@slats/claude-assets-sync 0.1.4 → 0.2.0

package/docs/claude/skills/claude-sync-applier/knowledge/reference-files.md

@@ -0,0 +1,120 @@
+# Reference Files
+
+The two stub files are **identical across all consumers**. Copy verbatim, do
+no substitution — the stubs discover package metadata at runtime via
+`import.meta.url`.
+
+Reference consumer: `packages/canard/schema-form`.
+
+---
+
+## `bin/claude-sync.mjs`
+
+Source of truth: `packages/canard/schema-form/bin/claude-sync.mjs`.
+
+Expected content (must match exactly):
+
+```js
+#!/usr/bin/env node
+import { runCli } from '@slats/claude-assets-sync';
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(
+  await readFile(resolve(packageRoot, 'package.json'), 'utf-8'),
+);
+
+if (typeof pkg.claude?.assetPath === 'string') {
+  runCli(process.argv, {
+    packageRoot,
+    packageName: pkg.name,
+    packageVersion: pkg.version,
+    assetPath: pkg.claude.assetPath,
+  }).catch((err) => {
+    process.stderr.write(
+      `[${pkg.name}] claude-sync failed: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+    process.exit(1);
+  });
+}
+```
+
+**Notes**
+
+- `import.meta.url` is resolved at runtime to the installed file path, so
+  `packageRoot` works both during local development and when consumed as a
+  dependency.
+- `pkg.claude?.assetPath` missing → the stub is a silent no-op. That is the
+  feature that lets a package opt out without shipping broken bins.
+- Emit to stderr on failure and exit 1. Do not `throw` — the CLI is the
+  process boundary.
+
+After writing, make it executable:
+
+```bash
+chmod +x ${TARGET_PATH}/bin/claude-sync.mjs
+```
+
+---
+
+## `scripts/build-hashes.mjs`
+
+Source of truth: `packages/canard/schema-form/scripts/build-hashes.mjs`.
+
+Expected content (must match exactly):
+
+```js
+#!/usr/bin/env node
+// Thin wrapper — parses this package's package.json and delegates to
+// @slats/claude-assets-sync/buildHashes. The `claude.assetPath` convention
+// lives here, in the consumer; the library is generic.
+import { buildHashes } from '@slats/claude-assets-sync/buildHashes';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+const packageRoot = process.cwd();
+const pkg = JSON.parse(
+  await readFile(resolve(packageRoot, 'package.json'), 'utf-8'),
+);
+
+if (typeof pkg.claude?.assetPath === 'string') {
+  try {
+    const { outPath, fileCount } = await buildHashes({
+      packageRoot,
+      packageName: pkg.name,
+      packageVersion: pkg.version,
+      assetPath: pkg.claude.assetPath,
+    });
+    console.log(
+      `✓ claude-hashes.json written: ${fileCount} file(s) → ${outPath}`,
+    );
+  } catch (err) {
+    console.error('❌ build-hashes failed:', err?.message ?? err);
+    process.exit(1);
+  }
+}
+```
+
+**Notes**
+
+- `packageRoot = process.cwd()` intentionally — this script runs via
+  `yarn <shortcut> build:hashes` from the package directory.
+- Same no-op behavior when `claude.assetPath` is missing.
+- Emits to stdout on success (humans read it during the build).
+
+No `chmod +x` needed — it's invoked via `node scripts/build-hashes.mjs`.
+
+---
+
+## Verification
+
+Before declaring Step 1/Step 2 complete, diff against the reference:
+
+```bash
+diff packages/canard/schema-form/bin/claude-sync.mjs ${TARGET_PATH}/bin/claude-sync.mjs
+diff packages/canard/schema-form/scripts/build-hashes.mjs ${TARGET_PATH}/scripts/build-hashes.mjs
+```
+
+Both diffs must be empty.

package/docs/claude/skills/claude-sync-applier/knowledge/smoke-tests.md

@@ -0,0 +1,102 @@
+# E2E Smoke Tests — 6-path matrix
+
+**Run from `/tmp/...` — never from the monorepo root or `${TARGET_PATH}/`.**
+
+`--scope=project` walks `cwd` upward looking for an existing `.claude`
+directory. Running from the monorepo would reuse or mutate the real repo's
+`.claude`, which is a destructive error.
+
+No fake `node_modules` needed — the bin resolves everything via
+`import.meta.url`.
+
+---
+
+## Setup
+
+```bash
+BIN=$PWD/${TARGET_PATH}/bin/claude-sync.mjs
+DIR=/tmp/claude-sync-smoke-${SHORTCUT:-target}
+[ -d "$DIR" ] && find "$DIR" -mindepth 1 -delete
+mkdir -p "$DIR" && cd "$DIR"
+```
+
+`[ -d ... ] && find -delete` keeps the setup idempotent. **Never** use
+`rm -rf` or unquoted `*` globs — too easy to nuke the wrong directory.
+
+---
+
+## Matrix
+
+Execute sequentially. `EXIT=$?` after each so the value is captured before the
+next command overwrites `$?`.
+
+| # | Command                                                                     | Expected exit | Purpose                                                  |
+|---|-----------------------------------------------------------------------------|---------------|----------------------------------------------------------|
+| 1 | `node "$BIN" --scope=project --dry-run`                                     | 0             | Dry run on empty dir — previews actions, no writes.      |
+| 2 | `node "$BIN" --scope=project`                                               | 0             | First real install — writes `.claude/` under `$DIR`.     |
+| 3 | `node "$BIN" --scope=project`                                               | 0             | Re-run — no-op because everything is already up-to-date. |
+| 4 | (after tampering) `CI=true node "$BIN" --scope=project`                     | **2**         | CI + tampered content → refuse to overwrite.             |
+| 5 | `CI=true node "$BIN" --scope=project --force`                               | 0             | `--force` overrides the refusal.                         |
+| 6 | `CI=true node "$BIN"`                                                       | **2**         | Missing `--scope` in non-TTY context → exit 2.           |
+
+### Tamper step (between path 3 and path 4)
+
+```bash
+find .claude -name SKILL.md -exec sh -c 'echo tampered >> "$1"' _ {} \;
+```
+
+Appends `tampered` to every `SKILL.md` under the local `.claude/`. This
+simulates a human edit that the CI-mode bin must detect and refuse to clobber.
+
+---
+
+## Execution Shape
+
+Split into **two bash calls** because `cwd` resets between Bash tool
+invocations.
+
+**First call** — paths 1–3:
+
+```bash
+BIN=$PWD/${TARGET_PATH}/bin/claude-sync.mjs
+DIR=/tmp/claude-sync-smoke-${SHORTCUT:-target}
+[ -d "$DIR" ] && find "$DIR" -mindepth 1 -delete
+mkdir -p "$DIR" && cd "$DIR"
+
+node "$BIN" --scope=project --dry-run; echo "EXIT=$?"   # expect 0
+node "$BIN" --scope=project;           echo "EXIT=$?"   # expect 0
+node "$BIN" --scope=project;           echo "EXIT=$?"   # expect 0
+```
+
+**Second call** — paths 4–6 (re-enter `$DIR`, reuse state from first call):
+
+```bash
+DIR=/tmp/claude-sync-smoke-${SHORTCUT:-target}
+BIN=$PWD/${TARGET_PATH}/bin/claude-sync.mjs
+cd "$DIR"
+
+find .claude -name SKILL.md -exec sh -c 'echo tampered >> "$1"' _ {} \;
+CI=true node "$BIN" --scope=project;         echo "EXIT=$?"   # expect 2
+CI=true node "$BIN" --scope=project --force; echo "EXIT=$?"   # expect 0
+CI=true node "$BIN";                         echo "EXIT=$?"   # expect 2
+```
+
+Note: `$PWD` in the second call is the parent shell's cwd (monorepo root), so
+`BIN` resolves correctly. `cd "$DIR"` then moves into the smoke directory
+before invoking.
+
+---
+
+## Failure Handling
+
+| Observed | Meaning                                                                 | Action                                                             |
+|----------|-------------------------------------------------------------------------|--------------------------------------------------------------------|
+| 1 ≠ 0    | Dry-run crashed. Likely a stub or engine bug.                           | Stop, capture stderr, report.                                      |
+| 2 ≠ 0    | First write failed. Likely permissions, engine bug, or manifest issue.  | Stop, inspect `dist/claude-hashes.json`, report.                   |
+| 3 ≠ 0    | Idempotency broken — re-run should be no-op.                            | Stop, diff `$DIR/.claude` before/after, report.                    |
+| 4 = 0    | CI mode did not refuse tampered files. Safety regression.               | Stop — the engine's CI gate is broken.                             |
+| 5 ≠ 0    | `--force` failed to override. Check engine.                             | Stop, report.                                                      |
+| 6 = 0    | Engine defaulted a scope in non-TTY context. Should require `--scope`.  | Stop, report.                                                      |
+
+Do not attempt to "make the tests pass" by altering expectations. The matrix
+encodes invariants of the engine — a mismatch is a real regression upstream.

package/docs/consumer-integration.md

@@ -0,0 +1,153 @@
+# Consumer Integration Template
+
+How to make a package "claude-sync aware" so `claude-sync` discovers and injects its `docs/claude/` tree into end-user `.claude` directories.
+
+## 1. `package.json` additions
+
+```jsonc
+{
+  "name": "@your-scope/your-package",
+  "version": "…",
+  "bin": {
+    "claude-sync": "./bin/claude-sync.mjs"
+  },
+  "files": [
+    "dist",
+    "docs",
+    "dist/claude-hashes.json",
+    "bin",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "… && yarn build:hashes",
+    "build:hashes": "node scripts/build-hashes.mjs"
+  },
+  "dependencies": {
+    "@slats/claude-assets-sync": "workspace:^",
+  },
+  "claude": {
+    "assetPath": "docs/claude"
+  }
+}
+```
+
+Do **not** expose `./bin/*` in `exports`. That would let consumer bundlers accidentally pull CLI code into app bundles.
+
+## 2. `bin/claude-sync.mjs` (3-line re-export stub)
+
+```javascript
+#!/usr/bin/env node
+import { runCli } from '@slats/claude-assets-sync';
+
+runCli(process.argv, { invokedFromBin: import.meta.url }).catch((err) => {
+  process.stderr.write(
+    `[@your-scope/your-package] claude-sync failed: ${err instanceof Error ? err.message : String(err)}\n`,
+  );
+  process.exit(1);
+});
+```
+
+`runCli` determines the implicit `--package` target in this priority order:
+
+1. `--all` or `--package=<name>` (explicit)
+2. The consumer that owns `process.cwd()` (i.e. the terminal you launched from). When you `cd` into a consumer's package directory and run `yarn claude-sync`, that consumer is picked automatically.
+3. The consumer that owns `invokedFromBin` (fallback). This keeps bare `npx <pkg> claude-sync` working from arbitrary cwds — including from inside another consumer's directory where option 2 would have picked a different package.
+4. The sole discovered consumer, if exactly one exists.
+5. Otherwise an error asking for `--package=<name>` or `--all`.
+
+Passing `invokedFromBin: import.meta.url` remains the mechanism for the fallback case. Omit it in slats's own global bin so it behaves as a cross-consumer dispatcher.
+
+Remember `chmod +x bin/claude-sync.mjs` (or rely on `files` entry to ship executable bit via npm).
+
+## 3. `scripts/build-hashes.mjs` (one line import)
+
+```javascript
+#!/usr/bin/env node
+import { buildHashes } from '@slats/claude-assets-sync/buildHashes';
+
+try {
+  const { outPath, fileCount } = await buildHashes();
+  console.log(`✓ claude-hashes.json written: ${fileCount} file(s) → ${outPath}`);
+} catch (err) {
+  console.error('❌ buildHashes failed:', err?.message ?? err);
+  process.exit(1);
+}
+```
+
+This reads the current `package.json` + its `claude.assetPath`, hashes every file under the asset root (ignoring `.omc/**`, `*.log`, `.DS_Store`), and writes `dist/claude-hashes.json`.
+
+## 4. Isolation guardrails (optional but recommended)
+
+In a `.dependency-cruiser.cjs`:
+
+```javascript
+{
+  name: 'src-no-bin',
+  severity: 'error',
+  from: { path: '^src/' },
+  to: { path: '^bin/' },
+},
+{
+  name: 'src-no-docs',
+  severity: 'error',
+  from: { path: '^src/' },
+  to: { path: '^docs/' },
+},
+{
+  name: 'src-no-claude-assets-sync',
+  severity: 'error',
+  from: { path: '^src/' },
+  to: { path: 'node_modules/@slats/claude-assets-sync' },
+},
+```
+
+Plus `"sideEffects": false` in `package.json`. The guardrails ensure the CLI engine never leaks into consumer runtime bundles.
+
+## 5. End-user invocations
+
+| Install topology | Working invocations |
+|---|---|
+| Consumer is a **direct dep** of the user's project | `npx claude-sync --scope=user` *(bare)* |
+| Always works (preferred in docs) | `npx -p @your-scope/your-package claude-sync --scope=user` |
+| Consumer is a **transitive dep** | `npx -p @your-scope/your-package claude-sync --scope=user` |
+| User has no consumer installed | `npx @slats/claude-assets-sync --package=@your-scope/your-package --scope=user` |
+| Multiple consumers discovered | `npx claude-sync --package=@your-scope/your-package` *or* `npx claude-sync --all` |
+
+### Scope resolution (project)
+
+For `--scope=project`, the target `.claude` directory is resolved by walking up from `process.cwd()` and reusing the first existing `.claude` directory found. Only if no ancestor owns a `.claude` does the CLI fall back to `process.cwd()/.claude`.
+
+```
+workspace/
+  .claude/                            ← reused target (auto-located)
+  packages/
+    @your-scope/your-package/         ← cd here and run claude-sync
+      bin/claude-sync.mjs
+```
+
+Running `yarn claude-sync --scope=project` from `packages/@your-scope/your-package/` injects into `workspace/.claude`, not `packages/@your-scope/your-package/.claude`. The CLI logs `(auto-located)` in its resolution line when this happens.
+
+## 6. Authoring `docs/claude/`
+
+Any file tree works, but the recommended layout is:
+
+```
+docs/claude/
+├── skills/
+│   └── <skill-name>/
+│       ├── SKILL.md
+│       └── knowledge/...
+├── rules/...
+└── commands/...
+```
+
+The hash manifest tracks every file under `docs/claude/` relative to the asset root. On inject, the CLI copies skills/rules/commands into the matching subtree under `.claude/`.
+
+## 7. Verification checklist
+
+- [ ] `yarn build` succeeds and emits `dist/claude-hashes.json` alongside the rest of `dist/`.
+- [ ] `node bin/claude-sync.mjs --help` prints the `claude-sync` subcommand tree.
+- [ ] `node bin/claude-sync.mjs list --json` emits an entry for your package with `hashesPresent: true`.
+- [ ] `node bin/claude-sync.mjs --scope=project --dry-run --package=@your-scope/your-package` emits a copy plan.
+- [ ] `yarn depcheck` (or whatever your dep-cruiser invocation is named) reports zero new violations.
+- [ ] Consumer bundler tree-shakes away CLI code (verify by greping the built bundle: should contain zero references to `@slats/claude-assets-sync`).

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@slats/claude-assets-sync",
-  "version": "0.1.4",
-  "description": "CLI tool to sync Claude commands and skills from npm packages to your project's .claude directory",
+  "version": "0.2.0",
+  "description": "Shared CLI engine that lets consumer packages inject their Claude docs (skills, rules, commands) into a user's .claude directory via a thin bin/inject-docs wrapper.",
   "keywords": [
     "claude",
     "claude-code",
     "cli",
-    "sync",
-    "commands",
+    "inject",
+    "docs",
     "skills",
     "assets"
   ],
@@ -29,23 +29,34 @@
       "source": "./src/index.ts",
       "import": "./dist/index.mjs",
       "require": "./dist/index.cjs"
+    },
+    "./buildHashes": {
+      "import": "./scripts/buildHashes.mjs"
     }
   },
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
-  "bin": "./dist/cli.mjs",
+  "bin": {
+    "claude-build-hashes": "./scripts/claude-build-hashes.mjs",
+    "claude-sync": "./bin/claude-sync.mjs"
+  },
   "files": [
     "dist",
+    "docs",
+    "bin",
+    "scripts",
     "README.md"
   ],
   "scripts": {
-    "build": "node scripts/inject-version.js && rollup -c && yarn build:types",
+    "build": "node scripts/inject-version.js && rollup -c && yarn build:types && yarn build:hashes",
+    "build:hashes": "node scripts/build-hashes.mjs",
     "build:publish:npm": "yarn build && yarn publish:npm",
     "build:types": "node ../../aileron/script/build/buildTypes.mjs",
-    "dev": "node scripts/inject-version.js && tsx src/cli.ts",
+    "dev": "node scripts/inject-version.js && tsx src/main.ts",
     "format": "prettier --write \"src/**/*.ts\"",
     "lint": "eslint \"src/**/*.ts\"",
+    "prepublishOnly": "yarn build",
     "publish:npm": "yarn npm publish --access public",
     "test": "vitest",
     "version:major": "yarn version major",
@@ -53,17 +64,14 @@
     "version:patch": "yarn version patch"
   },
   "dependencies": {
-    "@winglet/react-utils": "^0.11.2",
+    "@inquirer/prompts": "^8.4.2",
     "commander": "^12.1.0",
-    "ink": "^6.6.0",
-    "ink-select-input": "^6.2.0",
-    "ink-spinner": "^5.0.0",
-    "picocolors": "^1.1.1",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1"
+    "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/react": "^19.0.0",
-    "ink-testing-library": "^4.0.0"
+    "@inquirer/testing": "^3.3.5"
+  },
+  "claude": {
+    "assetPath": "docs/claude"
   }
 }

package/scripts/build-hashes.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Thin wrapper — parses this package's package.json and delegates to
+// @slats/claude-assets-sync/buildHashes. The `claude.assetPath` convention
+// lives here, in the consumer; the library is generic.
+import { buildHashes } from '@slats/claude-assets-sync/buildHashes';
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(
+  await readFile(resolve(packageRoot, 'package.json'), 'utf-8'),
+);
+
+if (typeof pkg.claude?.assetPath === 'string') {
+  try {
+    const { outPath, fileCount } = await buildHashes({
+      packageRoot,
+      packageName: pkg.name,
+      packageVersion: pkg.version,
+      assetPath: pkg.claude.assetPath,
+    });
+    console.log(
+      `✓ claude-hashes.json written: ${fileCount} file(s) → ${outPath}`,
+    );
+  } catch (err) {
+    console.error('❌ build-hashes failed:', err?.message ?? err);
+    process.exit(1);
+  }
+}

package/scripts/buildHashes.d.mts

@@ -0,0 +1,15 @@
+export interface BuildHashesOptions {
+  packageRoot?: string;
+  packageName?: string;
+  packageVersion?: string;
+  assetPathRel?: string;
+}
+
+export interface BuildHashesResult {
+  outPath: string;
+  fileCount: number;
+}
+
+export function buildHashes(
+  opts?: BuildHashesOptions,
+): Promise<BuildHashesResult>;

package/scripts/buildHashes.mjs

@@ -0,0 +1,82 @@
+// Library + importable implementation for the hash manifest builder.
+//
+// Self-executing CLI behavior lives in `./claude-build-hashes.mjs` so this
+// file stays free of top-level await and can be bundled into CJS/ESM outputs
+// via Rollup without format errors.
+//
+// Exported for:
+//   - Consumer packages: `import { buildHashes } from '@slats/claude-assets-sync/buildHashes'`
+//   - Standalone bin: `./claude-build-hashes.mjs`
+//
+// The caller owns all package metadata. This function does not read
+// package.json — consumers parse their own manifest and pass a ready-made
+// set of values so the library stays free of field-shape assumptions.
+
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+
+const MANIFEST_FILENAME = 'claude-hashes.json';
+const NOISE = [/(^|\/)\.omc(\/|$)/, /(^|\/)\.DS_Store$/, /\.log$/];
+
+const toPosix = (p) => (sep === '/' ? p : p.split(sep).join('/'));
+
+async function* walk(root) {
+  let entries;
+  try {
+    entries = await readdir(root, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === 'ENOENT') return;
+    throw err;
+  }
+  for (const entry of entries) {
+    const abs = join(root, entry.name);
+    if (entry.isDirectory()) yield* walk(abs);
+    else if (entry.isFile()) yield abs;
+  }
+}
+
+export async function buildHashes(opts) {
+  if (
+    !opts ||
+    typeof opts.packageRoot !== 'string' ||
+    typeof opts.packageName !== 'string' ||
+    typeof opts.packageVersion !== 'string' ||
+    typeof opts.assetPath !== 'string'
+  ) {
+    throw new Error(
+      'buildHashes requires { packageRoot, packageName, packageVersion, assetPath }.',
+    );
+  }
+  const { packageRoot, packageName, packageVersion, assetPath } = opts;
+  if (!isAbsolute(packageRoot)) {
+    throw new Error(
+      `packageRoot must be an absolute path; received: ${packageRoot}`,
+    );
+  }
+  const assetRoot = resolve(packageRoot, assetPath);
+  const files = {};
+  for await (const abs of walk(assetRoot)) {
+    const rel = toPosix(relative(assetRoot, abs));
+    if (NOISE.some((re) => re.test(rel))) continue;
+    const buf = await readFile(abs);
+    files[rel] = createHash('sha256').update(buf).digest('hex');
+  }
+  const sorted = Object.fromEntries(
+    Object.entries(files).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+  );
+  const manifest = {
+    schemaVersion: 1,
+    package: { name: packageName, version: packageVersion },
+    generatedAt: new Date().toISOString(),
+    algorithm: 'sha256',
+    assetRoot: assetPath,
+    files: sorted,
+    previousVersions: {},
+  };
+  const distDir = resolve(packageRoot, 'dist');
+  await mkdir(distDir, { recursive: true });
+  const outPath = join(distDir, MANIFEST_FILENAME);
+  await writeFile(outPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf-8');
+  return { outPath, fileCount: Object.keys(sorted).length };
+}

package/scripts/claude-build-hashes.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Standalone CLI for `claude-build-hashes`.
+//
+// Reads the consumer's package.json at process.cwd() to extract the asset
+// path, then delegates to `buildHashes`. Consumers who want a different
+// manifest layout can skip this bin and ship a one-line
+// `scripts/build-hashes.mjs` that calls `buildHashes` directly with their
+// own parsed values.
+//
+// Convention: `pkg.claude?.assetPath` with a fallback of `'claude'`.
+// This convention is purely consumer-side — the library itself enforces
+// nothing about package.json shape.
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+import { buildHashes } from './buildHashes.mjs';
+
+try {
+  const packageRoot = process.cwd();
+  const pkg = JSON.parse(
+    await readFile(resolve(packageRoot, 'package.json'), 'utf-8'),
+  );
+  if (typeof pkg.name !== 'string' || typeof pkg.version !== 'string') {
+    throw new Error(
+      `${packageRoot}/package.json must define "name" and "version".`,
+    );
+  }
+  const assetPath =
+    typeof pkg.claude?.assetPath === 'string' && pkg.claude.assetPath.length > 0
+      ? pkg.claude.assetPath
+      : 'claude';
+  const { outPath, fileCount } = await buildHashes({
+    packageRoot,
+    packageName: pkg.name,
+    packageVersion: pkg.version,
+    assetPath,
+  });
+  console.log(`✓ claude-hashes.json written: ${fileCount} file(s) → ${outPath}`);
+} catch (err) {
+  console.error('❌ buildHashes failed:', err?.message ?? err);
+  process.exit(1);
+}