience helpers for sync code.
+// ---------------------------------------------------------------------------
+export function findBundle(lock, name) {
+    if (!lock)
+        return null;
+    return lock.bundles.find((b) => b.name === name) ?? null;
+}
+/**
+ * Replace the bundle entry with `entry.name`, or append it. Returns a
+ * new LockFile preserving order (existing bundles keep their position;
+ * a new bundle goes at the end).
+ */
+export function upsertBundle(lock, entry) {
+    const base = lock ?? {
+        methodRepo: "sdd-method",
+        lockVersion: LOCK_VERSION,
+        bundles: [],
+    };
+    const idx = base.bundles.findIndex((b) => b.name === entry.name);
+    const bundles = idx >= 0
+        ? base.bundles.map((b, i) => (i === idx ? entry : b))
+        : [...base.bundles, entry];
+    return { ...base, bundles };
+}
+/**
+ * Remove the bundle entry named `name`, preserving the order of the rest.
+ * Returns the lock unchanged if the name is absent. Pure — composed with
+ * `upsertBundle` this gives bundle MIGRATION as a single lock value
+ * (`upsertBundle(removeBundle(lock, old), incoming)`), so one
+ * `writeLockFile` call swaps the blocks with no intermediate state where
+ * neither bundle is recorded.
+ */
+export function removeBundle(lock, name) {
+    const base = lock ?? {
+        methodRepo: "sdd-method",
+        lockVersion: LOCK_VERSION,
+        bundles: [],
+    };
+    return { ...base, bundles: base.bundles.filter((b) => b.name !== name) };
+}
+/**
+ * True if any bundle in the lock other than `excluding` is a forward
+ * base. Used to enforce requires_forward_base for additive layers.
+ */
+export function hasForwardBase(lock, excluding) {
+    if (!lock)
+        return false;
+    return lock.bundles.some((b) => b.name !== excluding && b.isForwardBase);
+}
+/**
+ * Find the forward-base bundle entry in a lock, or null if none.
+ */
+export function findForwardBase(lock, excluding) {
+    if (!lock)
+        return null;
+    return (lock.bundles.find((b) => b.name !== excluding && b.isForwardBase) ?? null);
+}
+export function pathToBundleMap(lock, excluding) {
+    const m = new Map();
+    if (!lock)
+        return m;
+    for (const b of lock.bundles) {
+        if (excluding !== undefined && b.name === excluding)
+            continue;
+        for (const p of b.managedPaths)
+            m.set(p, b.name);
+    }
+    return m;
+}
+//# sourceMappingURL=lock-file.js.map

package/dist/lib/pack/log.js

@@ -0,0 +1,18 @@
+// Output helpers shared by `pack build` and `pack validate`. Split out so
+// `pack validate` can be imported without pulling in the builder — the
+// verify-only CLI ships validation and must not ship the code that writes
+// a pack (M-ADR 0212 §4.3b).
+export const SECTION_RULE = "═".repeat(59);
+export function section(title) {
+    return `\n${SECTION_RULE}\n  ${title}\n${SECTION_RULE}\n\n`;
+}
+export function info(msg) {
+    return `[INFO] ${msg}\n`;
+}
+export function pass(msg) {
+    return `[PASS] ${msg}\n`;
+}
+export function fail(msg) {
+    return `[FAIL] ${msg}\n`;
+}
+//# sourceMappingURL=log.js.map

package/dist/lib/pack/schema.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+/**
+ * Zod schema for adopter pack seeds. Mirrors
+ * docs/method/foundations/schemas/context-pack-seed-schema.yaml.
+ *
+ * Used by `sdd-cli pack validate` for fast feedback during authoring.
+ * The structural parse in seed.ts already enforces presence of required
+ * fields; this schema layer adds value-shape checks (semver patterns,
+ * known forward-base bundle names, non-empty managed_paths).
+ */
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+$/;
+const VERSIONED_RANGE_PATTERN = /^(\^|~|>=)?v?\d+\.\d+\.\d+$/;
+// Exported so the canonical-schema conformance test can assert this vocabulary
+// matches context-pack-seed-schema.yaml's `forward_base.bundle` enum. The two had
+// drifted (canonical carried three values, this four) with nothing to detect it.
+export const KNOWN_FORWARD_BASES = [
+    "app-baseline",
+    "integration-baseline",
+    "platform-baseline",
+    "reverse-baseline",
+];
+export const PackSeedSchema = z.object({
+    version: z
+        .string()
+        .regex(SEMVER_PATTERN, "version must be semver (X.Y.Z)"),
+    scope: z
+        .string()
+        .regex(/^[a-z0-9-]+$/, "scope must be lower-kebab-case slug"),
+    // Optional per ADR 0176 §4.6: absent = profile-agnostic pack.
+    forwardBase: z
+        .object({
+        bundle: z.enum(KNOWN_FORWARD_BASES),
+        minimumVersion: z
+            .string()
+            .regex(/^v\d+\.\d+\.\d+$/, "forward_base.minimum_version must be vX.Y.Z"),
+        sourceRepo: z.string().min(1),
+    })
+        .optional(),
+    // Vendor-base pack pin (M-ADR 0175, seed schema 1.2.0). Present only on a
+    // vendor-base pack: names the vendor and the vendor version whose documented
+    // truth this pack's content encodes.
+    //
+    // The point of a PACK-LEVEL pin is that a consuming SDD does not restate it. A
+    // consumer pins the pack exactly (its bundles-list entry + sha256) and the
+    // vendor version it inherits is DERIVED from here. Recording it consumer-side
+    // as well would be a second source of truth that can silently disagree, and the
+    // pack is authoritative for its own vendor pin.
+    //
+    // `vendorVersion` is free-form by design: it carries either a formal vendor
+    // version or the anchor schema's `<vendor>-docs@YYYY-MM-DD` snapshot form, and
+    // vendors' own version strings are not the method's to constrain.
+    vendorBase: z
+        .object({
+        vendor: z
+            .string()
+            .regex(/^[a-z][a-z0-9-]*$/, "vendor_base.vendor must be a lower-kebab-case slug"),
+        vendorVersion: z.string().min(1, "vendor_base.vendor_version must be non-empty"),
+    })
+        .optional(),
+    minimumSddCliVersion: z
+        .string()
+        .regex(SEMVER_PATTERN, "minimum_sdd_cli_version must be semver (X.Y.Z)"),
+    description: z.string().min(1),
+    include: z.array(z.string()).optional(),
+    managedPaths: z
+        .array(z.string().min(1))
+        .min(1, "managed_paths must have at least one entry"),
+    forbiddenPaths: z.array(z.string()).optional(),
+    // ADR 0176 §4.3: scaffold-source path prefixes; each must cover at
+    // least one managed_paths entry (checked in the superRefine below).
+    scaffoldSourcePaths: z.array(z.string().min(1)).optional(),
+    requiresPack: z
+        .object({
+        name: z.string().min(1),
+        version: z
+            .string()
+            .regex(VERSIONED_RANGE_PATTERN, "requires_pack.version must be a semver range (e.g. ^v1.2.0)"),
+    })
+        .optional(),
+    sourcePath: z.string(),
+});
+const PackSeedSchemaRefined = PackSeedSchema.superRefine((seed, ctx) => {
+    // A vendor-base pack is PROFILE-AGNOSTIC (M-ADR 0176 §4.6, M-ADR 0175): its
+    // content is vendor-defined, so it layers over any baseline and must not pin
+    // one. Declaring both is a contradiction the producer should hear at validate
+    // time rather than discover when a consumer on a different baseline cannot
+    // apply it.
+    if (seed.vendorBase && seed.forwardBase) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["forwardBase"],
+            message: "a vendor_base pack is profile-agnostic and must omit forward_base " +
+                "(M-ADR 0176 §4.6); remove forward_base, or remove vendor_base if this " +
+                "is not a vendor-base pack",
+        });
+    }
+    if (!seed.scaffoldSourcePaths)
+        return;
+    for (const [i, prefix] of seed.scaffoldSourcePaths.entries()) {
+        const covers = seed.managedPaths.some((mp) => mp.startsWith(prefix));
+        if (!covers) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["scaffoldSourcePaths", i],
+                message: `scaffold_source_paths entry "${prefix}" matches no managed_paths entry`,
+            });
+        }
+    }
+});
+export function validateSeed(seed) {
+    const result = PackSeedSchemaRefined.safeParse(seed);
+    if (result.success) {
+        return { ok: true, errors: [] };
+    }
+    const errors = result.error.issues.map((issue) => ({
+        field: issue.path.join("."),
+        message: issue.message,
+    }));
+    return { ok: false, errors };
+}
+//# sourceMappingURL=schema.js.map