aw-spec-cli 0.1.2 → 0.1.4

package/assets/docs/VerticalSlice/pack-reference-foundation.ps1

@@ -0,0 +1,157 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Pack a verified feature reference template into a single AW-Spec text pack file.
+
+.DESCRIPTION
+    Walks -SourceDir (a templates/features/<Name>.SimpleSample folder), excludes build/IDE
+    artifacts, template meta-files, and secret-bearing files, and writes every remaining file
+    into one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
+    (UTF-8, LF); binary files are base64-encoded. The resulting pack file is the single bundled
+    artifact consumed by /aw-spec-addcomponent or /aw-spec-implement unpack workflows.
+
+.EXAMPLE
+    ./pack-reference-foundation.ps1 `
+        -SourceDir ../../templates/features/VerticalSlice.SimpleSample `
+        -OutFile   ./VerticalSlice.Reference.pack.txt `
+        -Sentinel  AppWeaver.VerticalSlice `
+        -Foundation VerticalSlice.Reference
+
+.EXAMPLE
+    ./pack-reference-foundation.ps1 `
+        -SourceDir ../../templates/features/ModularMonolith.SimpleSample `
+        -OutFile   ../ModularMonolith/ModularMonolith.Reference.pack.txt `
+        -Sentinel  AppWeaver.ModularMonolith `
+        -Foundation ModularMonolith.Reference
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $SourceDir,
+    [string] $OutFile,
+    [string] $Sentinel   = 'AppWeaver.VerticalSlice',
+    [string] $Foundation = 'VerticalSlice.Reference',
+    [switch] $AllowSecrets
+)
+
+$ErrorActionPreference = 'Stop'
+
+$src = (Resolve-Path -LiteralPath $SourceDir).Path
+if (-not (Test-Path -LiteralPath $src -PathType Container)) {
+    throw "SourceDir is not a folder: $SourceDir"
+}
+if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
+
+# Entire subtree excluded if any path segment matches one of these.
+$excludeDirs  = @('bin','obj','.vs','.git','.idea','.vscode','TestResults','node_modules','packages','App_Data','artifacts','.next','logs')
+
+# Files excluded by leaf-name glob (build noise, local dbs, secret-bearing files, and
+# template meta-files that should never appear in unpacked output).
+$excludeFiles = @(
+    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
+    '.env','*.env.*','.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
+    '.DS_Store',           # macOS metadata
+    '*.my-ref.*',          # template annotation files (Action: Exclude in TemplateConfig)
+    '*TemplateConfig.config'  # template configuration meta-files
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless -AllowSecrets.
+$secretPatterns = @(
+    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
+    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
+    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
+    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
+)
+
+function Test-Excluded([string] $relPath) {
+    foreach ($seg in ($relPath -split '[\\/]')) {
+        if ($excludeDirs -contains $seg) { return $true }
+    }
+    $leaf = Split-Path $relPath -Leaf
+    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
+    return $false
+}
+
+function Test-Binary([byte[]] $bytes) {
+    $n = [Math]::Min(8000, $bytes.Length)
+    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
+    return $false
+}
+
+# Collect + filter
+$picked = New-Object System.Collections.Generic.List[object]
+foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
+    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
+    if (Test-Excluded $rel) { continue }
+    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
+}
+$picked = @($picked | Sort-Object Rel)
+if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
+
+# Secret scan — fail closed so credentials never get baked into the committed bundle.
+$findings = New-Object System.Collections.Generic.List[string]
+foreach ($p in $picked) {
+    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
+    foreach ($pat in $secretPatterns) {
+        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
+    }
+}
+if ($findings.Count -gt 0) {
+    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
+    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
+}
+
+# Sentinel sanity check
+$hits = 0
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+        if ($t.Contains($Sentinel)) { $hits++ }
+    } catch { }
+}
+if ($hits -eq 0) {
+    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you build the sample under that exact name?"
+} else {
+    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
+}
+
+# Build the pack (explicit LF newlines throughout)
+$sb = [System.Text.StringBuilder]::new()
+function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
+
+AddLine '# AW-SPEC REFERENCE PACK'
+AddLine "# foundation: $Foundation"
+AddLine "# sentinel: $Sentinel"
+AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
+AddLine "# files: $($picked.Count)"
+AddLine '# format: aw-spec-pack/v1'
+AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+AddLine '#   <Sentinel>           -> <AppName>            (dotted:       namespaces, csproj/sln, refs)'
+AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  Aspire project class names)'
+AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: UserSecretsId, db/containers)'
+AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+AddLine '# ============================================================'
+AddLine ''
+
+foreach ($p in $picked) {
+    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
+    if (Test-Binary $bytes) {
+        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
+        AddLine ([Convert]::ToBase64String($bytes))
+        AddLine '<<<ENDFILE>>>'
+    } else {
+        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
+        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
+        [void]$sb.Append($text)
+        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
+        AddLine '<<<ENDFILE>>>'
+    }
+}
+
+$outDir = Split-Path -Parent $OutFile
+if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
+    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
+}
+[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
+
+Write-Host "Packed $($picked.Count) file(s) -> $OutFile"

package/assets/docs/VerticalSlice/pack-reference-foundation.sh

@@ -0,0 +1,209 @@
+#!/usr/bin/env bash
+#
+# pack-reference-foundation.sh — bash/macOS port of pack-reference-foundation.ps1
+#
+# SYNOPSIS
+#   Pack a verified feature reference template into a single AW-Spec text pack file.
+#
+# DESCRIPTION
+#   Walks --source-dir (a templates/features/<Name>.SimpleSample folder), excludes build/IDE
+#   artifacts, template meta-files, and secret-bearing files, and writes every remaining file
+#   into one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
+#   (UTF-8, LF); binary files are base64-encoded. Format-compatible with unpack-reference-foundation.
+#
+# EXAMPLE
+#   ./pack-reference-foundation.sh \
+#       --source-dir ../../templates/features/VerticalSlice.SimpleSample \
+#       --out-file   ./VerticalSlice.Reference.pack.txt \
+#       --sentinel   AppWeaver.VerticalSlice \
+#       --foundation VerticalSlice.Reference
+#
+#   ./pack-reference-foundation.sh \
+#       --source-dir ../../templates/features/ModularMonolith.SimpleSample \
+#       --out-file   ../ModularMonolith/ModularMonolith.Reference.pack.txt \
+#       --sentinel   AppWeaver.ModularMonolith \
+#       --foundation ModularMonolith.Reference
+#
+set -euo pipefail
+
+# ------------------------------------------------------------------ defaults ---
+SENTINEL='AppWeaver.VerticalSlice'
+FOUNDATION='VerticalSlice.Reference'
+SOURCE_DIR=''
+OUT_FILE=''
+ALLOW_SECRETS=0
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: pack-reference-foundation.sh --source-dir <dir> [--out-file <file>]
+                                    [--sentinel <name>] [--foundation <name>]
+                                    [--allow-secrets]
+
+  -s, --source-dir <dir>   templates/features/<Name>.SimpleSample folder  (required)
+  -o, --out-file <file>    Output pack file  (default: ./<foundation>.pack.txt)
+      --sentinel <name>    Sentinel app name  (default: AppWeaver.VerticalSlice)
+      --foundation <name>  Foundation/pack name  (default: VerticalSlice.Reference)
+      --allow-secrets      Pack even if credential markers are detected
+  -h, --help               Show this help
+
+Positional fallback: pack-reference-foundation.sh <source-dir> [out-file]
+EOF
+}
+
+# -------------------------------------------------------------- arg parsing ---
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -s|--source-dir)  SOURCE_DIR="${2:?--source-dir needs a value}"; shift 2 ;;
+    -o|--out-file)    OUT_FILE="${2:?--out-file needs a value}";     shift 2 ;;
+    --sentinel)       SENTINEL="${2:?--sentinel needs a value}";     shift 2 ;;
+    --foundation)     FOUNDATION="${2:?--foundation needs a value}"; shift 2 ;;
+    --allow-secrets)  ALLOW_SECRETS=1; shift ;;
+    -h|--help)        usage; exit 0 ;;
+    --)               shift; break ;;
+    -*)               echo "Error: unknown option: $1" >&2; usage; exit 2 ;;
+    *)
+      if   [ -z "$SOURCE_DIR" ]; then SOURCE_DIR="$1"
+      elif [ -z "$OUT_FILE"   ]; then OUT_FILE="$1"
+      else echo "Error: unexpected argument: $1" >&2; usage; exit 2
+      fi
+      shift ;;
+  esac
+done
+
+[ -n "$SOURCE_DIR" ] || { echo "Error: --source-dir is required." >&2; usage; exit 2; }
+[ -d "$SOURCE_DIR" ] || { echo "Error: SourceDir is not a folder: $SOURCE_DIR" >&2; exit 1; }
+
+SRC="$(cd "$SOURCE_DIR" && pwd -P)"
+[ -n "$OUT_FILE" ] || OUT_FILE="$(pwd)/$FOUNDATION.pack.txt"
+
+# -------------------------------------------------------------- exclusions ---
+# Entire subtree excluded if any path segment matches one of these.
+EXCLUDE_DIRS=(bin obj .vs .git .idea .vscode TestResults node_modules packages App_Data artifacts .next logs)
+
+# Files excluded by leaf-name glob — build noise, local dbs, secret-bearing files,
+# macOS metadata, and template meta-files that must never appear in unpacked output.
+EXCLUDE_FILES=(
+  '*.user' '*.suo' '*.DotSettings.user' '*.db' '*.db-shm' '*.db-wal' '*.sqlite' '*.log'
+  '.env' '*.env.*' '.env.*' '*.pfx' '*.pem' '*.key' '*.snk' 'id_rsa' 'id_rsa.pub' 'secrets.json'
+  '.DS_Store'
+  '*.my-ref.*'
+  '*TemplateConfig.config'
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless --allow-secrets.
+SECRET_NAMES=('NuGet ClearTextPassword' 'Private key block' 'AWS access key id' 'Azure DevOps PAT-ish')
+SECRET_RX=(
+  'ClearTextPassword'
+  'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY'
+  'AKIA[0-9A-Z]{16}'
+  '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]'
+)
+
+is_excluded() {
+  local rel="$1" seg leaf g
+  local -a segs
+  IFS='/' read -ra segs <<< "$rel"
+  for seg in "${segs[@]}"; do
+    for g in "${EXCLUDE_DIRS[@]}"; do
+      [ "$seg" = "$g" ] && return 0
+    done
+  done
+  leaf="${rel##*/}"
+  for g in "${EXCLUDE_FILES[@]}"; do
+    # shellcheck disable=SC2254
+    case "$leaf" in $g) return 0 ;; esac
+  done
+  return 1
+}
+
+is_binary() {
+  local f="$1" n1 n2
+  n1="$(head -c 8000 "$f" | wc -c | tr -d '[:space:]')"
+  n2="$(head -c 8000 "$f" | LC_ALL=C tr -d '\000' | wc -c | tr -d '[:space:]')"
+  [ "$n1" != "$n2" ]
+}
+
+# ----------------------------------------------------------- collect + sort ---
+picked=()
+while IFS= read -r full; do
+  rel="${full#"$SRC"/}"
+  is_excluded "$rel" && continue
+  picked+=("$rel")
+done < <(find "$SRC" -type f | LC_ALL=C sort)
+
+[ "${#picked[@]}" -gt 0 ] || { echo "Error: No files to pack under: $SRC" >&2; exit 1; }
+
+# ----------------------------------------------------------- secret scan -----
+findings=()
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  for i in "${!SECRET_RX[@]}"; do
+    if LC_ALL=C grep -aEq -- "${SECRET_RX[$i]}" "$f" 2>/dev/null; then
+      findings+=("  $rel  ->  ${SECRET_NAMES[$i]}")
+    fi
+  done
+done
+if [ "${#findings[@]}" -gt 0 ]; then
+  if [ "$ALLOW_SECRETS" -eq 1 ]; then
+    echo "WARNING: Potential secret(s) detected — packing anyway (--allow-secrets):" >&2
+    printf '%s\n' "${findings[@]}" >&2
+  else
+    echo "Error: Potential secret(s) detected — refusing to pack (rotate + remove them, or pass --allow-secrets):" >&2
+    printf '%s\n' "${findings[@]}" >&2
+    exit 1
+  fi
+fi
+
+# ----------------------------------------------------------- sentinel check --
+hits=0
+for rel in "${picked[@]}"; do
+  if LC_ALL=C grep -aFq -- "$SENTINEL" "$SRC/$rel" 2>/dev/null; then
+    hits=$((hits + 1))
+  fi
+done
+if [ "$hits" -eq 0 ]; then
+  echo "WARNING: Sentinel '$SENTINEL' not found in any file. Did you build the sample under that exact name?" >&2
+else
+  echo "Sentinel '$SENTINEL' found in $hits file(s)."
+fi
+
+# ----------------------------------------------------------- write the pack --
+outdir="$(dirname "$OUT_FILE")"
+[ -d "$outdir" ] || mkdir -p "$outdir"
+
+{
+  printf '%s\n' '# AW-SPEC REFERENCE PACK'
+  printf '# foundation: %s\n' "$FOUNDATION"
+  printf '# sentinel: %s\n'   "$SENTINEL"
+  printf '# generated: %s\n'  "$(date -u +%Y-%m-%dT%H:%M:%S.0000000Z)"
+  printf '# files: %s\n'      "${#picked[@]}"
+  printf '%s\n' '# format: aw-spec-pack/v1'
+  printf '%s\n' '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+  printf '%s\n' '#   <Sentinel>           -> <AppName>            (dotted:       namespaces, csproj/sln, refs)'
+  printf '%s\n' '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  Aspire project class names)'
+  printf '%s\n' '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: UserSecretsId, db/containers)'
+  printf '%s\n' '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+  printf '%s\n' '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+  printf '%s\n' '# ============================================================'
+  printf '\n'
+} > "$OUT_FILE"
+
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  if is_binary "$f"; then
+    {
+      printf '<<<FILE path="%s" encoding="base64">>>\n' "$rel"
+      base64 < "$f" | tr -d '\n'
+      printf '\n'
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  else
+    {
+      printf '<<<FILE path="%s">>>\n' "$rel"
+      awk '{ sub(/\r$/, ""); print }' "$f"
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  fi
+done
+
+echo "Packed ${#picked[@]} file(s) -> $OUT_FILE"

package/assets/docs/VerticalSlice/unpack-reference-foundation.ps1

@@ -0,0 +1,129 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Unpack an AW-Spec reference pack file into a target project, renaming the
+    sentinel app name to the caller's app name.
+
+.DESCRIPTION
+    Reads -PackFile (produced by pack-reference-foundation.ps1), takes the sentinel from
+    its header (override with -Sentinel), derives four case forms of the target app name,
+    and writes every file block to -OutDir with the sentinel rewritten in both file
+    CONTENTS and file/dir PATHS. Text blocks are rewritten and written as UTF-8;
+    base64 blocks are decoded as-is. Refuses to overwrite existing files unless -Force.
+
+.EXAMPLE
+    ./unpack-reference-foundation.ps1 `
+        -PackFile ./VerticalSlice.Reference.pack.txt `
+        -TargetAppName AppWeaver.Pharma `
+        -OutDir ../../
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $PackFile,
+    [Parameter(Mandatory)] [string] $TargetAppName,
+    [string] $OutDir = '.',
+    [string] $Sentinel,
+    [switch] $Force,
+    [switch] $DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+
+$pack  = (Resolve-Path -LiteralPath $PackFile).Path
+$lines = ([System.IO.File]::ReadAllText($pack)) -split "`r?`n"
+
+# --- sentinel from header unless overridden ---
+if (-not $Sentinel) {
+    foreach ($l in $lines) {
+        if ($l -match '^#\s*sentinel:\s*(.+?)\s*$') { $Sentinel = $Matches[1]; break }
+    }
+}
+if (-not $Sentinel) { throw "Sentinel not found in pack header; supply it with -Sentinel." }
+
+# --- derive case forms ---
+function Conv-Underscore  ([string] $s) { $s -replace '\.','_' }
+function Conv-LowerHyphen ([string] $s) { ($s.ToLowerInvariant()) -replace '\.','-' }
+function Conv-LowerDot    ([string] $s) { $s.ToLowerInvariant() }
+
+# NOTE: do NOT use a hashtable here — PowerShell hashtable keys are case-INSENSITIVE,
+# which would collapse the dotted ("AppWeaver.VerticalSlice") and lower-dot
+# ("appweaver.verticalslice") forms into one entry and drop the namespace rename.
+$forms = @(
+    @{ From = $Sentinel;                     To = $TargetAppName }
+    @{ From = (Conv-Underscore  $Sentinel);  To = (Conv-Underscore  $TargetAppName) }
+    @{ From = (Conv-LowerHyphen $Sentinel);  To = (Conv-LowerHyphen $TargetAppName) }
+    @{ From = (Conv-LowerDot    $Sentinel);  To = (Conv-LowerDot    $TargetAppName) }
+)
+$replacements = @()
+$seen = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::Ordinal)
+foreach ($pair in $forms) {
+    $from = [string]$pair.From
+    $to   = [string]$pair.To
+    if ([string]::IsNullOrEmpty($from)) { continue }
+    if ($from -ceq $to) { continue }
+    if (-not $seen.Add($from)) { continue }
+    $replacements += [pscustomobject]@{ From = $from; To = $to }
+}
+# longest token first so overlaps resolve correctly
+$replacements = @($replacements | Sort-Object { $_.From.Length } -Descending)
+
+function Apply-Repl([string] $text) {
+    foreach ($r in $replacements) { $text = $text.Replace($r.From, $r.To) }
+    return $text
+}
+
+# --- output root ---
+if (-not (Test-Path -LiteralPath $OutDir)) { New-Item -ItemType Directory -Force -Path $OutDir | Out-Null }
+$outRoot = (Resolve-Path -LiteralPath $OutDir).Path
+$sep     = [System.IO.Path]::DirectorySeparatorChar
+
+# --- parse file blocks ---
+$files = @()
+$i = 0
+while ($i -lt $lines.Count) {
+    if ($lines[$i] -match '^<<<FILE path="(.+?)"(?:\s+encoding="(\w+)")?>>>\s*$') {
+        $rel = $Matches[1]; $enc = $Matches[2]
+        $i++
+        $buf = New-Object System.Collections.Generic.List[string]
+        while ($i -lt $lines.Count -and $lines[$i] -ne '<<<ENDFILE>>>') {
+            $buf.Add($lines[$i]); $i++
+        }
+        $files += [pscustomobject]@{ Rel = $rel; Enc = $enc; Content = ($buf -join "`n") }
+    }
+    $i++
+}
+if ($files.Count -eq 0) { throw "No <<<FILE>>> blocks found in pack: $pack" }
+
+function Resolve-Dest([string] $rel) {
+    $renamed = (Apply-Repl $rel).Replace('/', $sep)
+    return (Join-Path $outRoot $renamed)
+}
+
+# --- conflict guard ---
+$conflicts = foreach ($f in $files) { $d = Resolve-Dest $f.Rel; if (Test-Path -LiteralPath $d) { $d } }
+if ($conflicts -and -not $Force) {
+    throw ("Refusing to overwrite existing files (re-run with -Force):`n  " + ($conflicts -join "`n  "))
+}
+
+# --- write ---
+$written = 0
+foreach ($f in $files) {
+    $dest    = Resolve-Dest $f.Rel
+    $destDir = Split-Path -Parent $dest
+    if ($DryRun) { Write-Host "WOULD WRITE  $($f.Rel)  ->  $dest"; continue }
+    if ($destDir -and -not (Test-Path -LiteralPath $destDir)) {
+        New-Item -ItemType Directory -Force -Path $destDir | Out-Null
+    }
+    if ($f.Enc -eq 'base64') {
+        [System.IO.File]::WriteAllBytes($dest, [Convert]::FromBase64String(($f.Content -replace '\s','')))
+    } else {
+        [System.IO.File]::WriteAllText($dest, (Apply-Repl $f.Content), [System.Text.UTF8Encoding]::new($false))
+    }
+    $written++
+}
+
+if ($DryRun) {
+    Write-Host "DryRun: $($files.Count) file(s) would be written to $outRoot (sentinel '$Sentinel' -> '$TargetAppName')."
+} else {
+    Write-Host "Unpacked $written file(s) to $outRoot (sentinel '$Sentinel' -> '$TargetAppName')."
+}