@wairon/sdk 5.0.1-dev.5

package/README.md

@@ -0,0 +1,61 @@
+# @wairon/sdk
+
+The pack-archive format authority and authoring toolkit for [wairon](https://github.com/SYW-Apps/Waffle-AIron).
+
+It owns the portable, versioned **`.wpack`** archive format: a ZIP whose root
+carries a `wairon-pack.yaml` envelope (identity, format/runtime compatibility,
+optional per-entry integrity) wrapping an ordinary directory pack (`pack.yaml`
+for declarative packs, `pack.cjs` for code packs, `skills/**/SKILL.md`, …).
+
+It is deliberately **standalone and dependency-free** with respect to the rest
+of wairon, so third-party pack authors can depend on only `@wairon/sdk`. It does
+STRUCTURAL / envelope validation only — semantic declarative-pack validation
+stays in wairon core and runs after extraction.
+
+## API
+
+```ts
+import {
+  scaffoldPack,   // scaffold a new pack project (declarative | code)
+  buildPack,      // build an installable .wpack from a pack directory
+  inspectArchive, // inspect + version-check a .wpack without extracting
+  extractPack,    // SAFELY extract a .wpack under enforced limits
+} from '@wairon/sdk';
+```
+
+### Safety model
+
+`extractPack` never writes anything unsafe: before a single byte is inflated,
+the codec plans the extraction from the archive's central-directory metadata and
+rejects zip-slip (`..`, absolute, backslash, drive-letter paths), symlinks and
+non-regular entries, and anything over the caps (entry count, total inflated
+size, per-entry size, compression ratio, path depth). Integrity is verified
+before the tree is written, so a tampered pack never lands.
+
+Whole in-memory buffers only (never streams) — the zip-bomb guard must enumerate
+entry sizes *before* decompression. The `bytes` surface is `Uint8Array` (Node's
+`Buffer` is accepted transparently).
+
+### Authoring code packs
+
+```ts
+import { defineRule, type RuleContext, type Finding } from '@wairon/sdk';
+
+export default {
+  name: 'my-rules',
+  rules: [
+    defineRule({
+      name: 'my-example',
+      description: 'Example architectural doctrine.',
+      codes: ['MY_EXAMPLE'],
+      check(ctx: RuleContext): Finding[] {
+        return [];
+      },
+    }),
+  ],
+};
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,219 @@
+/**
+ * The `.wpack` envelope, serialized as `wairon-pack.yaml` at the archive root —
+ * the portable, versioned identity + integrity header wrapping a directory pack.
+ * `kind` is "declarative" (data only) or "code" (executable entry / rules).
+ */
+interface PackArchiveManifest {
+    /** Pack-archive format version (currently 1); a newer major is rejected, not silently mis-read. */
+    formatVersion: number;
+    /** Pack identity; must equal the inner pack manifest's name. */
+    name: string;
+    /** Pack version (semver); must equal the inner pack manifest's version. */
+    version: string;
+    /** "declarative" (data only) | "code" (executable entry / programmatic rules). */
+    kind: string;
+    /** Archive-relative path to the pack entry file (e.g. "pack.yaml", "pack.cjs"). */
+    entry: string;
+    /** Minimum compatible wairon version (semver range). */
+    minWaironVersion?: string;
+    /** Optional integrity digest over the manifest. */
+    digest?: string;
+    /** Optional per-entry integrity map: archive path -> sha256. */
+    entryDigests?: Record<string, string>;
+    /** Producer stamp, e.g. "@wairon/sdk@X.Y.Z". */
+    generatedBy?: string;
+    /** ISO-8601 build timestamp. */
+    generatedAt?: string;
+}
+/**
+ * The result of inspecting a `.wpack` without extracting it: its envelope
+ * identity plus computed archive stats and a compatibility verdict.
+ */
+interface PackArchiveInfo {
+    name: string;
+    version: string;
+    /** "declarative" | "code". */
+    kind: string;
+    entry: string;
+    formatVersion: number;
+    minWaironVersion?: string;
+    /** Number of regular file entries in the archive. */
+    entryCount: number;
+    totalUncompressedBytes: number;
+    /** Whether formatVersion + minWaironVersion are compatible with the running wairon. */
+    compatible: boolean;
+    /** Present when integrity data was carried: true if every entry digest matched. */
+    integrityVerified?: boolean;
+}
+/**
+ * The outcome of safely extracting a `.wpack` into a destination directory:
+ * where it landed, its parsed envelope, and the archive-relative entry path.
+ */
+interface PackExtractionResult {
+    /** Absolute path the pack was extracted into (e.g. .wai/packs/<name>). */
+    directory: string;
+    /** Path to the pack entry file within `directory`. */
+    entryPath: string;
+    /** The parsed envelope. */
+    manifest: PackArchiveManifest;
+    /** Pack name (convenience mirror of manifest.name). */
+    name: string;
+    /** "declarative" | "code". */
+    kind: string;
+    /** Number of files written. */
+    entryCount: number;
+}
+/**
+ * The configurable safety caps the codec enforces when planning an extraction —
+ * the zip-bomb / oversized-archive guardrails. Every field is optional; unset
+ * fields fall back to the codec's default profile.
+ */
+interface PackExtractionLimits {
+    /** Max entry count (default 4096). */
+    maxEntries?: number;
+    /** Max total inflated size (default 32 MiB; hosted 8 MiB). */
+    maxTotalUncompressedBytes?: number;
+    /** Max single-entry inflated size (default 8 MiB). */
+    maxEntryBytes?: number;
+    /** Max inflated:compressed ratio, zip-bomb guard (default 100). */
+    maxCompressionRatio?: number;
+    /** Max path nesting depth (default 16). */
+    maxDepth?: number;
+}
+/**
+ * Inputs to `wairon pack init`: the identity and variant of the pack project to
+ * scaffold, and where to write it.
+ */
+interface PackScaffoldRequest {
+    /** Pack name (also the default directory + archive stem). */
+    name: string;
+    /** Initial version (default 0.1.0). */
+    version?: string;
+    /** "declarative" | "code". */
+    kind: string;
+    /** Directory to scaffold the pack project into. */
+    targetDir: string;
+    /** Include a skills/<id>/SKILL.md stub. */
+    withSkill?: boolean;
+}
+/**
+ * The output of `wairon pack build`: the assembled `.wpack` archive bytes, a
+ * descriptor of what was built, and a suggested file name.
+ */
+interface PackBuildResult {
+    /** The assembled .wpack (ZIP) bytes. */
+    archive: Uint8Array;
+    /** Descriptor of the built archive. */
+    info: PackArchiveInfo;
+    /** e.g. "my-pack-1.0.0.wpack". */
+    suggestedFileName: string;
+}
+/**
+ * One file within a pack: an archive-relative POSIX path and its raw bytes. The
+ * common currency between the scaffold specialist, the archive adapter, and the
+ * codec (integrity verification over file bytes).
+ */
+interface PackFile {
+    /** Archive-relative POSIX path (forward slashes). */
+    path: string;
+    /** Raw file bytes. */
+    contents: Uint8Array;
+}
+/**
+ * Metadata for one archive entry, enumerated by the archive adapter WITHOUT
+ * inflating it — so the codec can enforce zip-bomb and size caps before any
+ * bytes are decompressed.
+ */
+interface ArchiveEntryMeta {
+    /** Raw archive entry path (as stored, pre-normalization). */
+    path: string;
+    uncompressedSize: number;
+    compressedSize: number;
+    /** "file" | "dir" | "symlink". */
+    kind: string;
+}
+/**
+ * The codec's approved, safe extraction plan: the normalized archive-relative
+ * paths that passed every safety check, plus the total inflated size. The
+ * archive adapter inflates and writes only these paths.
+ */
+interface PackExtractionPlan {
+    /** Approved, normalized relative paths to inflate + write under the destination. */
+    paths: string[];
+    /** Sum of approved entries' inflated sizes. */
+    totalUncompressedBytes: number;
+}
+
+/** Severity of a finding a pack rule emits. */
+type RuleSeverity = 'error' | 'warning';
+/** A single issue a pack rule reports about the spec tree. */
+interface Finding {
+    /** Pack-local issue code (surfaced namespaced by wairon, e.g. `<PACK>_<CODE>`). */
+    code: string;
+    /** 'error' | 'warning'. */
+    severity: RuleSeverity;
+    /** Human-readable explanation of the violation. */
+    message: string;
+    /** The spec id the finding is anchored to (optional). */
+    specId?: string;
+}
+/**
+ * A read-only spec node as seen by a pack rule: its id/name plus arbitrary
+ * further fields (kept open so the facade stays stable as the spec model grows).
+ */
+interface RuleSpecNode {
+    id: string;
+    name?: string;
+    [key: string]: unknown;
+}
+/**
+ * The minimal, stable view of the spec tree a code-pack rule inspects. A rule
+ * reads these collections and returns findings — it never mutates state and
+ * never reaches into wairon core internals.
+ */
+interface RuleContext {
+    /** The L0 system spec. */
+    system: RuleSpecNode;
+    /** All L1 subsystem specs. */
+    subsystems: RuleSpecNode[];
+    /** All L2 component specs. */
+    components: RuleSpecNode[];
+    /** All L3 interface specs. */
+    interfaces: RuleSpecNode[];
+    /** All L4 implementation specs. */
+    implementations: RuleSpecNode[];
+    /** All shared type/value-object specs. */
+    types: RuleSpecNode[];
+}
+/**
+ * A programmatic conformance rule shipped by a code pack. Its runtime shape —
+ * `{ name, description?, codes: string[], check }` — is what wairon's extension
+ * loader duck-types when it loads a `pack.cjs`.
+ */
+interface SddRule {
+    /** Stable rule id (kebab-case), e.g. "my-portal-transport". */
+    name: string;
+    /** One-line description of what the rule enforces and why. */
+    description?: string;
+    /** The issue codes this rule can emit. */
+    codes: string[];
+    /** Inspect the spec tree and return findings (empty when clean). */
+    check(ctx: RuleContext): Finding[];
+}
+/**
+ * Author an SddRule with full type inference. Returns the rule unchanged — it
+ * exists purely so code packs get typed authoring without importing anything
+ * from wairon core.
+ */
+declare function defineRule(rule: SddRule): SddRule;
+
+/** Scaffold a new pack project (declarative or code) into a directory; returns the created file paths. */
+declare function scaffoldPack(request: PackScaffoldRequest): string[];
+/** Build an installable .wpack archive from a pack directory. */
+declare function buildPack(sourceDir: string): PackBuildResult;
+/** Inspect + verify a .wpack archive without extracting it. */
+declare function inspectArchive(archive: Uint8Array): PackArchiveInfo;
+/** Safely extract a .wpack archive into a destination directory under enforced limits. */
+declare function extractPack(archive: Uint8Array, destDir: string, limits?: PackExtractionLimits): PackExtractionResult;
+
+export { type ArchiveEntryMeta, type Finding, type PackArchiveInfo, type PackArchiveManifest, type PackBuildResult, type PackExtractionLimits, type PackExtractionPlan, type PackExtractionResult, type PackFile, type PackScaffoldRequest, type RuleContext, type RuleSeverity, type RuleSpecNode, type SddRule, buildPack, defineRule, extractPack, inspectArchive, scaffoldPack };

package/dist/index.js

@@ -0,0 +1,705 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// package.json
+var require_package = __commonJS({
+  "package.json"(exports2, module2) {
+    module2.exports = {
+      name: "@wairon/sdk",
+      version: "5.0.1-dev.5",
+      description: "Wairon pack-archive (.wpack) format authority and authoring toolkit \u2014 scaffold, build, inspect, and safely extract wairon extension packs.",
+      keywords: [
+        "wairon",
+        "sdd",
+        "pack",
+        "wpack",
+        "archive",
+        "developer-tools"
+      ],
+      author: "SYW",
+      license: "MIT",
+      homepage: "https://github.com/SYW-Apps/Waffle-AIron",
+      repository: {
+        type: "git",
+        url: "https://github.com/SYW-Apps/Waffle-AIron.git"
+      },
+      type: "commonjs",
+      main: "./dist/index.js",
+      types: "./dist/index.d.ts",
+      files: [
+        "dist",
+        "README.md"
+      ],
+      engines: {
+        node: ">=18.0.0"
+      },
+      scripts: {
+        build: "tsup",
+        typecheck: "tsc --noEmit",
+        test: "vitest run",
+        "test:watch": "vitest",
+        clean: "rimraf dist"
+      },
+      dependencies: {
+        fflate: "^0.8.2",
+        "js-yaml": "^4.1.0"
+      },
+      devDependencies: {
+        "@types/js-yaml": "^4.0.9",
+        "@types/node": "^20.14.0",
+        rimraf: "^5.0.7",
+        tsup: "^8.1.0",
+        typescript: "^5.5.2",
+        vitest: "^4.1.9"
+      }
+    };
+  }
+});
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  buildPack: () => buildPack2,
+  defineRule: () => defineRule,
+  extractPack: () => extractPack2,
+  inspectArchive: () => inspectArchive2,
+  scaffoldPack: () => scaffoldPack2
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/orchestrator.ts
+var path2 = __toESM(require("path"));
+var import_js_yaml2 = require("js-yaml");
+
+// src/codec.ts
+var import_js_yaml = require("js-yaml");
+var import_crypto = require("crypto");
+var ENVELOPE_FILENAME = "wairon-pack.yaml";
+var SUPPORTED_FORMAT_VERSION = 1;
+var DEFAULTS = {
+  maxEntries: 4096,
+  maxTotalUncompressedBytes: 32 * 1024 * 1024,
+  maxEntryBytes: 8 * 1024 * 1024,
+  maxCompressionRatio: 100,
+  maxDepth: 16
+};
+function parseManifest(text) {
+  const raw = (0, import_js_yaml.load)(text);
+  const manifest = validateEnvelope(raw);
+  if (Math.trunc(manifest.formatVersion) > SUPPORTED_FORMAT_VERSION) {
+    throw new Error("unsupported pack-archive formatVersion (newer than this wairon understands)");
+  }
+  return manifest;
+}
+function serializeManifest(manifest) {
+  const clean = {
+    formatVersion: manifest.formatVersion,
+    name: manifest.name,
+    version: manifest.version,
+    kind: manifest.kind,
+    entry: manifest.entry
+  };
+  if (manifest.minWaironVersion !== void 0) clean.minWaironVersion = manifest.minWaironVersion;
+  if (manifest.digest !== void 0) clean.digest = manifest.digest;
+  if (manifest.entryDigests !== void 0) clean.entryDigests = manifest.entryDigests;
+  if (manifest.generatedBy !== void 0) clean.generatedBy = manifest.generatedBy;
+  if (manifest.generatedAt !== void 0) clean.generatedAt = manifest.generatedAt;
+  return (0, import_js_yaml.dump)(clean, { sortKeys: false });
+}
+function defaultLimits() {
+  return { ...DEFAULTS };
+}
+function planExtraction(entries, limits) {
+  const caps = {
+    maxEntries: limits.maxEntries ?? DEFAULTS.maxEntries,
+    maxTotalUncompressedBytes: limits.maxTotalUncompressedBytes ?? DEFAULTS.maxTotalUncompressedBytes,
+    maxEntryBytes: limits.maxEntryBytes ?? DEFAULTS.maxEntryBytes,
+    maxCompressionRatio: limits.maxCompressionRatio ?? DEFAULTS.maxCompressionRatio,
+    maxDepth: limits.maxDepth ?? DEFAULTS.maxDepth
+  };
+  const approved = [];
+  let total = 0;
+  for (const entry of entries) {
+    if (isSymlinkOrNonRegular(entry.kind) || isStructurallyUnsafePath(entry.path)) {
+      rejectUnsafe();
+    }
+    if (entry.kind === "dir") continue;
+    const normalized = normalizeRelPath(entry.path);
+    if (escapesDestination(normalized) || pathDepth(normalized) > caps.maxDepth) {
+      rejectUnsafe();
+    }
+    if (entry.uncompressedSize > caps.maxEntryBytes || compressionRatio(entry) > caps.maxCompressionRatio) {
+      rejectUnsafe();
+    }
+    approved.push(normalized);
+    total += entry.uncompressedSize;
+  }
+  if (approved.length > caps.maxEntries || total > caps.maxTotalUncompressedBytes) {
+    rejectUnsafe();
+  }
+  return { paths: approved, totalUncompressedBytes: total };
+}
+function verifyIdentity(manifest, packName, packVersion) {
+  if (manifest.name !== packName || manifest.version !== packVersion) {
+    throw new Error("envelope identity mismatch (envelope name/version differ from the inner pack manifest)");
+  }
+}
+function verifyIntegrity(manifest, files) {
+  if (!manifest.entryDigests) {
+    return false;
+  }
+  const digests = manifest.entryDigests;
+  for (const file of files) {
+    if (file.path === ENVELOPE_FILENAME) continue;
+    if (sha256(file.contents) !== digests[file.path]) {
+      throw new Error("integrity digest mismatch");
+    }
+  }
+  return true;
+}
+function sealIntegrity(manifest, files, generatedBy, generatedAt) {
+  const entryDigests = {};
+  for (const file of files) {
+    if (file.path === ENVELOPE_FILENAME) continue;
+    entryDigests[file.path] = sha256(file.contents);
+  }
+  const digest = sha256(canonicalDigestBytes(entryDigests));
+  return { ...manifest, entryDigests, digest, generatedBy, generatedAt };
+}
+function checkCompatibility(manifest, waironVersion) {
+  if (Math.trunc(manifest.formatVersion) > SUPPORTED_FORMAT_VERSION) {
+    return false;
+  }
+  if (manifest.minWaironVersion && isBelow(waironVersion, manifest.minWaironVersion)) {
+    return false;
+  }
+  return true;
+}
+function rejectUnsafe() {
+  throw new Error("reject: unsafe or oversized archive entry (zip-slip / size / ratio / depth guard)");
+}
+function validateEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("malformed pack envelope (not a YAML mapping)");
+  }
+  const o = raw;
+  if (typeof o.formatVersion !== "number") throw new Error("pack envelope: formatVersion must be a number");
+  if (typeof o.name !== "string" || !o.name) throw new Error("pack envelope: name is required");
+  if (typeof o.version !== "string" || !o.version) throw new Error("pack envelope: version is required");
+  if (typeof o.kind !== "string" || o.kind !== "declarative" && o.kind !== "code") {
+    throw new Error('pack envelope: kind must be "declarative" or "code"');
+  }
+  if (typeof o.entry !== "string" || !o.entry) throw new Error("pack envelope: entry is required");
+  const manifest = {
+    formatVersion: o.formatVersion,
+    name: o.name,
+    version: o.version,
+    kind: o.kind,
+    entry: o.entry
+  };
+  if (typeof o.minWaironVersion === "string") manifest.minWaironVersion = o.minWaironVersion;
+  if (typeof o.digest === "string") manifest.digest = o.digest;
+  if (o.entryDigests && typeof o.entryDigests === "object") {
+    manifest.entryDigests = o.entryDigests;
+  }
+  if (typeof o.generatedBy === "string") manifest.generatedBy = o.generatedBy;
+  if (typeof o.generatedAt === "string") manifest.generatedAt = o.generatedAt;
+  return manifest;
+}
+function isSymlinkOrNonRegular(kind) {
+  return kind !== "file" && kind !== "dir";
+}
+function isStructurallyUnsafePath(p) {
+  if (p.includes("\\")) return true;
+  if (/^[A-Za-z]:/.test(p)) return true;
+  if (p.startsWith("/")) return true;
+  return p.split("/").some((seg) => seg === "..");
+}
+function normalizeRelPath(p) {
+  return p.split("/").filter((seg) => seg !== "" && seg !== ".").join("/");
+}
+function escapesDestination(normalized) {
+  return normalized.startsWith("/") || normalized.split("/").some((seg) => seg === "..");
+}
+function pathDepth(normalized) {
+  return normalized.split("/").filter((seg) => seg !== "").length;
+}
+function compressionRatio(entry) {
+  if (entry.compressedSize > 0) return entry.uncompressedSize / entry.compressedSize;
+  return entry.uncompressedSize > 0 ? Infinity : 0;
+}
+function canonicalDigestBytes(entryDigests) {
+  const lines = Object.keys(entryDigests).sort().map((key) => `${key}:${entryDigests[key]}`).join("\n");
+  return new TextEncoder().encode(lines);
+}
+function sha256(data) {
+  return (0, import_crypto.createHash)("sha256").update(data).digest("hex");
+}
+function isBelow(running, minimum) {
+  const [rMaj, rMin, rPat] = parseSemverCore(running);
+  const [mMaj, mMin, mPat] = parseSemverCore(minimum);
+  if (rMaj !== mMaj) return rMaj < mMaj;
+  if (rMin !== mMin) return rMin < mMin;
+  return rPat < mPat;
+}
+function parseSemverCore(v) {
+  const cleaned = v.trim().replace(/^[^0-9]*/, "");
+  const core = cleaned.split(/[-+]/)[0];
+  const parts = core.split(".").map((n) => parseInt(n, 10));
+  return [parts[0] || 0, parts[1] || 0, parts[2] || 0];
+}
+
+// src/version.ts
+var SDK_VERSION = loadVersion();
+function loadVersion() {
+  try {
+    const pkg = require_package();
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+// src/scaffold.ts
+var enc = (s) => new TextEncoder().encode(s);
+function render(request) {
+  const version = request.version ?? "0.1.0";
+  let files;
+  if (request.kind === "code") {
+    files = renderCodePack(request.name, version);
+  } else {
+    files = renderDeclarativePack(request.name, version);
+  }
+  if (request.withSkill) {
+    files.push(renderSkillStub(request.name, version));
+  }
+  return files;
+}
+function renderDeclarativePack(name, version) {
+  return [
+    { path: "wairon-pack.yaml", contents: enc(declarativeEnvelope(name, version)) },
+    { path: "pack.yaml", contents: enc(declarativeManifest(name, version)) },
+    { path: "README.md", contents: enc(readme(name, "declarative", "pack.yaml")) }
+  ];
+}
+function renderCodePack(name, version) {
+  return [
+    { path: "wairon-pack.yaml", contents: enc(codeEnvelope(name, version)) },
+    { path: "package.json", contents: enc(codePackageJson(name, version)) },
+    { path: "tsconfig.json", contents: enc(codeTsconfig()) },
+    { path: "pack.ts", contents: enc(codeEntry(name, version)) },
+    { path: "README.md", contents: enc(readme(name, "code", "pack.cjs")) }
+  ];
+}
+function renderSkillStub(name, _version) {
+  const id = slug(name);
+  return { path: `skills/${id}/SKILL.md`, contents: enc(skillStub(name)) };
+}
+function declarativeEnvelope(name, version) {
+  return [
+    "formatVersion: 1",
+    `name: ${name}`,
+    `version: ${version}`,
+    "kind: declarative",
+    "entry: pack.yaml",
+    ""
+  ].join("\n");
+}
+function codeEnvelope(name, version) {
+  return [
+    "formatVersion: 1",
+    `name: ${name}`,
+    `version: ${version}`,
+    "kind: code",
+    "entry: pack.cjs",
+    `minWaironVersion: ${SDK_VERSION}`,
+    ""
+  ].join("\n");
+}
+function declarativeManifest(name, version) {
+  return [
+    `name: ${name}`,
+    `version: ${version}`,
+    "",
+    "# Custom architectural profiles this pack contributes (example, commented):",
+    "# profiles:",
+    "#   my-profile:",
+    "#     family: backend-like",
+    "#     forbiddenStereotypes:",
+    "#       - types: [Adapter]",
+    '#         reason: "Domain components must not touch adapters directly."',
+    "profiles: {}",
+    "",
+    "# Target language / platform tables (example, commented):",
+    "# languages:",
+    "#   rust:",
+    "#     unsupportedFlow: {}",
+    "#     foreignBuiltins: []",
+    "languages: {}",
+    "",
+    "# Reusable, versioned architecture patterns:",
+    "patterns: []",
+    ""
+  ].join("\n");
+}
+function codePackageJson(name, version) {
+  const pkg = {
+    name,
+    version,
+    private: true,
+    scripts: {
+      build: "esbuild pack.ts --bundle --platform=node --packages=external --format=cjs --outfile=pack.cjs"
+    },
+    dependencies: {
+      "@wairon/sdk": SDK_VERSION
+    },
+    devDependencies: {
+      esbuild: "^0.21.0",
+      typescript: "^5.0.0"
+    }
+  };
+  return `${JSON.stringify(pkg, null, 2)}
+`;
+}
+function codeTsconfig() {
+  const tsconfig = {
+    compilerOptions: {
+      target: "ES2020",
+      module: "CommonJS",
+      moduleResolution: "node",
+      strict: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      declaration: false,
+      noEmit: true
+    },
+    include: ["pack.ts"]
+  };
+  return `${JSON.stringify(tsconfig, null, 2)}
+`;
+}
+function codeEntry(name, version) {
+  const code = slug(name).toUpperCase().replace(/-/g, "_");
+  return [
+    "import { defineRule } from '@wairon/sdk';",
+    "import type { RuleContext, Finding } from '@wairon/sdk';",
+    "",
+    "const exampleRule = defineRule({",
+    `  name: '${slug(name)}-example',`,
+    "  description: 'Example architectural rule. Replace with your own doctrine.',",
+    `  codes: ['${code}_EXAMPLE'],`,
+    "  check(ctx: RuleContext): Finding[] {",
+    "    const findings: Finding[] = [];",
+    "    for (const component of ctx.components) {",
+    "      // Inspect the spec tree and push findings as needed.",
+    "      void component;",
+    "    }",
+    "    return findings;",
+    "  },",
+    "});",
+    "",
+    "export default {",
+    `  name: '${name}',`,
+    `  version: '${version}',`,
+    "  rules: [exampleRule],",
+    "};",
+    ""
+  ].join("\n");
+}
+function readme(name, kind, entry) {
+  return [
+    `# ${name}`,
+    "",
+    `A wairon ${kind} pack.`,
+    "",
+    `- Envelope: \`wairon-pack.yaml\``,
+    `- Entry: \`${entry}\``,
+    "",
+    "Build an installable `.wpack` archive with `wairon pack build`.",
+    ""
+  ].join("\n");
+}
+function skillStub(name) {
+  return [
+    "---",
+    `name: ${name}`,
+    `description: ${name} authoring skill (stub).`,
+    "---",
+    "",
+    `# ${name}`,
+    "",
+    "Describe when this skill applies and what it guides.",
+    ""
+  ].join("\n");
+}
+function slug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+
+// src/archive.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_fflate = require("fflate");
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
+function listEntries(archive) {
+  const symlinks = detectSymlinkNames(archive);
+  const metas = [];
+  (0, import_fflate.unzipSync)(archive, {
+    filter: (info) => {
+      metas.push({
+        path: info.name,
+        uncompressedSize: info.originalSize,
+        compressedSize: info.size,
+        kind: classifyKind(info.name, symlinks)
+      });
+      return false;
+    }
+  });
+  return metas;
+}
+function inflateEntry(archive, entryPath) {
+  const inflated = (0, import_fflate.unzipSync)(archive, { filter: (info) => info.name === entryPath });
+  const bytes = inflated[entryPath];
+  if (!bytes) throw new Error(`archive entry not found: ${entryPath}`);
+  return bytes;
+}
+function assembleArchive(files) {
+  const zippable = {};
+  for (const file of files) zippable[file.path] = file.contents;
+  const bytes = (0, import_fflate.zipSync)(zippable);
+  return bytes;
+}
+function readPackDir(dir) {
+  const files = [];
+  walkPackDir(dir, dir, files);
+  return files;
+}
+function writeTree(destDir, files) {
+  for (const file of files) {
+    const absolute = path.join(destDir, file.path);
+    fs.mkdirSync(path.dirname(absolute), { recursive: true });
+    fs.writeFileSync(absolute, file.contents);
+  }
+}
+function classifyKind(name, symlinks) {
+  if (symlinks.has(name)) return "symlink";
+  if (name.endsWith("/")) return "dir";
+  return "file";
+}
+function walkPackDir(root, current, out) {
+  for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      walkPackDir(root, path.join(current, entry.name), out);
+    } else if (entry.isFile()) {
+      const absolute = path.join(current, entry.name);
+      const relative2 = path.relative(root, absolute).split(path.sep).join("/");
+      out.push({ path: relative2, contents: fs.readFileSync(absolute) });
+    }
+  }
+}
+function detectSymlinkNames(archive) {
+  const names = /* @__PURE__ */ new Set();
+  try {
+    const eocd = findEocd(archive);
+    if (eocd < 0) return names;
+    let p = readU32(archive, eocd + 16);
+    const count = readU16(archive, eocd + 10);
+    const decoder = new TextDecoder();
+    for (let i = 0; i < count; i++) {
+      if (readU32(archive, p) !== 33639248) break;
+      const versionMadeBy = readU16(archive, p + 4);
+      const nameLen = readU16(archive, p + 28);
+      const extraLen = readU16(archive, p + 30);
+      const commentLen = readU16(archive, p + 32);
+      const externalAttrs = readU32(archive, p + 38);
+      const name = decoder.decode(archive.subarray(p + 46, p + 46 + nameLen));
+      if (versionMadeBy >> 8 === 3) {
+        const unixMode = externalAttrs >>> 16 & 65535;
+        if ((unixMode & 61440) === 40960) names.add(name);
+      }
+      p += 46 + nameLen + extraLen + commentLen;
+    }
+  } catch {
+    return names;
+  }
+  return names;
+}
+function findEocd(buf) {
+  const minRecord = 22;
+  const lowerBound = Math.max(0, buf.length - (minRecord + 65535));
+  for (let i = buf.length - minRecord; i >= lowerBound; i--) {
+    if (readU32(buf, i) === 101010256) return i;
+  }
+  return -1;
+}
+function readU16(buf, off) {
+  return buf[off] | buf[off + 1] << 8;
+}
+function readU32(buf, off) {
+  return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;
+}
+
+// src/orchestrator.ts
+var decode = (b) => new TextDecoder().decode(b);
+var encode = (s) => new TextEncoder().encode(s);
+function scaffoldPack(request) {
+  const files = render(request);
+  writeTree(request.targetDir, files);
+  return files.map((file) => path2.join(request.targetDir, file.path));
+}
+function buildPack(sourceDir) {
+  const files = readPackDir(sourceDir);
+  const envelope = files.find((file) => file.path === ENVELOPE_FILENAME);
+  if (!envelope) {
+    throw new Error("pack build requires a wairon-pack.yaml envelope (run `wairon pack init` to scaffold one)");
+  }
+  const manifest = parseManifest(decode(envelope.contents));
+  const identity = readInnerIdentity(files, manifest);
+  verifyIdentity(manifest, identity.name, identity.version);
+  const sealed = sealIntegrity(manifest, files, `@wairon/sdk@${SDK_VERSION}`, (/* @__PURE__ */ new Date()).toISOString());
+  const sealedText = serializeManifest(sealed);
+  const finalFiles = upsertEnvelope(files, sealedText);
+  const archiveBytes = assembleArchive(finalFiles);
+  const info = buildInfo(sealed, finalFiles);
+  const suggestedFileName = `${sealed.name}-${sealed.version}.wpack`;
+  return { archive: archiveBytes, info, suggestedFileName };
+}
+function inspectArchive(archiveBytes) {
+  const entries = listEntries(archiveBytes);
+  if (!entries.some((entry) => entry.path === ENVELOPE_FILENAME)) {
+    throw new Error("not a .wpack archive (missing wairon-pack.yaml envelope)");
+  }
+  const envelopeBytes = inflateEntry(archiveBytes, ENVELOPE_FILENAME);
+  const manifest = parseManifest(decode(envelopeBytes));
+  const compatible = checkCompatibility(manifest, SDK_VERSION);
+  const fileEntries = entries.filter((entry) => entry.kind === "file");
+  const totalUncompressedBytes = entries.reduce((sum, entry) => sum + entry.uncompressedSize, 0);
+  const info = {
+    name: manifest.name,
+    version: manifest.version,
+    kind: manifest.kind,
+    entry: manifest.entry,
+    formatVersion: manifest.formatVersion,
+    entryCount: fileEntries.length,
+    totalUncompressedBytes,
+    compatible
+  };
+  if (manifest.minWaironVersion !== void 0) info.minWaironVersion = manifest.minWaironVersion;
+  return info;
+}
+function extractPack(archiveBytes, destDir, limits) {
+  const effectiveLimits = limits === void 0 ? defaultLimits() : limits;
+  const entries = listEntries(archiveBytes);
+  const plan = planExtraction(entries, effectiveLimits);
+  const files = [];
+  for (const approvedPath of plan.paths) {
+    const contents = inflateEntry(archiveBytes, approvedPath);
+    files.push({ path: approvedPath, contents });
+  }
+  const envelope = files.find((file) => file.path === ENVELOPE_FILENAME);
+  if (!envelope) {
+    throw new Error("not a .wpack archive (missing wairon-pack.yaml envelope)");
+  }
+  const manifest = parseManifest(decode(envelope.contents));
+  verifyIntegrity(manifest, files);
+  const directory = path2.resolve(destDir);
+  writeTree(directory, files);
+  const result = {
+    directory,
+    entryPath: manifest.entry,
+    manifest,
+    name: manifest.name,
+    kind: manifest.kind,
+    entryCount: files.length
+  };
+  return result;
+}
+function readInnerIdentity(files, manifest) {
+  const innerPath = manifest.kind === "code" ? "package.json" : manifest.entry;
+  const inner = files.find((file) => file.path === innerPath);
+  if (!inner) throw new Error(`pack build: inner pack manifest "${innerPath}" is missing`);
+  const parsed = manifest.kind === "code" ? JSON.parse(decode(inner.contents)) : (0, import_js_yaml2.load)(decode(inner.contents));
+  const name = parsed?.name;
+  const version = parsed?.version;
+  if (typeof name !== "string" || typeof version !== "string") {
+    throw new Error(`pack build: inner pack manifest "${innerPath}" lacks a name/version`);
+  }
+  return { name, version };
+}
+function upsertEnvelope(files, envelopeText) {
+  const others = files.filter((file) => file.path !== ENVELOPE_FILENAME);
+  return [...others, { path: ENVELOPE_FILENAME, contents: encode(envelopeText) }];
+}
+function buildInfo(manifest, files) {
+  const totalUncompressedBytes = files.reduce((sum, file) => sum + file.contents.length, 0);
+  const info = {
+    name: manifest.name,
+    version: manifest.version,
+    kind: manifest.kind,
+    entry: manifest.entry,
+    formatVersion: manifest.formatVersion,
+    entryCount: files.length,
+    totalUncompressedBytes,
+    compatible: true
+  };
+  if (manifest.minWaironVersion !== void 0) info.minWaironVersion = manifest.minWaironVersion;
+  return info;
+}
+
+// src/authoring.ts
+function defineRule(rule) {
+  return rule;
+}
+
+// src/index.ts
+function scaffoldPack2(request) {
+  return scaffoldPack(request);
+}
+function buildPack2(sourceDir) {
+  return buildPack(sourceDir);
+}
+function inspectArchive2(archive) {
+  return inspectArchive(archive);
+}
+function extractPack2(archive, destDir, limits) {
+  return extractPack(archive, destDir, limits);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildPack,
+  defineRule,
+  extractPack,
+  inspectArchive,
+  scaffoldPack
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../package.json","../src/index.ts","../src/orchestrator.ts","../src/codec.ts","../src/version.ts","../src/scaffold.ts","../src/archive.ts","../src/authoring.ts"],"sourcesContent":["{\n  \"name\": \"@wairon/sdk\",\n  \"version\": \"5.0.1-dev.5\",\n  \"description\": \"Wairon pack-archive (.wpack) format authority and authoring toolkit — scaffold, build, inspect, and safely extract wairon extension packs.\",\n  \"keywords\": [\n    \"wairon\",\n    \"sdd\",\n    \"pack\",\n    \"wpack\",\n    \"archive\",\n    \"developer-tools\"\n  ],\n  \"author\": \"SYW\",\n  \"license\": \"MIT\",\n  \"homepage\": \"https://github.com/SYW-Apps/Waffle-AIron\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/SYW-Apps/Waffle-AIron.git\"\n  },\n  \"type\": \"commonjs\",\n  \"main\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"files\": [\n    \"dist\",\n    \"README.md\"\n  ],\n  \"engines\": {\n    \"node\": \">=18.0.0\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"typecheck\": \"tsc --noEmit\",\n    \"test\": \"vitest run\",\n    \"test:watch\": \"vitest\",\n    \"clean\": \"rimraf dist\"\n  },\n  \"dependencies\": {\n    \"fflate\": \"^0.8.2\",\n    \"js-yaml\": \"^4.1.0\"\n  },\n  \"devDependencies\": {\n    \"@types/js-yaml\": \"^4.0.9\",\n    \"@types/node\": \"^20.14.0\",\n    \"rimraf\": \"^5.0.7\",\n    \"tsup\": \"^8.1.0\",\n    \"typescript\": \"^5.5.2\",\n    \"vitest\": \"^4.1.9\"\n  }\n}\n","import * as orchestrator from './orchestrator.js';\nimport type {\n  PackArchiveInfo,\n  PackBuildResult,\n  PackExtractionLimits,\n  PackExtractionResult,\n  PackScaffoldRequest,\n} from './types.js';\n\n// ---------------------------------------------------------------------------\n// SDK Portal (sdk_portal_impl) — the @wairon/sdk package entry. Each capability\n// is a 1:1 forward to the SDK orchestrator with no logic of its own; the module\n// also re-exports the pure pack-authoring value objects and the rule-authoring\n// contract (compile-time types + the defineRule helper).\n// ---------------------------------------------------------------------------\n\n/** Scaffold a new pack project (declarative or code) into a directory; returns the created file paths. */\nexport function scaffoldPack(request: PackScaffoldRequest): string[] {\n  // Step 1: forward to the SDK orchestrator.\n  return orchestrator.scaffoldPack(request);\n}\n\n/** Build an installable .wpack archive from a pack directory. */\nexport function buildPack(sourceDir: string): PackBuildResult {\n  // Step 1: forward to the SDK orchestrator.\n  return orchestrator.buildPack(sourceDir);\n}\n\n/** Inspect + verify a .wpack archive without extracting it. */\nexport function inspectArchive(archive: Uint8Array): PackArchiveInfo {\n  // Step 1: forward to the SDK orchestrator.\n  return orchestrator.inspectArchive(archive);\n}\n\n/** Safely extract a .wpack archive into a destination directory under enforced limits. */\nexport function extractPack(\n  archive: Uint8Array,\n  destDir: string,\n  limits?: PackExtractionLimits,\n): PackExtractionResult {\n  // Step 1: forward to the SDK orchestrator.\n  return orchestrator.extractPack(archive, destDir, limits);\n}\n\n// Re-export the pure pack-archive value objects...\nexport * from './types.js';\n// ...and the rule-authoring contract (SddRule + stable RuleContext/Finding facade + defineRule).\nexport * from './authoring.js';\n","import * as path from 'path';\nimport { load as yamlLoad } from 'js-yaml';\nimport * as codec from './codec.js';\nimport * as scaffold from './scaffold.js';\nimport * as archive from './archive.js';\nimport { SDK_VERSION } from './version.js';\nimport type {\n  PackArchiveInfo,\n  PackArchiveManifest,\n  PackBuildResult,\n  PackExtractionLimits,\n  PackExtractionResult,\n  PackFile,\n  PackScaffoldRequest,\n} from './types.js';\n\n// ---------------------------------------------------------------------------\n// SDK Orchestrator (sdk_orchestrator_impl) — the four pack workflows. Delegates\n// format/safety decisions to the codec, template rendering to the scaffold\n// specialist, and all zip+fs I/O to the archive adapter. Holds no state.\n// ---------------------------------------------------------------------------\n\nconst decode = (b: Uint8Array): string => new TextDecoder().decode(b);\nconst encode = (s: string): Uint8Array => new TextEncoder().encode(s);\n\n/** Render the scaffold file map and write it under the target directory. */\nexport function scaffoldPack(request: PackScaffoldRequest): string[] {\n  // Step 1: render the scaffold file map for the requested pack.\n  const files = scaffold.render(request);\n  // Step 2: write the rendered files as a directory tree under targetDir.\n  archive.writeTree(request.targetDir, files);\n  // Step 3: return the created file paths (targetDir-joined).\n  return files.map((file) => path.join(request.targetDir, file.path));\n}\n\n/** Build an installable .wpack archive from a pack directory. */\nexport function buildPack(sourceDir: string): PackBuildResult {\n  // Step 1: read the source pack directory into a file map.\n  const files = archive.readPackDir(sourceDir);\n  // Step 2: require an envelope.\n  const envelope = files.find((file) => file.path === codec.ENVELOPE_FILENAME);\n  if (!envelope) {\n    // Step 3: reject a pack directory with no envelope.\n    throw new Error('pack build requires a wairon-pack.yaml envelope (run `wairon pack init` to scaffold one)');\n  }\n  // Step 4 (parse): parse + validate the envelope (also version-gates the format).\n  const manifest = codec.parseManifest(decode(envelope.contents));\n  // Step 5: read the inner pack identity (pack.yaml, or package.json for code).\n  const identity = readInnerIdentity(files, manifest);\n  // Step 6: assert the envelope's name/version match the inner pack manifest.\n  codec.verifyIdentity(manifest, identity.name, identity.version);\n  // Step 7: seal integrity (entryDigests + digest + generatedBy/generatedAt).\n  const sealed = codec.sealIntegrity(manifest, files, `@wairon/sdk@${SDK_VERSION}`, new Date().toISOString());\n  // Step 8: serialize the sealed manifest back to canonical envelope text.\n  const sealedText = codec.serializeManifest(sealed);\n  // Step 9: upsert wairon-pack.yaml (sealed envelope text) into the file map.\n  const finalFiles = upsertEnvelope(files, sealedText);\n  // Step 10: deflate the files + envelope into .wpack archive bytes.\n  const archiveBytes = archive.assembleArchive(finalFiles);\n  // Step 11: assemble PackArchiveInfo + suggestedFileName.\n  const info = buildInfo(sealed, finalFiles);\n  const suggestedFileName = `${sealed.name}-${sealed.version}.wpack`;\n  // Step 12: return the build result.\n  return { archive: archiveBytes, info, suggestedFileName };\n}\n\n/** Inspect + verify a .wpack archive without extracting it. */\nexport function inspectArchive(archiveBytes: Uint8Array): PackArchiveInfo {\n  // Step 1: enumerate archive entries without inflating.\n  const entries = archive.listEntries(archiveBytes);\n  // Step 2: is there no wairon-pack.yaml entry?\n  if (!entries.some((entry) => entry.path === codec.ENVELOPE_FILENAME)) {\n    // Step 3: reject a non-.wpack archive.\n    throw new Error('not a .wpack archive (missing wairon-pack.yaml envelope)');\n  }\n  // Step 4 (readEnv): inflate just the envelope entry.\n  const envelopeBytes = archive.inflateEntry(archiveBytes, codec.ENVELOPE_FILENAME);\n  // Step 5: parse + version-check the envelope text.\n  const manifest = codec.parseManifest(decode(envelopeBytes));\n  // Step 6: compute compatibility against the running wairon version.\n  const compatible = codec.checkCompatibility(manifest, SDK_VERSION);\n  // Step 7: assemble PackArchiveInfo from the manifest + archive stats.\n  const fileEntries = entries.filter((entry) => entry.kind === 'file');\n  const totalUncompressedBytes = entries.reduce((sum, entry) => sum + entry.uncompressedSize, 0);\n  const info: PackArchiveInfo = {\n    name: manifest.name,\n    version: manifest.version,\n    kind: manifest.kind,\n    entry: manifest.entry,\n    formatVersion: manifest.formatVersion,\n    entryCount: fileEntries.length,\n    totalUncompressedBytes,\n    compatible,\n  };\n  if (manifest.minWaironVersion !== undefined) info.minWaironVersion = manifest.minWaironVersion;\n  // Step 8: return the PackArchiveInfo (no extraction performed).\n  return info;\n}\n\n/** Safely extract a .wpack archive into a destination directory under enforced limits. */\nexport function extractPack(\n  archiveBytes: Uint8Array,\n  destDir: string,\n  limits?: PackExtractionLimits,\n): PackExtractionResult {\n  // Step 1: did the caller omit limits?\n  const effectiveLimits = limits === undefined\n    // Step 2: fall back to the codec's default limit profile.\n    ? codec.defaultLimits()\n    : limits;\n  // Step 3 (list): enumerate archive entries without inflating (caps run pre-decompress).\n  const entries = archive.listEntries(archiveBytes);\n  // Step 4: compute the safe extraction plan (throws on any unsafe/oversized entry).\n  const plan = codec.planExtraction(entries, effectiveLimits);\n  // Step 5: initialize an empty file list.\n  const files: PackFile[] = [];\n  // Step 6: inflate each approved path from the plan.\n  for (const approvedPath of plan.paths) {\n    // Step 7: inflate one approved entry.\n    const contents = archive.inflateEntry(archiveBytes, approvedPath);\n    // Step 8 (inflateEnd): append { path, contents } to the file list.\n    files.push({ path: approvedPath, contents });\n  }\n  // Step 9: read the wairon-pack.yaml text from the inflated files.\n  const envelope = files.find((file) => file.path === codec.ENVELOPE_FILENAME);\n  if (!envelope) {\n    throw new Error('not a .wpack archive (missing wairon-pack.yaml envelope)');\n  }\n  // Step 10: parse the envelope into the result manifest.\n  const manifest = codec.parseManifest(decode(envelope.contents));\n  // Step 11: enforce integrity BEFORE writing (throws on mismatch; no-op when none carried).\n  codec.verifyIntegrity(manifest, files);\n  // Step 12: write the approved, integrity-checked files as a directory tree.\n  const directory = path.resolve(destDir);\n  archive.writeTree(directory, files);\n  // Step 13: assemble PackExtractionResult.\n  const result: PackExtractionResult = {\n    directory,\n    entryPath: manifest.entry,\n    manifest,\n    name: manifest.name,\n    kind: manifest.kind,\n    entryCount: files.length,\n  };\n  // Step 14: return where the pack landed + its parsed manifest.\n  return result;\n}\n\n// --- helpers ---------------------------------------------------------------\n\nfunction readInnerIdentity(files: PackFile[], manifest: PackArchiveManifest): { name: string; version: string } {\n  const innerPath = manifest.kind === 'code' ? 'package.json' : manifest.entry;\n  const inner = files.find((file) => file.path === innerPath);\n  if (!inner) throw new Error(`pack build: inner pack manifest \"${innerPath}\" is missing`);\n  const parsed = (manifest.kind === 'code'\n    ? JSON.parse(decode(inner.contents))\n    : yamlLoad(decode(inner.contents))) as Record<string, unknown> | null;\n  const name = parsed?.name;\n  const version = parsed?.version;\n  if (typeof name !== 'string' || typeof version !== 'string') {\n    throw new Error(`pack build: inner pack manifest \"${innerPath}\" lacks a name/version`);\n  }\n  return { name, version };\n}\n\nfunction upsertEnvelope(files: PackFile[], envelopeText: string): PackFile[] {\n  const others = files.filter((file) => file.path !== codec.ENVELOPE_FILENAME);\n  return [...others, { path: codec.ENVELOPE_FILENAME, contents: encode(envelopeText) }];\n}\n\nfunction buildInfo(manifest: PackArchiveManifest, files: PackFile[]): PackArchiveInfo {\n  const totalUncompressedBytes = files.reduce((sum, file) => sum + file.contents.length, 0);\n  const info: PackArchiveInfo = {\n    name: manifest.name,\n    version: manifest.version,\n    kind: manifest.kind,\n    entry: manifest.entry,\n    formatVersion: manifest.formatVersion,\n    entryCount: files.length,\n    totalUncompressedBytes,\n    compatible: true,\n  };\n  if (manifest.minWaironVersion !== undefined) info.minWaironVersion = manifest.minWaironVersion;\n  return info;\n}\n","import { load as yamlLoad, dump as yamlDump } from 'js-yaml';\nimport { createHash } from 'crypto';\nimport type {\n  ArchiveEntryMeta,\n  PackArchiveManifest,\n  PackExtractionLimits,\n  PackExtractionPlan,\n  PackFile,\n} from './types.js';\n\n// ---------------------------------------------------------------------------\n// Pack Codec (pack_codec_impl) — PURE format + safety logic, no I/O.\n//\n// planExtraction is the single safety chokepoint (zip-slip / size / ratio /\n// depth / symlink guards, all pre-decompress). sealIntegrity/verifyIntegrity\n// are the produce/verify integrity pair. The codec stays pure: build time is\n// passed in, never read here.\n// ---------------------------------------------------------------------------\n\n/** The archive-root envelope filename. */\nexport const ENVELOPE_FILENAME = 'wairon-pack.yaml';\n\n/** The highest pack-archive format major this SDK understands. */\nconst SUPPORTED_FORMAT_VERSION = 1;\n\n/** The default extraction-safety profile: 4096 / 32 MiB / 8 MiB / 100:1 / depth 16. */\nconst DEFAULTS = {\n  maxEntries: 4096,\n  maxTotalUncompressedBytes: 32 * 1024 * 1024,\n  maxEntryBytes: 8 * 1024 * 1024,\n  maxCompressionRatio: 100,\n  maxDepth: 16,\n} as const;\n\n/** Parse + validate the envelope text into a PackArchiveManifest; throws on malformed/newer-major. */\nexport function parseManifest(text: string): PackArchiveManifest {\n  // Step 1: parse the envelope YAML text (throws on malformed YAML).\n  const raw = yamlLoad(text);\n  // Step 2: validate the required fields are present and well-typed.\n  const manifest = validateEnvelope(raw);\n  // Step 3: is the format major newer than this wairon supports?\n  if (Math.trunc(manifest.formatVersion) > SUPPORTED_FORMAT_VERSION) {\n    // Step 4: fail loudly rather than silently mis-read a newer format.\n    throw new Error('unsupported pack-archive formatVersion (newer than this wairon understands)');\n  }\n  // Step 5: return the parsed manifest.\n  return manifest;\n}\n\n/** Serialize a manifest to canonical wairon-pack.yaml text (build path). */\nexport function serializeManifest(manifest: PackArchiveManifest): string {\n  // Step 1: drop undefined optional fields for a clean, canonical envelope.\n  const clean: Record<string, unknown> = {\n    formatVersion: manifest.formatVersion,\n    name: manifest.name,\n    version: manifest.version,\n    kind: manifest.kind,\n    entry: manifest.entry,\n  };\n  if (manifest.minWaironVersion !== undefined) clean.minWaironVersion = manifest.minWaironVersion;\n  if (manifest.digest !== undefined) clean.digest = manifest.digest;\n  if (manifest.entryDigests !== undefined) clean.entryDigests = manifest.entryDigests;\n  if (manifest.generatedBy !== undefined) clean.generatedBy = manifest.generatedBy;\n  if (manifest.generatedAt !== undefined) clean.generatedAt = manifest.generatedAt;\n  // Step 2: return the wairon-pack.yaml text.\n  return yamlDump(clean, { sortKeys: false });\n}\n\n/** The default extraction-safety profile; callers override individual caps. */\nexport function defaultLimits(): PackExtractionLimits {\n  // Step 1: return the default caps profile.\n  return { ...DEFAULTS };\n}\n\n/** Compute the safe extraction plan from enumerated entries under `limits`, or throw. */\nexport function planExtraction(entries: ArchiveEntryMeta[], limits: PackExtractionLimits): PackExtractionPlan {\n  // Step 1: resolve effective caps — each field of `limits` over the defaults.\n  const caps = {\n    maxEntries: limits.maxEntries ?? DEFAULTS.maxEntries,\n    maxTotalUncompressedBytes: limits.maxTotalUncompressedBytes ?? DEFAULTS.maxTotalUncompressedBytes,\n    maxEntryBytes: limits.maxEntryBytes ?? DEFAULTS.maxEntryBytes,\n    maxCompressionRatio: limits.maxCompressionRatio ?? DEFAULTS.maxCompressionRatio,\n    maxDepth: limits.maxDepth ?? DEFAULTS.maxDepth,\n  };\n  // Step 2: initialize an empty approved-path list and a running total of 0.\n  const approved: string[] = [];\n  let total = 0;\n  // Step 3: vet each enumerated entry.\n  for (const entry of entries) {\n    // Step 4: reject symlinks/non-regular entries and structurally unsafe paths.\n    if (isSymlinkOrNonRegular(entry.kind) || isStructurallyUnsafePath(entry.path)) {\n      rejectUnsafe();\n    }\n    // Directory entries are structural (writeTree recreates them from file\n    // paths) — skip without approving, never inflate a 0-byte dir marker.\n    if (entry.kind === 'dir') continue;\n    // Step 5: normalize the entry path to a destination-relative POSIX path.\n    const normalized = normalizeRelPath(entry.path);\n    // Step 6: reject zip-slip and over-deep paths.\n    if (escapesDestination(normalized) || pathDepth(normalized) > caps.maxDepth) {\n      rejectUnsafe();\n    }\n    // Step 7: reject oversized entries and zip bombs.\n    if (entry.uncompressedSize > caps.maxEntryBytes || compressionRatio(entry) > caps.maxCompressionRatio) {\n      rejectUnsafe();\n    }\n    // Step 8 (vetEnd): accept — append the path and add its inflated size.\n    approved.push(normalized);\n    total += entry.uncompressedSize;\n  }\n  // Step 9: reject archives exceeding the aggregate caps.\n  if (approved.length > caps.maxEntries || total > caps.maxTotalUncompressedBytes) {\n    rejectUnsafe();\n  }\n  // Step 11: return the approved plan.\n  return { paths: approved, totalUncompressedBytes: total };\n}\n\n/** Assert the envelope's name/version match the inner pack manifest; throw on mismatch. */\nexport function verifyIdentity(manifest: PackArchiveManifest, packName: string, packVersion: string): void {\n  // Step 1: do envelope name/version differ from the inner pack manifest?\n  if (manifest.name !== packName || manifest.version !== packVersion) {\n    // Step 2: reject a tampered/mis-assembled archive.\n    throw new Error('envelope identity mismatch (envelope name/version differ from the inner pack manifest)');\n  }\n  // Step 3: identity verified.\n}\n\n/** Verify every entry's sha256 against entryDigests; false when none carried, throws on mismatch. */\nexport function verifyIntegrity(manifest: PackArchiveManifest, files: PackFile[]): boolean {\n  // Step 1: did the envelope carry no integrity data?\n  if (!manifest.entryDigests) {\n    // Step 2: no integrity data present — return false.\n    return false;\n  }\n  const digests = manifest.entryDigests;\n  // Step 3: check each file's digest.\n  for (const file of files) {\n    // The envelope carries these digests and cannot digest itself — skip it.\n    if (file.path === ENVELOPE_FILENAME) continue;\n    // Step 4: does the recomputed sha256 differ from the recorded digest?\n    if (sha256(file.contents) !== digests[file.path]) {\n      // Step 7: a digest mismatch means tampering.\n      throw new Error('integrity digest mismatch');\n    }\n    // Step 5 (checkEnd): this file's digest matches.\n  }\n  // Step 6: all digests matched — return true.\n  return true;\n}\n\n/** Produce-side partner of verifyIntegrity: fill entryDigests + digest + stamps. */\nexport function sealIntegrity(\n  manifest: PackArchiveManifest,\n  files: PackFile[],\n  generatedBy: string,\n  generatedAt: string,\n): PackArchiveManifest {\n  // Step 1: initialize an empty entryDigests map.\n  const entryDigests: Record<string, string> = {};\n  // Step 2: hash each file.\n  for (const file of files) {\n    // The envelope is the carrier of these digests — never hash it into itself.\n    if (file.path === ENVELOPE_FILENAME) continue;\n    // Step 3 (hashEnd): compute sha256(file.contents) and record it under file.path.\n    entryDigests[file.path] = sha256(file.contents);\n  }\n  // Step 4: compute an overall manifest digest over the sorted entryDigests.\n  const digest = sha256(canonicalDigestBytes(entryDigests));\n  // Step 5: set entryDigests, digest, generatedBy, generatedAt.\n  // Step 6: return the sealed manifest.\n  return { ...manifest, entryDigests, digest, generatedBy, generatedAt };\n}\n\n/** Whether the archive's formatVersion + minWaironVersion are compatible with `waironVersion`. */\nexport function checkCompatibility(manifest: PackArchiveManifest, waironVersion: string): boolean {\n  // Step 1: is the archive format unsupported?\n  if (Math.trunc(manifest.formatVersion) > SUPPORTED_FORMAT_VERSION) {\n    // Step 4: incompatible.\n    return false;\n  }\n  // Step 2: is the running wairon below the pack's minimum?\n  if (manifest.minWaironVersion && isBelow(waironVersion, manifest.minWaironVersion)) {\n    // Step 4: incompatible.\n    return false;\n  }\n  // Step 3: compatible.\n  return true;\n}\n\n// --- helpers ---------------------------------------------------------------\n\nfunction rejectUnsafe(): never {\n  throw new Error('reject: unsafe or oversized archive entry (zip-slip / size / ratio / depth guard)');\n}\n\nfunction validateEnvelope(raw: unknown): PackArchiveManifest {\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('malformed pack envelope (not a YAML mapping)');\n  }\n  const o = raw as Record<string, unknown>;\n  if (typeof o.formatVersion !== 'number') throw new Error('pack envelope: formatVersion must be a number');\n  if (typeof o.name !== 'string' || !o.name) throw new Error('pack envelope: name is required');\n  if (typeof o.version !== 'string' || !o.version) throw new Error('pack envelope: version is required');\n  if (typeof o.kind !== 'string' || (o.kind !== 'declarative' && o.kind !== 'code')) {\n    throw new Error('pack envelope: kind must be \"declarative\" or \"code\"');\n  }\n  if (typeof o.entry !== 'string' || !o.entry) throw new Error('pack envelope: entry is required');\n  const manifest: PackArchiveManifest = {\n    formatVersion: o.formatVersion,\n    name: o.name,\n    version: o.version,\n    kind: o.kind,\n    entry: o.entry,\n  };\n  if (typeof o.minWaironVersion === 'string') manifest.minWaironVersion = o.minWaironVersion;\n  if (typeof o.digest === 'string') manifest.digest = o.digest;\n  if (o.entryDigests && typeof o.entryDigests === 'object') {\n    manifest.entryDigests = o.entryDigests as Record<string, string>;\n  }\n  if (typeof o.generatedBy === 'string') manifest.generatedBy = o.generatedBy;\n  if (typeof o.generatedAt === 'string') manifest.generatedAt = o.generatedAt;\n  return manifest;\n}\n\nfunction isSymlinkOrNonRegular(kind: string): boolean {\n  return kind !== 'file' && kind !== 'dir';\n}\n\nfunction isStructurallyUnsafePath(p: string): boolean {\n  if (p.includes('\\\\')) return true; // backslash\n  if (/^[A-Za-z]:/.test(p)) return true; // drive letter\n  if (p.startsWith('/')) return true; // absolute POSIX\n  return p.split('/').some((seg) => seg === '..'); // parent traversal\n}\n\nfunction normalizeRelPath(p: string): string {\n  return p\n    .split('/')\n    .filter((seg) => seg !== '' && seg !== '.')\n    .join('/');\n}\n\nfunction escapesDestination(normalized: string): boolean {\n  return normalized.startsWith('/') || normalized.split('/').some((seg) => seg === '..');\n}\n\nfunction pathDepth(normalized: string): number {\n  return normalized.split('/').filter((seg) => seg !== '').length;\n}\n\nfunction compressionRatio(entry: ArchiveEntryMeta): number {\n  if (entry.compressedSize > 0) return entry.uncompressedSize / entry.compressedSize;\n  return entry.uncompressedSize > 0 ? Infinity : 0;\n}\n\nfunction canonicalDigestBytes(entryDigests: Record<string, string>): Uint8Array {\n  const lines = Object.keys(entryDigests)\n    .sort()\n    .map((key) => `${key}:${entryDigests[key]}`)\n    .join('\\n');\n  return new TextEncoder().encode(lines);\n}\n\nfunction sha256(data: Uint8Array): string {\n  return createHash('sha256').update(data).digest('hex');\n}\n\nfunction isBelow(running: string, minimum: string): boolean {\n  const [rMaj, rMin, rPat] = parseSemverCore(running);\n  const [mMaj, mMin, mPat] = parseSemverCore(minimum);\n  if (rMaj !== mMaj) return rMaj < mMaj;\n  if (rMin !== mMin) return rMin < mMin;\n  return rPat < mPat;\n}\n\nfunction parseSemverCore(v: string): [number, number, number] {\n  const cleaned = v.trim().replace(/^[^0-9]*/, ''); // strip leading ^, ~, >=, v, etc.\n  const core = cleaned.split(/[-+]/)[0]; // drop prerelease/build metadata\n  const parts = core.split('.').map((n) => parseInt(n, 10));\n  return [parts[0] || 0, parts[1] || 0, parts[2] || 0];\n}\n","// The running @wairon/sdk version — stamped into built archives (generatedBy)\n// and used as the \"running wairon version\" for pack version-compatibility\n// checks. tsup inlines package.json at build time; at runtime the require\n// resolves against the shipped package (../package.json from dist/).\n\nexport const SDK_VERSION: string = loadVersion();\n\nfunction loadVersion(): string {\n  try {\n    const pkg = require('../package.json') as { version?: string };\n    return pkg.version ?? '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n","import type { PackFile, PackScaffoldRequest } from './types.js';\nimport { SDK_VERSION } from './version.js';\n\n// ---------------------------------------------------------------------------\n// Pack Scaffold Specialist (pack_scaffold_specialist_impl) — PURE template\n// rendering for `wairon pack init`. Produces an in-memory file map; writes\n// nothing. Code packs pin @wairon/sdk to the running SDK version.\n// ---------------------------------------------------------------------------\n\nconst enc = (s: string): Uint8Array => new TextEncoder().encode(s);\n\n/** Render the scaffold file map for the requested pack (declarative or code). */\nexport function render(request: PackScaffoldRequest): PackFile[] {\n  const version = request.version ?? '0.1.0';\n  let files: PackFile[];\n  // Step 1: which variant?\n  if (request.kind === 'code') {\n    // Step 2: render the code-pack file map.\n    files = renderCodePack(request.name, version);\n    // Step 3: skip the declarative variant (fall through to the skill gate).\n  } else {\n    // Step 4 (declVariant): render the declarative-pack file map.\n    files = renderDeclarativePack(request.name, version);\n  }\n  // Step 5 (skillGate): include a skill stub?\n  if (request.withSkill) {\n    // Step 6: append a skills/<id>/SKILL.md stub to the file map.\n    files.push(renderSkillStub(request.name, version));\n  }\n  // Step 7 (done): return the rendered file map.\n  return files;\n}\n\n// --- variant renderers -----------------------------------------------------\n\nfunction renderDeclarativePack(name: string, version: string): PackFile[] {\n  return [\n    { path: 'wairon-pack.yaml', contents: enc(declarativeEnvelope(name, version)) },\n    { path: 'pack.yaml', contents: enc(declarativeManifest(name, version)) },\n    { path: 'README.md', contents: enc(readme(name, 'declarative', 'pack.yaml')) },\n  ];\n}\n\nfunction renderCodePack(name: string, version: string): PackFile[] {\n  return [\n    { path: 'wairon-pack.yaml', contents: enc(codeEnvelope(name, version)) },\n    { path: 'package.json', contents: enc(codePackageJson(name, version)) },\n    { path: 'tsconfig.json', contents: enc(codeTsconfig()) },\n    { path: 'pack.ts', contents: enc(codeEntry(name, version)) },\n    { path: 'README.md', contents: enc(readme(name, 'code', 'pack.cjs')) },\n  ];\n}\n\nfunction renderSkillStub(name: string, _version: string): PackFile {\n  const id = slug(name);\n  return { path: `skills/${id}/SKILL.md`, contents: enc(skillStub(name)) };\n}\n\n// --- templates -------------------------------------------------------------\n\nfunction declarativeEnvelope(name: string, version: string): string {\n  return [\n    'formatVersion: 1',\n    `name: ${name}`,\n    `version: ${version}`,\n    'kind: declarative',\n    'entry: pack.yaml',\n    '',\n  ].join('\\n');\n}\n\nfunction codeEnvelope(name: string, version: string): string {\n  return [\n    'formatVersion: 1',\n    `name: ${name}`,\n    `version: ${version}`,\n    'kind: code',\n    'entry: pack.cjs',\n    `minWaironVersion: ${SDK_VERSION}`,\n    '',\n  ].join('\\n');\n}\n\nfunction declarativeManifest(name: string, version: string): string {\n  return [\n    `name: ${name}`,\n    `version: ${version}`,\n    '',\n    '# Custom architectural profiles this pack contributes (example, commented):',\n    '# profiles:',\n    '#   my-profile:',\n    '#     family: backend-like',\n    '#     forbiddenStereotypes:',\n    '#       - types: [Adapter]',\n    '#         reason: \"Domain components must not touch adapters directly.\"',\n    'profiles: {}',\n    '',\n    '# Target language / platform tables (example, commented):',\n    '# languages:',\n    '#   rust:',\n    '#     unsupportedFlow: {}',\n    '#     foreignBuiltins: []',\n    'languages: {}',\n    '',\n    '# Reusable, versioned architecture patterns:',\n    'patterns: []',\n    '',\n  ].join('\\n');\n}\n\nfunction codePackageJson(name: string, version: string): string {\n  const pkg = {\n    name,\n    version,\n    private: true,\n    scripts: {\n      build: 'esbuild pack.ts --bundle --platform=node --packages=external --format=cjs --outfile=pack.cjs',\n    },\n    dependencies: {\n      '@wairon/sdk': SDK_VERSION,\n    },\n    devDependencies: {\n      esbuild: '^0.21.0',\n      typescript: '^5.0.0',\n    },\n  };\n  return `${JSON.stringify(pkg, null, 2)}\\n`;\n}\n\nfunction codeTsconfig(): string {\n  const tsconfig = {\n    compilerOptions: {\n      target: 'ES2020',\n      module: 'CommonJS',\n      moduleResolution: 'node',\n      strict: true,\n      esModuleInterop: true,\n      skipLibCheck: true,\n      declaration: false,\n      noEmit: true,\n    },\n    include: ['pack.ts'],\n  };\n  return `${JSON.stringify(tsconfig, null, 2)}\\n`;\n}\n\nfunction codeEntry(name: string, version: string): string {\n  const code = slug(name).toUpperCase().replace(/-/g, '_');\n  return [\n    \"import { defineRule } from '@wairon/sdk';\",\n    \"import type { RuleContext, Finding } from '@wairon/sdk';\",\n    '',\n    'const exampleRule = defineRule({',\n    `  name: '${slug(name)}-example',`,\n    \"  description: 'Example architectural rule. Replace with your own doctrine.',\",\n    `  codes: ['${code}_EXAMPLE'],`,\n    '  check(ctx: RuleContext): Finding[] {',\n    '    const findings: Finding[] = [];',\n    '    for (const component of ctx.components) {',\n    '      // Inspect the spec tree and push findings as needed.',\n    '      void component;',\n    '    }',\n    '    return findings;',\n    '  },',\n    '});',\n    '',\n    'export default {',\n    `  name: '${name}',`,\n    `  version: '${version}',`,\n    '  rules: [exampleRule],',\n    '};',\n    '',\n  ].join('\\n');\n}\n\nfunction readme(name: string, kind: string, entry: string): string {\n  return [\n    `# ${name}`,\n    '',\n    `A wairon ${kind} pack.`,\n    '',\n    `- Envelope: \\`wairon-pack.yaml\\``,\n    `- Entry: \\`${entry}\\``,\n    '',\n    'Build an installable `.wpack` archive with `wairon pack build`.',\n    '',\n  ].join('\\n');\n}\n\nfunction skillStub(name: string): string {\n  return [\n    '---',\n    `name: ${name}`,\n    `description: ${name} authoring skill (stub).`,\n    '---',\n    '',\n    `# ${name}`,\n    '',\n    'Describe when this skill applies and what it guides.',\n    '',\n  ].join('\\n');\n}\n\nfunction slug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '');\n}\n","import * as fs from 'fs';\nimport * as path from 'path';\nimport { zipSync, unzipSync, type Zippable } from 'fflate';\nimport type { ArchiveEntryMeta, PackFile } from './types.js';\n\n// ---------------------------------------------------------------------------\n// Pack Archive Adapter (pack_archive_adapter_impl) — the ONLY zip-library + fs\n// I/O boundary of the SDK. Technology: fflate (pure-JS ZIP, no native deps).\n//\n// Acts only on already-validated inputs: it makes no path-safety or format\n// decisions (that is the codec's job). Enumeration reads sizes WITHOUT\n// inflating so the codec can enforce zip-bomb / size caps before any bytes are\n// decompressed.\n// ---------------------------------------------------------------------------\n\nconst SKIP_DIRS = new Set(['node_modules', '.git', '.hg', '.svn']);\n\n/**\n * Enumerate every entry's metadata (path, compressed + uncompressed size, kind)\n * WITHOUT decompressing any bytes, so the codec can enforce caps before\n * inflation.\n */\nexport function listEntries(archive: Uint8Array): ArchiveEntryMeta[] {\n  // Step 1: read the central directory via the zip library, mapping each record\n  // to ArchiveEntryMeta without inflating any data. fflate's filter reports\n  // {name, size (compressed), originalSize (uncompressed)} for every entry;\n  // returning false skips decompression. Symlink detection reads the central\n  // directory's external attributes (fflate's metadata omits the unix mode).\n  const symlinks = detectSymlinkNames(archive);\n  const metas: ArchiveEntryMeta[] = [];\n  unzipSync(archive, {\n    filter: (info): boolean => {\n      metas.push({\n        path: info.name,\n        uncompressedSize: info.originalSize,\n        compressedSize: info.size,\n        kind: classifyKind(info.name, symlinks),\n      });\n      return false;\n    },\n  });\n  // Step 2: return the entry metadata list.\n  return metas;\n}\n\n/** Decompress and return the bytes of a single named entry. */\nexport function inflateEntry(archive: Uint8Array, entryPath: string): Uint8Array {\n  // Step 1: locate the named entry and inflate only it.\n  const inflated = unzipSync(archive, { filter: (info): boolean => info.name === entryPath });\n  const bytes = inflated[entryPath];\n  if (!bytes) throw new Error(`archive entry not found: ${entryPath}`);\n  // Step 2: return the entry's decompressed bytes.\n  return bytes;\n}\n\n/** Deflate a set of files (the envelope + pack contents) into a single ZIP buffer. */\nexport function assembleArchive(files: PackFile[]): Uint8Array {\n  // Step 1: add each file to a zip container (deflating) and finalize.\n  const zippable: Zippable = {};\n  for (const file of files) zippable[file.path] = file.contents;\n  const bytes = zipSync(zippable);\n  // Step 2: return the archive bytes.\n  return bytes;\n}\n\n/** Read a source pack directory recursively into a file map (POSIX paths + bytes). */\nexport function readPackDir(dir: string): PackFile[] {\n  // Step 1: walk the directory recursively, reading each file into\n  // { path: POSIX-relative, contents } (skipping node_modules and VCS dirs).\n  const files: PackFile[] = [];\n  walkPackDir(dir, dir, files);\n  // Step 2: return the file map.\n  return files;\n}\n\n/** Write a file map as a directory tree under destDir, creating parent directories. */\nexport function writeTree(destDir: string, files: PackFile[]): void {\n  // Step 1: write each approved file.\n  for (const file of files) {\n    // Step 2 (writeEnd): create parent directories and write the file's bytes.\n    const absolute = path.join(destDir, file.path);\n    fs.mkdirSync(path.dirname(absolute), { recursive: true });\n    fs.writeFileSync(absolute, file.contents);\n  }\n  // Step 3: done.\n}\n\n// --- helpers ---------------------------------------------------------------\n\nfunction classifyKind(name: string, symlinks: Set<string>): string {\n  if (symlinks.has(name)) return 'symlink';\n  if (name.endsWith('/')) return 'dir';\n  return 'file';\n}\n\nfunction walkPackDir(root: string, current: string, out: PackFile[]): void {\n  for (const entry of fs.readdirSync(current, { withFileTypes: true })) {\n    if (entry.isDirectory()) {\n      if (SKIP_DIRS.has(entry.name)) continue;\n      walkPackDir(root, path.join(current, entry.name), out);\n    } else if (entry.isFile()) {\n      const absolute = path.join(current, entry.name);\n      const relative = path.relative(root, absolute).split(path.sep).join('/');\n      out.push({ path: relative, contents: fs.readFileSync(absolute) });\n    }\n  }\n}\n\n// Best-effort central-directory scan for symlink entries (unix S_IFLNK in the\n// external file attributes). fflate's high-level metadata omits the unix mode,\n// so the codec's symlink rejection needs this. Any parse trouble yields an\n// empty set — no worse than fflate alone, and confinement/size caps still apply.\nfunction detectSymlinkNames(archive: Uint8Array): Set<string> {\n  const names = new Set<string>();\n  try {\n    const eocd = findEocd(archive);\n    if (eocd < 0) return names;\n    let p = readU32(archive, eocd + 16); // central directory offset\n    const count = readU16(archive, eocd + 10);\n    const decoder = new TextDecoder();\n    for (let i = 0; i < count; i++) {\n      if (readU32(archive, p) !== 0x02014b50) break; // central file header sig\n      const versionMadeBy = readU16(archive, p + 4);\n      const nameLen = readU16(archive, p + 28);\n      const extraLen = readU16(archive, p + 30);\n      const commentLen = readU16(archive, p + 32);\n      const externalAttrs = readU32(archive, p + 38);\n      const name = decoder.decode(archive.subarray(p + 46, p + 46 + nameLen));\n      if ((versionMadeBy >> 8) === 3) { // unix host\n        const unixMode = (externalAttrs >>> 16) & 0xffff;\n        if ((unixMode & 0o170000) === 0o120000) names.add(name);\n      }\n      p += 46 + nameLen + extraLen + commentLen;\n    }\n  } catch {\n    return names;\n  }\n  return names;\n}\n\nfunction findEocd(buf: Uint8Array): number {\n  const minRecord = 22;\n  const lowerBound = Math.max(0, buf.length - (minRecord + 0xffff));\n  for (let i = buf.length - minRecord; i >= lowerBound; i--) {\n    if (readU32(buf, i) === 0x06054b50) return i;\n  }\n  return -1;\n}\n\nfunction readU16(buf: Uint8Array, off: number): number {\n  return buf[off] | (buf[off + 1] << 8);\n}\n\nfunction readU32(buf: Uint8Array, off: number): number {\n  return (buf[off] | (buf[off + 1] << 8) | (buf[off + 2] << 16) | (buf[off + 3] << 24)) >>> 0;\n}\n","// ---------------------------------------------------------------------------\n// Rule-authoring contract (the code-pack compile target).\n//\n// Code packs are written against `@wairon/sdk`, never against wairon core. This\n// is a small, stable, hand-authored facade — deliberately NOT core's fat\n// RuleContext. `defineRule` returns the rule unchanged (identity + type\n// inference); the runtime shape `{ name, description?, codes: string[], check }`\n// is exactly what the core extension loader duck-types.\n// ---------------------------------------------------------------------------\n\n/** Severity of a finding a pack rule emits. */\nexport type RuleSeverity = 'error' | 'warning';\n\n/** A single issue a pack rule reports about the spec tree. */\nexport interface Finding {\n  /** Pack-local issue code (surfaced namespaced by wairon, e.g. `<PACK>_<CODE>`). */\n  code: string;\n  /** 'error' | 'warning'. */\n  severity: RuleSeverity;\n  /** Human-readable explanation of the violation. */\n  message: string;\n  /** The spec id the finding is anchored to (optional). */\n  specId?: string;\n}\n\n/**\n * A read-only spec node as seen by a pack rule: its id/name plus arbitrary\n * further fields (kept open so the facade stays stable as the spec model grows).\n */\nexport interface RuleSpecNode {\n  id: string;\n  name?: string;\n  [key: string]: unknown;\n}\n\n/**\n * The minimal, stable view of the spec tree a code-pack rule inspects. A rule\n * reads these collections and returns findings — it never mutates state and\n * never reaches into wairon core internals.\n */\nexport interface RuleContext {\n  /** The L0 system spec. */\n  system: RuleSpecNode;\n  /** All L1 subsystem specs. */\n  subsystems: RuleSpecNode[];\n  /** All L2 component specs. */\n  components: RuleSpecNode[];\n  /** All L3 interface specs. */\n  interfaces: RuleSpecNode[];\n  /** All L4 implementation specs. */\n  implementations: RuleSpecNode[];\n  /** All shared type/value-object specs. */\n  types: RuleSpecNode[];\n}\n\n/**\n * A programmatic conformance rule shipped by a code pack. Its runtime shape —\n * `{ name, description?, codes: string[], check }` — is what wairon's extension\n * loader duck-types when it loads a `pack.cjs`.\n */\nexport interface SddRule {\n  /** Stable rule id (kebab-case), e.g. \"my-portal-transport\". */\n  name: string;\n  /** One-line description of what the rule enforces and why. */\n  description?: string;\n  /** The issue codes this rule can emit. */\n  codes: string[];\n  /** Inspect the spec tree and return findings (empty when clean). */\n  check(ctx: RuleContext): Finding[];\n}\n\n/**\n * Author an SddRule with full type inference. Returns the rule unchanged — it\n * exists purely so code packs get typed authoring without importing anything\n * from wairon core.\n */\nexport function defineRule(rule: SddRule): SddRule {\n  return rule;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA,iBAAAA,UAAAC,SAAA;AAAA,IAAAA,QAAA;AAAA,MACE,MAAQ;AAAA,MACR,SAAW;AAAA,MACX,aAAe;AAAA,MACf,UAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,QAAU;AAAA,MACV,SAAW;AAAA,MACX,UAAY;AAAA,MACZ,YAAc;AAAA,QACZ,MAAQ;AAAA,QACR,KAAO;AAAA,MACT;AAAA,MACA,MAAQ;AAAA,MACR,MAAQ;AAAA,MACR,OAAS;AAAA,MACT,OAAS;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,MACA,SAAW;AAAA,QACT,MAAQ;AAAA,MACV;AAAA,MACA,SAAW;AAAA,QACT,OAAS;AAAA,QACT,WAAa;AAAA,QACb,MAAQ;AAAA,QACR,cAAc;AAAA,QACd,OAAS;AAAA,MACX;AAAA,MACA,cAAgB;AAAA,QACd,QAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,iBAAmB;AAAA,QACjB,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,QAAU;AAAA,QACV,MAAQ;AAAA,QACR,YAAc;AAAA,QACd,QAAU;AAAA,MACZ;AAAA,IACF;AAAA;AAAA;;;AChDA;AAAA;AAAA,mBAAAC;AAAA,EAAA;AAAA,qBAAAC;AAAA,EAAA,sBAAAC;AAAA,EAAA,oBAAAC;AAAA;AAAA;;;ACAA,IAAAC,QAAsB;AACtB,IAAAC,kBAAiC;;;ACDjC,qBAAmD;AACnD,oBAA2B;AAmBpB,IAAM,oBAAoB;AAGjC,IAAM,2BAA2B;AAGjC,IAAM,WAAW;AAAA,EACf,YAAY;AAAA,EACZ,2BAA2B,KAAK,OAAO;AAAA,EACvC,eAAe,IAAI,OAAO;AAAA,EAC1B,qBAAqB;AAAA,EACrB,UAAU;AACZ;AAGO,SAAS,cAAc,MAAmC;AAE/D,QAAM,UAAM,eAAAC,MAAS,IAAI;AAEzB,QAAM,WAAW,iBAAiB,GAAG;AAErC,MAAI,KAAK,MAAM,SAAS,aAAa,IAAI,0BAA0B;AAEjE,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,SAAO;AACT;AAGO,SAAS,kBAAkB,UAAuC;AAEvE,QAAM,QAAiC;AAAA,IACrC,eAAe,SAAS;AAAA,IACxB,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,OAAO,SAAS;AAAA,EAClB;AACA,MAAI,SAAS,qBAAqB,OAAW,OAAM,mBAAmB,SAAS;AAC/E,MAAI,SAAS,WAAW,OAAW,OAAM,SAAS,SAAS;AAC3D,MAAI,SAAS,iBAAiB,OAAW,OAAM,eAAe,SAAS;AACvE,MAAI,SAAS,gBAAgB,OAAW,OAAM,cAAc,SAAS;AACrE,MAAI,SAAS,gBAAgB,OAAW,OAAM,cAAc,SAAS;AAErE,aAAO,eAAAC,MAAS,OAAO,EAAE,UAAU,MAAM,CAAC;AAC5C;AAGO,SAAS,gBAAsC;AAEpD,SAAO,EAAE,GAAG,SAAS;AACvB;AAGO,SAAS,eAAe,SAA6B,QAAkD;AAE5G,QAAM,OAAO;AAAA,IACX,YAAY,OAAO,cAAc,SAAS;AAAA,IAC1C,2BAA2B,OAAO,6BAA6B,SAAS;AAAA,IACxE,eAAe,OAAO,iBAAiB,SAAS;AAAA,IAChD,qBAAqB,OAAO,uBAAuB,SAAS;AAAA,IAC5D,UAAU,OAAO,YAAY,SAAS;AAAA,EACxC;AAEA,QAAM,WAAqB,CAAC;AAC5B,MAAI,QAAQ;AAEZ,aAAW,SAAS,SAAS;AAE3B,QAAI,sBAAsB,MAAM,IAAI,KAAK,yBAAyB,MAAM,IAAI,GAAG;AAC7E,mBAAa;AAAA,IACf;AAGA,QAAI,MAAM,SAAS,MAAO;AAE1B,UAAM,aAAa,iBAAiB,MAAM,IAAI;AAE9C,QAAI,mBAAmB,UAAU,KAAK,UAAU,UAAU,IAAI,KAAK,UAAU;AAC3E,mBAAa;AAAA,IACf;AAEA,QAAI,MAAM,mBAAmB,KAAK,iBAAiB,iBAAiB,KAAK,IAAI,KAAK,qBAAqB;AACrG,mBAAa;AAAA,IACf;AAEA,aAAS,KAAK,UAAU;AACxB,aAAS,MAAM;AAAA,EACjB;AAEA,MAAI,SAAS,SAAS,KAAK,cAAc,QAAQ,KAAK,2BAA2B;AAC/E,iBAAa;AAAA,EACf;AAEA,SAAO,EAAE,OAAO,UAAU,wBAAwB,MAAM;AAC1D;AAGO,SAAS,eAAe,UAA+B,UAAkB,aAA2B;AAEzG,MAAI,SAAS,SAAS,YAAY,SAAS,YAAY,aAAa;AAElE,UAAM,IAAI,MAAM,wFAAwF;AAAA,EAC1G;AAEF;AAGO,SAAS,gBAAgB,UAA+B,OAA4B;AAEzF,MAAI,CAAC,SAAS,cAAc;AAE1B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,SAAS;AAEzB,aAAW,QAAQ,OAAO;AAExB,QAAI,KAAK,SAAS,kBAAmB;AAErC,QAAI,OAAO,KAAK,QAAQ,MAAM,QAAQ,KAAK,IAAI,GAAG;AAEhD,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAAA,EAEF;AAEA,SAAO;AACT;AAGO,SAAS,cACd,UACA,OACA,aACA,aACqB;AAErB,QAAM,eAAuC,CAAC;AAE9C,aAAW,QAAQ,OAAO;AAExB,QAAI,KAAK,SAAS,kBAAmB;AAErC,iBAAa,KAAK,IAAI,IAAI,OAAO,KAAK,QAAQ;AAAA,EAChD;AAEA,QAAM,SAAS,OAAO,qBAAqB,YAAY,CAAC;AAGxD,SAAO,EAAE,GAAG,UAAU,cAAc,QAAQ,aAAa,YAAY;AACvE;AAGO,SAAS,mBAAmB,UAA+B,eAAgC;AAEhG,MAAI,KAAK,MAAM,SAAS,aAAa,IAAI,0BAA0B;AAEjE,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,QAAQ,eAAe,SAAS,gBAAgB,GAAG;AAElF,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAIA,SAAS,eAAsB;AAC7B,QAAM,IAAI,MAAM,mFAAmF;AACrG;AAEA,SAAS,iBAAiB,KAAmC;AAC3D,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,kBAAkB,SAAU,OAAM,IAAI,MAAM,+CAA+C;AACxG,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,EAAE,KAAM,OAAM,IAAI,MAAM,iCAAiC;AAC5F,MAAI,OAAO,EAAE,YAAY,YAAY,CAAC,EAAE,QAAS,OAAM,IAAI,MAAM,oCAAoC;AACrG,MAAI,OAAO,EAAE,SAAS,YAAa,EAAE,SAAS,iBAAiB,EAAE,SAAS,QAAS;AACjF,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,MAAI,OAAO,EAAE,UAAU,YAAY,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,kCAAkC;AAC/F,QAAM,WAAgC;AAAA,IACpC,eAAe,EAAE;AAAA,IACjB,MAAM,EAAE;AAAA,IACR,SAAS,EAAE;AAAA,IACX,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,EACX;AACA,MAAI,OAAO,EAAE,qBAAqB,SAAU,UAAS,mBAAmB,EAAE;AAC1E,MAAI,OAAO,EAAE,WAAW,SAAU,UAAS,SAAS,EAAE;AACtD,MAAI,EAAE,gBAAgB,OAAO,EAAE,iBAAiB,UAAU;AACxD,aAAS,eAAe,EAAE;AAAA,EAC5B;AACA,MAAI,OAAO,EAAE,gBAAgB,SAAU,UAAS,cAAc,EAAE;AAChE,MAAI,OAAO,EAAE,gBAAgB,SAAU,UAAS,cAAc,EAAE;AAChE,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAuB;AACpD,SAAO,SAAS,UAAU,SAAS;AACrC;AAEA,SAAS,yBAAyB,GAAoB;AACpD,MAAI,EAAE,SAAS,IAAI,EAAG,QAAO;AAC7B,MAAI,aAAa,KAAK,CAAC,EAAG,QAAO;AACjC,MAAI,EAAE,WAAW,GAAG,EAAG,QAAO;AAC9B,SAAO,EAAE,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI;AAChD;AAEA,SAAS,iBAAiB,GAAmB;AAC3C,SAAO,EACJ,MAAM,GAAG,EACT,OAAO,CAAC,QAAQ,QAAQ,MAAM,QAAQ,GAAG,EACzC,KAAK,GAAG;AACb;AAEA,SAAS,mBAAmB,YAA6B;AACvD,SAAO,WAAW,WAAW,GAAG,KAAK,WAAW,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI;AACvF;AAEA,SAAS,UAAU,YAA4B;AAC7C,SAAO,WAAW,MAAM,GAAG,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,EAAE;AAC3D;AAEA,SAAS,iBAAiB,OAAiC;AACzD,MAAI,MAAM,iBAAiB,EAAG,QAAO,MAAM,mBAAmB,MAAM;AACpE,SAAO,MAAM,mBAAmB,IAAI,WAAW;AACjD;AAEA,SAAS,qBAAqB,cAAkD;AAC9E,QAAM,QAAQ,OAAO,KAAK,YAAY,EACnC,KAAK,EACL,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,aAAa,GAAG,CAAC,EAAE,EAC1C,KAAK,IAAI;AACZ,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEA,SAAS,OAAO,MAA0B;AACxC,aAAO,0BAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AACvD;AAEA,SAAS,QAAQ,SAAiB,SAA0B;AAC1D,QAAM,CAAC,MAAM,MAAM,IAAI,IAAI,gBAAgB,OAAO;AAClD,QAAM,CAAC,MAAM,MAAM,IAAI,IAAI,gBAAgB,OAAO;AAClD,MAAI,SAAS,KAAM,QAAO,OAAO;AACjC,MAAI,SAAS,KAAM,QAAO,OAAO;AACjC,SAAO,OAAO;AAChB;AAEA,SAAS,gBAAgB,GAAqC;AAC5D,QAAM,UAAU,EAAE,KAAK,EAAE,QAAQ,YAAY,EAAE;AAC/C,QAAM,OAAO,QAAQ,MAAM,MAAM,EAAE,CAAC;AACpC,QAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AACxD,SAAO,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AACrD;;;ACpRO,IAAM,cAAsB,YAAY;AAE/C,SAAS,cAAsB;AAC7B,MAAI;AACF,UAAM,MAAM;AACZ,WAAO,IAAI,WAAW;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACLA,IAAM,MAAM,CAAC,MAA0B,IAAI,YAAY,EAAE,OAAO,CAAC;AAG1D,SAAS,OAAO,SAA0C;AAC/D,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI;AAEJ,MAAI,QAAQ,SAAS,QAAQ;AAE3B,YAAQ,eAAe,QAAQ,MAAM,OAAO;AAAA,EAE9C,OAAO;AAEL,YAAQ,sBAAsB,QAAQ,MAAM,OAAO;AAAA,EACrD;AAEA,MAAI,QAAQ,WAAW;AAErB,UAAM,KAAK,gBAAgB,QAAQ,MAAM,OAAO,CAAC;AAAA,EACnD;AAEA,SAAO;AACT;AAIA,SAAS,sBAAsB,MAAc,SAA6B;AACxE,SAAO;AAAA,IACL,EAAE,MAAM,oBAAoB,UAAU,IAAI,oBAAoB,MAAM,OAAO,CAAC,EAAE;AAAA,IAC9E,EAAE,MAAM,aAAa,UAAU,IAAI,oBAAoB,MAAM,OAAO,CAAC,EAAE;AAAA,IACvE,EAAE,MAAM,aAAa,UAAU,IAAI,OAAO,MAAM,eAAe,WAAW,CAAC,EAAE;AAAA,EAC/E;AACF;AAEA,SAAS,eAAe,MAAc,SAA6B;AACjE,SAAO;AAAA,IACL,EAAE,MAAM,oBAAoB,UAAU,IAAI,aAAa,MAAM,OAAO,CAAC,EAAE;AAAA,IACvE,EAAE,MAAM,gBAAgB,UAAU,IAAI,gBAAgB,MAAM,OAAO,CAAC,EAAE;AAAA,IACtE,EAAE,MAAM,iBAAiB,UAAU,IAAI,aAAa,CAAC,EAAE;AAAA,IACvD,EAAE,MAAM,WAAW,UAAU,IAAI,UAAU,MAAM,OAAO,CAAC,EAAE;AAAA,IAC3D,EAAE,MAAM,aAAa,UAAU,IAAI,OAAO,MAAM,QAAQ,UAAU,CAAC,EAAE;AAAA,EACvE;AACF;AAEA,SAAS,gBAAgB,MAAc,UAA4B;AACjE,QAAM,KAAK,KAAK,IAAI;AACpB,SAAO,EAAE,MAAM,UAAU,EAAE,aAAa,UAAU,IAAI,UAAU,IAAI,CAAC,EAAE;AACzE;AAIA,SAAS,oBAAoB,MAAc,SAAyB;AAClE,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI;AAAA,IACb,YAAY,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,aAAa,MAAc,SAAyB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI;AAAA,IACb,YAAY,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,qBAAqB,WAAW;AAAA,IAChC;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,oBAAoB,MAAc,SAAyB;AAClE,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb,YAAY,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,gBAAgB,MAAc,SAAyB;AAC9D,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,MACP,OAAO;AAAA,IACT;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,IACjB;AAAA,IACA,iBAAiB;AAAA,MACf,SAAS;AAAA,MACT,YAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA;AACxC;AAEA,SAAS,eAAuB;AAC9B,QAAM,WAAW;AAAA,IACf,iBAAiB;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,kBAAkB;AAAA,MAClB,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,IACA,SAAS,CAAC,SAAS;AAAA,EACrB;AACA,SAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAC7C;AAEA,SAAS,UAAU,MAAc,SAAyB;AACxD,QAAM,OAAO,KAAK,IAAI,EAAE,YAAY,EAAE,QAAQ,MAAM,GAAG;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,CAAC;AAAA,IACtB;AAAA,IACA,cAAc,IAAI;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,IAAI;AAAA,IAChB,eAAe,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,OAAO,MAAc,MAAc,OAAuB;AACjE,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT;AAAA,IACA,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,cAAc,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI;AAAA,IACb,gBAAgB,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,IACA,KAAK,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,MAAsB;AAClC,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAC3B;;;AChNA,SAAoB;AACpB,WAAsB;AACtB,oBAAkD;AAalD,IAAM,YAAY,oBAAI,IAAI,CAAC,gBAAgB,QAAQ,OAAO,MAAM,CAAC;AAO1D,SAAS,YAAY,SAAyC;AAMnE,QAAM,WAAW,mBAAmB,OAAO;AAC3C,QAAM,QAA4B,CAAC;AACnC,+BAAU,SAAS;AAAA,IACjB,QAAQ,CAAC,SAAkB;AACzB,YAAM,KAAK;AAAA,QACT,MAAM,KAAK;AAAA,QACX,kBAAkB,KAAK;AAAA,QACvB,gBAAgB,KAAK;AAAA,QACrB,MAAM,aAAa,KAAK,MAAM,QAAQ;AAAA,MACxC,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAGO,SAAS,aAAa,SAAqB,WAA+B;AAE/E,QAAM,eAAW,yBAAU,SAAS,EAAE,QAAQ,CAAC,SAAkB,KAAK,SAAS,UAAU,CAAC;AAC1F,QAAM,QAAQ,SAAS,SAAS;AAChC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4BAA4B,SAAS,EAAE;AAEnE,SAAO;AACT;AAGO,SAAS,gBAAgB,OAA+B;AAE7D,QAAM,WAAqB,CAAC;AAC5B,aAAW,QAAQ,MAAO,UAAS,KAAK,IAAI,IAAI,KAAK;AACrD,QAAM,YAAQ,uBAAQ,QAAQ;AAE9B,SAAO;AACT;AAGO,SAAS,YAAY,KAAyB;AAGnD,QAAM,QAAoB,CAAC;AAC3B,cAAY,KAAK,KAAK,KAAK;AAE3B,SAAO;AACT;AAGO,SAAS,UAAU,SAAiB,OAAyB;AAElE,aAAW,QAAQ,OAAO;AAExB,UAAM,WAAgB,UAAK,SAAS,KAAK,IAAI;AAC7C,IAAG,aAAe,aAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,IAAG,iBAAc,UAAU,KAAK,QAAQ;AAAA,EAC1C;AAEF;AAIA,SAAS,aAAa,MAAc,UAA+B;AACjE,MAAI,SAAS,IAAI,IAAI,EAAG,QAAO;AAC/B,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,YAAY,MAAc,SAAiB,KAAuB;AACzE,aAAW,SAAY,eAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACpE,QAAI,MAAM,YAAY,GAAG;AACvB,UAAI,UAAU,IAAI,MAAM,IAAI,EAAG;AAC/B,kBAAY,MAAW,UAAK,SAAS,MAAM,IAAI,GAAG,GAAG;AAAA,IACvD,WAAW,MAAM,OAAO,GAAG;AACzB,YAAM,WAAgB,UAAK,SAAS,MAAM,IAAI;AAC9C,YAAMC,YAAgB,cAAS,MAAM,QAAQ,EAAE,MAAW,QAAG,EAAE,KAAK,GAAG;AACvE,UAAI,KAAK,EAAE,MAAMA,WAAU,UAAa,gBAAa,QAAQ,EAAE,CAAC;AAAA,IAClE;AAAA,EACF;AACF;AAMA,SAAS,mBAAmB,SAAkC;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,MAAI;AACF,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,OAAO,EAAG,QAAO;AACrB,QAAI,IAAI,QAAQ,SAAS,OAAO,EAAE;AAClC,UAAM,QAAQ,QAAQ,SAAS,OAAO,EAAE;AACxC,UAAM,UAAU,IAAI,YAAY;AAChC,aAAS,IAAI,GAAG,IAAI,OAAO,KAAK;AAC9B,UAAI,QAAQ,SAAS,CAAC,MAAM,SAAY;AACxC,YAAM,gBAAgB,QAAQ,SAAS,IAAI,CAAC;AAC5C,YAAM,UAAU,QAAQ,SAAS,IAAI,EAAE;AACvC,YAAM,WAAW,QAAQ,SAAS,IAAI,EAAE;AACxC,YAAM,aAAa,QAAQ,SAAS,IAAI,EAAE;AAC1C,YAAM,gBAAgB,QAAQ,SAAS,IAAI,EAAE;AAC7C,YAAM,OAAO,QAAQ,OAAO,QAAQ,SAAS,IAAI,IAAI,IAAI,KAAK,OAAO,CAAC;AACtE,UAAK,iBAAiB,MAAO,GAAG;AAC9B,cAAM,WAAY,kBAAkB,KAAM;AAC1C,aAAK,WAAW,WAAc,MAAU,OAAM,IAAI,IAAI;AAAA,MACxD;AACA,WAAK,KAAK,UAAU,WAAW;AAAA,IACjC;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAAyB;AACzC,QAAM,YAAY;AAClB,QAAM,aAAa,KAAK,IAAI,GAAG,IAAI,UAAU,YAAY,MAAO;AAChE,WAAS,IAAI,IAAI,SAAS,WAAW,KAAK,YAAY,KAAK;AACzD,QAAI,QAAQ,KAAK,CAAC,MAAM,UAAY,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAiB,KAAqB;AACrD,SAAO,IAAI,GAAG,IAAK,IAAI,MAAM,CAAC,KAAK;AACrC;AAEA,SAAS,QAAQ,KAAiB,KAAqB;AACrD,UAAQ,IAAI,GAAG,IAAK,IAAI,MAAM,CAAC,KAAK,IAAM,IAAI,MAAM,CAAC,KAAK,KAAO,IAAI,MAAM,CAAC,KAAK,QAAS;AAC5F;;;AJrIA,IAAM,SAAS,CAAC,MAA0B,IAAI,YAAY,EAAE,OAAO,CAAC;AACpE,IAAM,SAAS,CAAC,MAA0B,IAAI,YAAY,EAAE,OAAO,CAAC;AAG7D,SAAS,aAAa,SAAwC;AAEnE,QAAM,QAAiB,OAAO,OAAO;AAErC,EAAQ,UAAU,QAAQ,WAAW,KAAK;AAE1C,SAAO,MAAM,IAAI,CAAC,SAAc,WAAK,QAAQ,WAAW,KAAK,IAAI,CAAC;AACpE;AAGO,SAAS,UAAU,WAAoC;AAE5D,QAAM,QAAgB,YAAY,SAAS;AAE3C,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,SAAe,iBAAiB;AAC3E,MAAI,CAAC,UAAU;AAEb,UAAM,IAAI,MAAM,0FAA0F;AAAA,EAC5G;AAEA,QAAM,WAAiB,cAAc,OAAO,SAAS,QAAQ,CAAC;AAE9D,QAAM,WAAW,kBAAkB,OAAO,QAAQ;AAElD,EAAM,eAAe,UAAU,SAAS,MAAM,SAAS,OAAO;AAE9D,QAAM,SAAe,cAAc,UAAU,OAAO,eAAe,WAAW,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAE1G,QAAM,aAAmB,kBAAkB,MAAM;AAEjD,QAAM,aAAa,eAAe,OAAO,UAAU;AAEnD,QAAM,eAAuB,gBAAgB,UAAU;AAEvD,QAAM,OAAO,UAAU,QAAQ,UAAU;AACzC,QAAM,oBAAoB,GAAG,OAAO,IAAI,IAAI,OAAO,OAAO;AAE1D,SAAO,EAAE,SAAS,cAAc,MAAM,kBAAkB;AAC1D;AAGO,SAAS,eAAe,cAA2C;AAExE,QAAM,UAAkB,YAAY,YAAY;AAEhD,MAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,SAAe,iBAAiB,GAAG;AAEpE,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,QAAM,gBAAwB,aAAa,cAAoB,iBAAiB;AAEhF,QAAM,WAAiB,cAAc,OAAO,aAAa,CAAC;AAE1D,QAAM,aAAmB,mBAAmB,UAAU,WAAW;AAEjE,QAAM,cAAc,QAAQ,OAAO,CAAC,UAAU,MAAM,SAAS,MAAM;AACnE,QAAM,yBAAyB,QAAQ,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,kBAAkB,CAAC;AAC7F,QAAM,OAAwB;AAAA,IAC5B,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,eAAe,SAAS;AAAA,IACxB,YAAY,YAAY;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,qBAAqB,OAAW,MAAK,mBAAmB,SAAS;AAE9E,SAAO;AACT;AAGO,SAAS,YACd,cACA,SACA,QACsB;AAEtB,QAAM,kBAAkB,WAAW,SAEzB,cAAc,IACpB;AAEJ,QAAM,UAAkB,YAAY,YAAY;AAEhD,QAAM,OAAa,eAAe,SAAS,eAAe;AAE1D,QAAM,QAAoB,CAAC;AAE3B,aAAW,gBAAgB,KAAK,OAAO;AAErC,UAAM,WAAmB,aAAa,cAAc,YAAY;AAEhE,UAAM,KAAK,EAAE,MAAM,cAAc,SAAS,CAAC;AAAA,EAC7C;AAEA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,SAAe,iBAAiB;AAC3E,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,QAAM,WAAiB,cAAc,OAAO,SAAS,QAAQ,CAAC;AAE9D,EAAM,gBAAgB,UAAU,KAAK;AAErC,QAAM,YAAiB,cAAQ,OAAO;AACtC,EAAQ,UAAU,WAAW,KAAK;AAElC,QAAM,SAA+B;AAAA,IACnC;AAAA,IACA,WAAW,SAAS;AAAA,IACpB;AAAA,IACA,MAAM,SAAS;AAAA,IACf,MAAM,SAAS;AAAA,IACf,YAAY,MAAM;AAAA,EACpB;AAEA,SAAO;AACT;AAIA,SAAS,kBAAkB,OAAmB,UAAkE;AAC9G,QAAM,YAAY,SAAS,SAAS,SAAS,iBAAiB,SAAS;AACvE,QAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,SAAS;AAC1D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,oCAAoC,SAAS,cAAc;AACvF,QAAM,SAAU,SAAS,SAAS,SAC9B,KAAK,MAAM,OAAO,MAAM,QAAQ,CAAC,QACjC,gBAAAC,MAAS,OAAO,MAAM,QAAQ,CAAC;AACnC,QAAM,OAAO,QAAQ;AACrB,QAAM,UAAU,QAAQ;AACxB,MAAI,OAAO,SAAS,YAAY,OAAO,YAAY,UAAU;AAC3D,UAAM,IAAI,MAAM,oCAAoC,SAAS,wBAAwB;AAAA,EACvF;AACA,SAAO,EAAE,MAAM,QAAQ;AACzB;AAEA,SAAS,eAAe,OAAmB,cAAkC;AAC3E,QAAM,SAAS,MAAM,OAAO,CAAC,SAAS,KAAK,SAAe,iBAAiB;AAC3E,SAAO,CAAC,GAAG,QAAQ,EAAE,MAAY,mBAAmB,UAAU,OAAO,YAAY,EAAE,CAAC;AACtF;AAEA,SAAS,UAAU,UAA+B,OAAoC;AACpF,QAAM,yBAAyB,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,SAAS,QAAQ,CAAC;AACxF,QAAM,OAAwB;AAAA,IAC5B,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,eAAe,SAAS;AAAA,IACxB,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AACA,MAAI,SAAS,qBAAqB,OAAW,MAAK,mBAAmB,SAAS;AAC9E,SAAO;AACT;;;AK5GO,SAAS,WAAW,MAAwB;AACjD,SAAO;AACT;;;AN7DO,SAASC,cAAa,SAAwC;AAEnE,SAAoB,aAAa,OAAO;AAC1C;AAGO,SAASC,WAAU,WAAoC;AAE5D,SAAoB,UAAU,SAAS;AACzC;AAGO,SAASC,gBAAe,SAAsC;AAEnE,SAAoB,eAAe,OAAO;AAC5C;AAGO,SAASC,aACd,SACA,SACA,QACsB;AAEtB,SAAoB,YAAY,SAAS,SAAS,MAAM;AAC1D;","names":["exports","module","buildPack","extractPack","inspectArchive","scaffoldPack","path","import_js_yaml","yamlLoad","yamlDump","relative","yamlLoad","scaffoldPack","buildPack","inspectArchive","extractPack"]}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@wairon/sdk",
+  "version": "5.0.1-dev.5",
+  "description": "Wairon pack-archive (.wpack) format authority and authoring toolkit — scaffold, build, inspect, and safely extract wairon extension packs.",
+  "keywords": [
+    "wairon",
+    "sdd",
+    "pack",
+    "wpack",
+    "archive",
+    "developer-tools"
+  ],
+  "author": "SYW",
+  "license": "MIT",
+  "homepage": "https://github.com/SYW-Apps/Waffle-AIron",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SYW-Apps/Waffle-AIron.git"
+  },
+  "type": "commonjs",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rimraf dist"
+  },
+  "dependencies": {
+    "fflate": "^0.8.2",
+    "js-yaml": "^4.1.0"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.14.0",
+    "rimraf": "^5.0.7",
+    "tsup": "^8.1.0",
+    "typescript": "^5.5.2",
+    "vitest": "^4.1.9"
+  }
+}