aw-spec-cli 0.1.2 → 0.1.3

package/assets/docs/ModularMonolith/pack-foundation.ps1

@@ -0,0 +1,145 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Pack a verified foundation solution into a single AW-Spec text pack file.
+
+.DESCRIPTION
+    Walks -SourceDir, excludes build/IDE artifacts, and writes every remaining file
+    into one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored
+    verbatim (UTF-8, LF); binary files are base64-encoded. The resulting pack file is
+    the single bundled artifact consumed by /aw-spec-foundation (see PACKAGING.md).
+
+.EXAMPLE
+    ./pack-foundation.ps1 -SourceDir ../../.foundation-build -OutFile ./VerticalSlice.pack.txt
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $SourceDir,
+    [string] $OutFile,
+    [string] $Sentinel    = 'AppWeaver.Foundation',
+    [string] $Foundation  = 'VerticalSlice',
+    [switch] $AllowSecrets
+)
+
+$ErrorActionPreference = 'Stop'
+
+$src = (Resolve-Path -LiteralPath $SourceDir).Path
+if (-not (Test-Path -LiteralPath $src -PathType Container)) {
+    throw "SourceDir is not a folder: $SourceDir"
+}
+if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
+
+# Entire subtree excluded if any path segment matches one of these
+$excludeDirs  = @('bin','obj','.vs','.git','.idea','.vscode','TestResults','node_modules','packages','App_Data','artifacts','.next','logs')
+# Files excluded by name glob (build noise, local dbs, and secret-bearing files)
+# NOTE: the root '.env' is intentionally NOT excluded — it carries required sample config
+# and is bundled on purpose. Per-environment overrides ('.env.local', '.env.production', ...)
+# stay excluded via the '.env.*' glob. Real credentials are still caught by the content scan.
+$excludeFiles = @(
+    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
+    '.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json'
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless -AllowSecrets.
+$secretPatterns = @(
+    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
+    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
+    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
+    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
+)
+
+function Test-Excluded([string] $relPath) {
+    foreach ($seg in ($relPath -split '[\\/]')) {
+        if ($excludeDirs -contains $seg) { return $true }
+    }
+    $leaf = Split-Path $relPath -Leaf
+    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
+    return $false
+}
+
+function Test-Binary([byte[]] $bytes) {
+    $n = [Math]::Min(8000, $bytes.Length)
+    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
+    return $false
+}
+
+# Collect + filter
+$picked = New-Object System.Collections.Generic.List[object]
+foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
+    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
+    if (Test-Excluded $rel) { continue }
+    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
+}
+$picked = @($picked | Sort-Object Rel)
+if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
+
+# Secret scan — fail closed so credentials never get baked into the committed bundle
+$findings = New-Object System.Collections.Generic.List[string]
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+    } catch { continue }
+    foreach ($pat in $secretPatterns) {
+        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
+    }
+}
+if ($findings.Count -gt 0) {
+    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
+    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
+}
+
+# Sentinel sanity check
+$hits = 0
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+        if ($t.Contains($Sentinel)) { $hits++ }
+    } catch { }
+}
+if ($hits -eq 0) {
+    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you build the sample under that exact name?"
+} else {
+    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
+}
+
+# Build the pack (explicit LF newlines throughout)
+$sb = [System.Text.StringBuilder]::new()
+function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
+
+AddLine '# AW-SPEC FOUNDATION PACK'
+AddLine "# foundation: $Foundation"
+AddLine "# sentinel: $Sentinel"
+AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
+AddLine "# files: $($picked.Count)"
+AddLine '# format: aw-spec-pack/v1'
+AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+AddLine '#   <Sentinel>           -> <AppName>            (dotted:       namespaces, csproj/sln, refs)'
+AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  Aspire project class names)'
+AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: UserSecretsId, db/containers)'
+AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+AddLine '# ============================================================'
+AddLine ''
+
+foreach ($p in $picked) {
+    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
+    if (Test-Binary $bytes) {
+        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
+        AddLine ([Convert]::ToBase64String($bytes))
+        AddLine '<<<ENDFILE>>>'
+    } else {
+        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
+        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
+        [void]$sb.Append($text)
+        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
+        AddLine '<<<ENDFILE>>>'
+    }
+}
+
+$outDir = Split-Path -Parent $OutFile
+if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
+    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
+}
+[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
+
+Write-Host "Packed $($picked.Count) file(s) -> $OutFile"

package/assets/docs/ModularMonolith/pack-foundation.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+#
+# pack-foundation.sh — bash/macOS+Unix port of pack-foundation.ps1
+#
+# SYNOPSIS
+#   Pack a verified foundation solution into a single AW-Spec text pack file.
+#
+# DESCRIPTION
+#   Walks --source-dir, excludes build/IDE artifacts and secret-bearing files, and
+#   writes every remaining file into one pack file using <<<FILE>>> / <<<ENDFILE>>>
+#   markers. Text files are stored verbatim (UTF-8, LF); binary files are
+#   base64-encoded. The resulting pack file is the single bundled artifact consumed
+#   by /aw-spec-foundation (see PACKAGING.md). This is byte-for-byte format-compatible
+#   with pack-foundation.ps1 / unpack-foundation.ps1.
+#
+# EXAMPLE
+#   ./pack-foundation.sh --source-dir ../../.foundation-build --out-file ./VerticalSlice.pack.txt --allow-secrets
+#
+set -euo pipefail
+
+# ------------------------------------------------------------------ defaults ---
+SENTINEL='AppWeaver.Foundation'
+FOUNDATION='VerticalSlice'
+SOURCE_DIR=''
+OUT_FILE=''
+ALLOW_SECRETS=0
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: pack-foundation.sh --source-dir <dir> [--out-file <file>] [--sentinel <name>]
+                          [--foundation <name>] [--allow-secrets]
+
+  -s, --source-dir <dir>   Folder holding the foundation solution        (required)
+  -o, --out-file <file>    Output pack file  (default: ./<foundation>.pack.txt)
+      --sentinel <name>    Sentinel app name        (default: AppWeaver.Foundation)
+      --foundation <name>  Foundation name                 (default: VerticalSlice)
+      --allow-secrets      Pack even if credential markers are detected
+  -h, --help               Show this help
+
+Positional fallback: pack-foundation.sh <source-dir> [out-file]
+EOF
+}
+
+# -------------------------------------------------------------- arg parsing ---
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -s|--source-dir)  SOURCE_DIR="${2:?--source-dir needs a value}"; shift 2 ;;
+    -o|--out-file)    OUT_FILE="${2:?--out-file needs a value}";     shift 2 ;;
+    --sentinel)       SENTINEL="${2:?--sentinel needs a value}";     shift 2 ;;
+    --foundation)     FOUNDATION="${2:?--foundation needs a value}"; shift 2 ;;
+    --allow-secrets)  ALLOW_SECRETS=1; shift ;;
+    -h|--help)        usage; exit 0 ;;
+    --)               shift; break ;;
+    -*)               echo "Error: unknown option: $1" >&2; usage; exit 2 ;;
+    *)
+      if   [ -z "$SOURCE_DIR" ]; then SOURCE_DIR="$1"
+      elif [ -z "$OUT_FILE"   ]; then OUT_FILE="$1"
+      else echo "Error: unexpected argument: $1" >&2; usage; exit 2
+      fi
+      shift ;;
+  esac
+done
+
+[ -n "$SOURCE_DIR" ] || { echo "Error: --source-dir is required." >&2; usage; exit 2; }
+[ -d "$SOURCE_DIR" ] || { echo "Error: SourceDir is not a folder: $SOURCE_DIR" >&2; exit 1; }
+
+SRC="$(cd "$SOURCE_DIR" && pwd -P)"
+[ -n "$OUT_FILE" ] || OUT_FILE="$(pwd)/$FOUNDATION.pack.txt"
+
+# -------------------------------------------------------------- exclusions ---
+# Entire subtree excluded if any path segment matches one of these.
+EXCLUDE_DIRS=(bin obj .vs .git .idea .vscode TestResults node_modules packages App_Data artifacts .next logs)
+# Files excluded by leaf-name glob (build noise, local dbs, and secret-bearing files).
+# NOTE: the root `.env` is intentionally NOT excluded — it carries required sample config
+# and is bundled on purpose. Per-environment overrides (`.env.local`, `.env.production`, ...)
+# stay excluded via the `.env.*` glob. Real credentials are still caught by the content scan.
+EXCLUDE_FILES=('*.user' '*.suo' '*.DotSettings.user' '*.db' '*.db-shm' '*.db-wal' '*.sqlite' '*.log' \
+               '.env.*' '*.pfx' '*.pem' '*.key' '*.snk' 'id_rsa' 'id_rsa.pub' 'secrets.json')
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless --allow-secrets.
+SECRET_NAMES=('NuGet ClearTextPassword' 'Private key block' 'AWS access key id' 'Azure DevOps PAT-ish')
+SECRET_RX=('ClearTextPassword' \
+           'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' \
+           'AKIA[0-9A-Z]{16}' \
+           '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]')
+
+is_excluded() {  # $1 = repo-relative path with '/' separators
+  local rel="$1" seg leaf g
+  local -a segs
+  IFS='/' read -ra segs <<< "$rel"
+  for seg in "${segs[@]}"; do
+    for g in "${EXCLUDE_DIRS[@]}"; do
+      [ "$seg" = "$g" ] && return 0
+    done
+  done
+  leaf="${rel##*/}"
+  for g in "${EXCLUDE_FILES[@]}"; do
+    # shellcheck disable=SC2254  # intentional glob match
+    case "$leaf" in $g) return 0 ;; esac
+  done
+  return 1
+}
+
+is_binary() {  # $1 = file path; true if a NUL byte appears in the first 8000 bytes
+  local f="$1" n1 n2
+  n1="$(head -c 8000 "$f" | wc -c | tr -d '[:space:]')"
+  n2="$(head -c 8000 "$f" | LC_ALL=C tr -d '\000' | wc -c | tr -d '[:space:]')"
+  [ "$n1" != "$n2" ]
+}
+
+# ----------------------------------------------------------- collect + sort ---
+picked=()
+while IFS= read -r full; do
+  rel="${full#"$SRC"/}"
+  is_excluded "$rel" && continue
+  picked+=("$rel")
+done < <(find "$SRC" -type f | LC_ALL=C sort)
+
+[ "${#picked[@]}" -gt 0 ] || { echo "Error: No files to pack under: $SRC" >&2; exit 1; }
+
+# ----------------------------------------------------------- secret scan -----
+# Fail closed so credentials never get baked into the committed bundle.
+findings=()
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  for i in "${!SECRET_RX[@]}"; do
+    if LC_ALL=C grep -aEq -- "${SECRET_RX[$i]}" "$f" 2>/dev/null; then
+      findings+=("  $rel  ->  ${SECRET_NAMES[$i]}")
+    fi
+  done
+done
+if [ "${#findings[@]}" -gt 0 ]; then
+  if [ "$ALLOW_SECRETS" -eq 1 ]; then
+    echo "WARNING: Potential secret(s) detected — packing anyway (--allow-secrets):" >&2
+    printf '%s\n' "${findings[@]}" >&2
+  else
+    echo "Error: Potential secret(s) detected — refusing to pack (rotate + remove them, or pass --allow-secrets):" >&2
+    printf '%s\n' "${findings[@]}" >&2
+    exit 1
+  fi
+fi
+
+# ----------------------------------------------------------- sentinel check --
+hits=0
+for rel in "${picked[@]}"; do
+  if LC_ALL=C grep -aFq -- "$SENTINEL" "$SRC/$rel" 2>/dev/null; then
+    hits=$((hits + 1))
+  fi
+done
+if [ "$hits" -eq 0 ]; then
+  echo "WARNING: Sentinel '$SENTINEL' not found in any file. Did you build the sample under that exact name?" >&2
+else
+  echo "Sentinel '$SENTINEL' found in $hits file(s)."
+fi
+
+# ----------------------------------------------------------- write the pack --
+outdir="$(dirname "$OUT_FILE")"
+[ -d "$outdir" ] || mkdir -p "$outdir"
+
+{
+  printf '%s\n' '# AW-SPEC FOUNDATION PACK'
+  printf '# foundation: %s\n' "$FOUNDATION"
+  printf '# sentinel: %s\n'   "$SENTINEL"
+  printf '# generated: %s\n'  "$(date -u +%Y-%m-%dT%H:%M:%S.0000000Z)"
+  printf '# files: %s\n'      "${#picked[@]}"
+  printf '%s\n' '# format: aw-spec-pack/v1'
+  printf '%s\n' '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+  printf '%s\n' '#   <Sentinel>           -> <AppName>            (dotted:       namespaces, csproj/sln, refs)'
+  printf '%s\n' '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  Aspire project class names)'
+  printf '%s\n' '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: UserSecretsId, db/containers)'
+  printf '%s\n' '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+  printf '%s\n' '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+  printf '%s\n' '# ============================================================'
+  printf '\n'
+} > "$OUT_FILE"
+
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  if is_binary "$f"; then
+    {
+      printf '<<<FILE path="%s" encoding="base64">>>\n' "$rel"
+      base64 < "$f" | tr -d '\n'
+      printf '\n'
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  else
+    {
+      printf '<<<FILE path="%s">>>\n' "$rel"
+      # CRLF -> LF, and guarantee the content ends with exactly one trailing newline.
+      awk '{ sub(/\r$/, ""); print }' "$f"
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  fi
+done
+
+echo "Packed ${#picked[@]} file(s) -> $OUT_FILE"

package/assets/docs/ModularMonolith/pack-reference-foundation.ps1

@@ -0,0 +1,157 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Pack a verified feature reference template into a single AW-Spec text pack file.
+
+.DESCRIPTION
+    Walks -SourceDir (a templates/features/<Name>.SimpleSample folder), excludes build/IDE
+    artifacts, template meta-files, and secret-bearing files, and writes every remaining file
+    into one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
+    (UTF-8, LF); binary files are base64-encoded. The resulting pack file is the single bundled
+    artifact consumed by /aw-spec-addcomponent or /aw-spec-implement unpack workflows.
+
+.EXAMPLE
+    ./pack-reference-foundation.ps1 `
+        -SourceDir ../../templates/features/VerticalSlice.SimpleSample `
+        -OutFile   ./VerticalSlice.Reference.pack.txt `
+        -Sentinel  AppWeaver.VerticalSlice `
+        -Foundation VerticalSlice.Reference
+
+.EXAMPLE
+    ./pack-reference-foundation.ps1 `
+        -SourceDir ../../templates/features/ModularMonolith.SimpleSample `
+        -OutFile   ../ModularMonolith/ModularMonolith.Reference.pack.txt `
+        -Sentinel  AppWeaver.ModularMonolith `
+        -Foundation ModularMonolith.Reference
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $SourceDir,
+    [string] $OutFile,
+    [string] $Sentinel   = 'AppWeaver.VerticalSlice',
+    [string] $Foundation = 'VerticalSlice.Reference',
+    [switch] $AllowSecrets
+)
+
+$ErrorActionPreference = 'Stop'
+
+$src = (Resolve-Path -LiteralPath $SourceDir).Path
+if (-not (Test-Path -LiteralPath $src -PathType Container)) {
+    throw "SourceDir is not a folder: $SourceDir"
+}
+if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
+
+# Entire subtree excluded if any path segment matches one of these.
+$excludeDirs  = @('bin','obj','.vs','.git','.idea','.vscode','TestResults','node_modules','packages','App_Data','artifacts','.next','logs')
+
+# Files excluded by leaf-name glob (build noise, local dbs, secret-bearing files, and
+# template meta-files that should never appear in unpacked output).
+$excludeFiles = @(
+    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
+    '.env','*.env.*','.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
+    '.DS_Store',           # macOS metadata
+    '*.my-ref.*',          # template annotation files (Action: Exclude in TemplateConfig)
+    '*TemplateConfig.config'  # template configuration meta-files
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless -AllowSecrets.
+$secretPatterns = @(
+    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
+    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
+    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
+    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
+)
+
+function Test-Excluded([string] $relPath) {
+    foreach ($seg in ($relPath -split '[\\/]')) {
+        if ($excludeDirs -contains $seg) { return $true }
+    }
+    $leaf = Split-Path $relPath -Leaf
+    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
+    return $false
+}
+
+function Test-Binary([byte[]] $bytes) {
+    $n = [Math]::Min(8000, $bytes.Length)
+    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
+    return $false
+}
+
+# Collect + filter
+$picked = New-Object System.Collections.Generic.List[object]
+foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
+    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
+    if (Test-Excluded $rel) { continue }
+    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
+}
+$picked = @($picked | Sort-Object Rel)
+if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
+
+# Secret scan — fail closed so credentials never get baked into the committed bundle.
+$findings = New-Object System.Collections.Generic.List[string]
+foreach ($p in $picked) {
+    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
+    foreach ($pat in $secretPatterns) {
+        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
+    }
+}
+if ($findings.Count -gt 0) {
+    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
+    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
+}
+
+# Sentinel sanity check
+$hits = 0
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+        if ($t.Contains($Sentinel)) { $hits++ }
+    } catch { }
+}
+if ($hits -eq 0) {
+    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you build the sample under that exact name?"
+} else {
+    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
+}
+
+# Build the pack (explicit LF newlines throughout)
+$sb = [System.Text.StringBuilder]::new()
+function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
+
+AddLine '# AW-SPEC REFERENCE PACK'
+AddLine "# foundation: $Foundation"
+AddLine "# sentinel: $Sentinel"
+AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
+AddLine "# files: $($picked.Count)"
+AddLine '# format: aw-spec-pack/v1'
+AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+AddLine '#   <Sentinel>           -> <AppName>            (dotted:       namespaces, csproj/sln, refs)'
+AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  Aspire project class names)'
+AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: UserSecretsId, db/containers)'
+AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+AddLine '# ============================================================'
+AddLine ''
+
+foreach ($p in $picked) {
+    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
+    if (Test-Binary $bytes) {
+        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
+        AddLine ([Convert]::ToBase64String($bytes))
+        AddLine '<<<ENDFILE>>>'
+    } else {
+        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
+        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
+        [void]$sb.Append($text)
+        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
+        AddLine '<<<ENDFILE>>>'
+    }
+}
+
+$outDir = Split-Path -Parent $OutFile
+if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
+    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
+}
+[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
+
+Write-Host "Packed $($picked.Count) file(s) -> $OutFile"