aw-spec-cli 0.1.3 → 0.1.4

package/assets/docs/UI.Visualization/pack-foundation.ps1

@@ -0,0 +1,165 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Pack the UI.Visualization foundation template into a single AW-Spec text pack file.
+
+.DESCRIPTION
+    Walks -SourceDir (templates/AppWeaver.UI.Visualization/), excludes build/IDE artifacts,
+    JS/Next.js output folders, and secret-bearing files, and writes every remaining file into
+    one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
+    (UTF-8, LF); binary files are base64-encoded. The resulting pack file is consumed by
+    /aw-spec-foundation (see PACKAGING.md).
+
+    This is the UI counterpart of pack-foundation.ps1 in docs/VerticalSlice/.
+
+.EXAMPLE
+    # From platform/AppWeaver.Spec/docs/UI.Visualization/
+    ./pack-foundation.ps1 `
+        -SourceDir ../../../../templates/AppWeaver.UI.Visualization `
+        -OutFile   ./UI.Visualization.pack.txt
+
+.EXAMPLE
+    # Override sentinel and foundation name
+    ./pack-foundation.ps1 `
+        -SourceDir ../../../../templates/AppWeaver.UI.Visualization `
+        -OutFile   ./UI.Visualization.pack.txt `
+        -Sentinel  UI.Visualization `
+        -Foundation UI.Visualization
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $SourceDir,
+    [string] $OutFile,
+    [string] $Sentinel   = 'UI.Visualization',
+    [string] $Foundation = 'UI.Visualization',
+    [switch] $AllowSecrets
+)
+
+$ErrorActionPreference = 'Stop'
+
+$src = (Resolve-Path -LiteralPath $SourceDir).Path
+if (-not (Test-Path -LiteralPath $src -PathType Container)) {
+    throw "SourceDir is not a folder: $SourceDir"
+}
+if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
+
+# Entire subtree excluded if any path segment matches one of these.
+# UI additions: .next, .turbo, dist, out, coverage, .cache
+$excludeDirs  = @(
+    'bin','obj','.vs','.git','.idea','.vscode','TestResults',
+    'node_modules','packages','App_Data','artifacts',
+    '.next','.turbo','dist','out','coverage','.cache','logs'
+)
+
+# Files excluded by name glob (build noise, generated files, and secret-bearing files).
+# NOTE: the root '.env' is intentionally NOT excluded — it carries required sample config.
+# Per-environment overrides ('.env.local', '.env.production', ...) stay excluded via the glob.
+$excludeFiles = @(
+    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
+    '.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
+    '.DS_Store',        # macOS metadata
+    '*.tsbuildinfo',    # TypeScript incremental build cache
+    'next-env.d.ts'     # Next.js auto-generated — regenerated on first npm run dev
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless -AllowSecrets.
+$secretPatterns = @(
+    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
+    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
+    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
+    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
+)
+
+function Test-Excluded([string] $relPath) {
+    foreach ($seg in ($relPath -split '[\\/]')) {
+        if ($excludeDirs -contains $seg) { return $true }
+    }
+    $leaf = Split-Path $relPath -Leaf
+    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
+    return $false
+}
+
+function Test-Binary([byte[]] $bytes) {
+    $n = [Math]::Min(8000, $bytes.Length)
+    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
+    return $false
+}
+
+# Collect + filter
+$picked = New-Object System.Collections.Generic.List[object]
+foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
+    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
+    if (Test-Excluded $rel) { continue }
+    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
+}
+$picked = @($picked | Sort-Object Rel)
+if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
+
+# Secret scan — fail closed so credentials never get baked into the committed bundle.
+$findings = New-Object System.Collections.Generic.List[string]
+foreach ($p in $picked) {
+    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
+    foreach ($pat in $secretPatterns) {
+        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
+    }
+}
+if ($findings.Count -gt 0) {
+    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
+    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
+}
+
+# Sentinel sanity check
+$hits = 0
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+        if ($t.Contains($Sentinel)) { $hits++ }
+    } catch { }
+}
+if ($hits -eq 0) {
+    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you author the template under that exact name?"
+} else {
+    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
+}
+
+# Build the pack (explicit LF newlines throughout)
+$sb = [System.Text.StringBuilder]::new()
+function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
+
+AddLine '# AW-SPEC FOUNDATION PACK'
+AddLine "# foundation: $Foundation"
+AddLine "# sentinel: $Sentinel"
+AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
+AddLine "# files: $($picked.Count)"
+AddLine '# format: aw-spec-pack/v1'
+AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+AddLine '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
+AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
+AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
+AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+AddLine '# ============================================================'
+AddLine ''
+
+foreach ($p in $picked) {
+    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
+    if (Test-Binary $bytes) {
+        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
+        AddLine ([Convert]::ToBase64String($bytes))
+        AddLine '<<<ENDFILE>>>'
+    } else {
+        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
+        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
+        [void]$sb.Append($text)
+        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
+        AddLine '<<<ENDFILE>>>'
+    }
+}
+
+$outDir = Split-Path -Parent $OutFile
+if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
+    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
+}
+[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
+
+Write-Host "Packed $($picked.Count) file(s) -> $OutFile"

package/assets/docs/UI.Visualization/pack-foundation.sh

@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+#
+# pack-foundation.sh — bash/macOS port of pack-foundation.ps1
+#
+# SYNOPSIS
+#   Pack the UI.Visualization foundation template into a single AW-Spec text pack file.
+#
+# DESCRIPTION
+#   Walks --source-dir (templates/AppWeaver.UI.Visualization/), excludes build/IDE artifacts,
+#   JS/Next.js output folders, and secret-bearing files, and writes every remaining file into
+#   one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
+#   (UTF-8, LF); binary files are base64-encoded. Format-compatible with unpack-foundation.ps1.
+#
+# EXAMPLE
+#   # From platform/AppWeaver.Spec/docs/UI.Visualization/
+#   ./pack-foundation.sh \
+#       --source-dir ../../../../templates/AppWeaver.UI.Visualization \
+#       --out-file   ./UI.Visualization.pack.txt
+#
+set -euo pipefail
+
+# ------------------------------------------------------------------ defaults ---
+SENTINEL='AppWeaver.UI.Visualization'
+FOUNDATION='AppWeaver.UI.Visualization'
+SOURCE_DIR=''
+OUT_FILE=''
+ALLOW_SECRETS=0
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: pack-foundation.sh --source-dir <dir> [--out-file <file>] [--sentinel <name>]
+                          [--foundation <name>] [--allow-secrets]
+
+  -s, --source-dir <dir>   templates/AppWeaver.UI.Visualization folder  (required)
+  -o, --out-file <file>    Output pack file  (default: ./<foundation>.pack.txt)
+      --sentinel <name>    Sentinel app name  (default: UI.Visualization)
+      --foundation <name>  Foundation name    (default: UI.Visualization)
+      --allow-secrets      Pack even if credential markers are detected
+  -h, --help               Show this help
+
+Positional fallback: pack-foundation.sh <source-dir> [out-file]
+EOF
+}
+
+# -------------------------------------------------------------- arg parsing ---
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -s|--source-dir)  SOURCE_DIR="${2:?--source-dir needs a value}"; shift 2 ;;
+    -o|--out-file)    OUT_FILE="${2:?--out-file needs a value}";     shift 2 ;;
+    --sentinel)       SENTINEL="${2:?--sentinel needs a value}";     shift 2 ;;
+    --foundation)     FOUNDATION="${2:?--foundation needs a value}"; shift 2 ;;
+    --allow-secrets)  ALLOW_SECRETS=1; shift ;;
+    -h|--help)        usage; exit 0 ;;
+    --)               shift; break ;;
+    -*)               echo "Error: unknown option: $1" >&2; usage; exit 2 ;;
+    *)
+      if   [ -z "$SOURCE_DIR" ]; then SOURCE_DIR="$1"
+      elif [ -z "$OUT_FILE"   ]; then OUT_FILE="$1"
+      else echo "Error: unexpected argument: $1" >&2; usage; exit 2
+      fi
+      shift ;;
+  esac
+done
+
+[ -n "$SOURCE_DIR" ] || { echo "Error: --source-dir is required." >&2; usage; exit 2; }
+[ -d "$SOURCE_DIR" ] || { echo "Error: SourceDir is not a folder: $SOURCE_DIR" >&2; exit 1; }
+
+SRC="$(cd "$SOURCE_DIR" && pwd -P)"
+[ -n "$OUT_FILE" ] || OUT_FILE="$(pwd)/$FOUNDATION.pack.txt"
+
+# -------------------------------------------------------------- exclusions ---
+# Entire subtree excluded if any path segment matches one of these.
+# UI additions over VerticalSlice: .turbo, dist, out, coverage, .cache
+EXCLUDE_DIRS=(
+  bin obj .vs .git .idea .vscode TestResults
+  node_modules packages App_Data artifacts
+  .next .turbo dist out coverage .cache logs
+)
+
+# Files excluded by leaf-name glob.
+# NOTE: the root '.env' is intentionally NOT excluded — it carries required sample config.
+EXCLUDE_FILES=(
+  '*.user' '*.suo' '*.DotSettings.user' '*.db' '*.db-shm' '*.db-wal' '*.sqlite' '*.log'
+  '.env.*' '*.pfx' '*.pem' '*.key' '*.snk' 'id_rsa' 'id_rsa.pub' 'secrets.json'
+  '.DS_Store'       # macOS metadata
+  '*.tsbuildinfo'   # TypeScript incremental build cache
+  'next-env.d.ts'   # Next.js auto-generated — regenerated on first npm run dev
+)
+
+# Content patterns that indicate a real secret; packing aborts on a hit unless --allow-secrets.
+SECRET_NAMES=('NuGet ClearTextPassword' 'Private key block' 'AWS access key id' 'Azure DevOps PAT-ish')
+SECRET_RX=(
+  'ClearTextPassword'
+  'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY'
+  'AKIA[0-9A-Z]{16}'
+  '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]'
+)
+
+is_excluded() {  # $1 = repo-relative path with '/' separators
+  local rel="$1" seg leaf g
+  local -a segs
+  IFS='/' read -ra segs <<< "$rel"
+  for seg in "${segs[@]}"; do
+    for g in "${EXCLUDE_DIRS[@]}"; do
+      [ "$seg" = "$g" ] && return 0
+    done
+  done
+  leaf="${rel##*/}"
+  for g in "${EXCLUDE_FILES[@]}"; do
+    # shellcheck disable=SC2254
+    case "$leaf" in $g) return 0 ;; esac
+  done
+  return 1
+}
+
+is_binary() {
+  local f="$1" n1 n2
+  n1="$(head -c 8000 "$f" | wc -c | tr -d '[:space:]')"
+  n2="$(head -c 8000 "$f" | LC_ALL=C tr -d '\000' | wc -c | tr -d '[:space:]')"
+  [ "$n1" != "$n2" ]
+}
+
+# ----------------------------------------------------------- collect + sort ---
+picked=()
+while IFS= read -r full; do
+  rel="${full#"$SRC"/}"
+  is_excluded "$rel" && continue
+  picked+=("$rel")
+done < <(find "$SRC" -type f | LC_ALL=C sort)
+
+[ "${#picked[@]}" -gt 0 ] || { echo "Error: No files to pack under: $SRC" >&2; exit 1; }
+
+# ----------------------------------------------------------- secret scan -----
+findings=()
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  for i in "${!SECRET_RX[@]}"; do
+    if LC_ALL=C grep -aEq -- "${SECRET_RX[$i]}" "$f" 2>/dev/null; then
+      findings+=("  $rel  ->  ${SECRET_NAMES[$i]}")
+    fi
+  done
+done
+if [ "${#findings[@]}" -gt 0 ]; then
+  if [ "$ALLOW_SECRETS" -eq 1 ]; then
+    echo "WARNING: Potential secret(s) detected — packing anyway (--allow-secrets):" >&2
+    printf '%s\n' "${findings[@]}" >&2
+  else
+    echo "Error: Potential secret(s) detected — refusing to pack:" >&2
+    printf '%s\n' "${findings[@]}" >&2
+    exit 1
+  fi
+fi
+
+# ----------------------------------------------------------- sentinel check --
+hits=0
+for rel in "${picked[@]}"; do
+  if LC_ALL=C grep -aFq -- "$SENTINEL" "$SRC/$rel" 2>/dev/null; then
+    hits=$((hits + 1))
+  fi
+done
+if [ "$hits" -eq 0 ]; then
+  echo "WARNING: Sentinel '$SENTINEL' not found in any file. Did you author the template under that exact name?" >&2
+else
+  echo "Sentinel '$SENTINEL' found in $hits file(s)."
+fi
+
+# ----------------------------------------------------------- write the pack --
+outdir="$(dirname "$OUT_FILE")"
+[ -d "$outdir" ] || mkdir -p "$outdir"
+
+{
+  printf '%s\n' '# AW-SPEC FOUNDATION PACK'
+  printf '# foundation: %s\n' "$FOUNDATION"
+  printf '# sentinel: %s\n'   "$SENTINEL"
+  printf '# generated: %s\n'  "$(date -u +%Y-%m-%dT%H:%M:%S.0000000Z)"
+  printf '# files: %s\n'      "${#picked[@]}"
+  printf '%s\n' '# format: aw-spec-pack/v1'
+  printf '%s\n' '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+  printf '%s\n' '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
+  printf '%s\n' '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
+  printf '%s\n' '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
+  printf '%s\n' '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+  printf '%s\n' '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+  printf '%s\n' '# ============================================================'
+  printf '\n'
+} > "$OUT_FILE"
+
+for rel in "${picked[@]}"; do
+  f="$SRC/$rel"
+  if is_binary "$f"; then
+    {
+      printf '<<<FILE path="%s" encoding="base64">>>\n' "$rel"
+      base64 < "$f" | tr -d '\n'
+      printf '\n'
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  else
+    {
+      printf '<<<FILE path="%s">>>\n' "$rel"
+      awk '{ sub(/\r$/, ""); print }' "$f"
+      printf '%s\n' '<<<ENDFILE>>>'
+    } >> "$OUT_FILE"
+  fi
+done
+
+echo "Packed ${#picked[@]} file(s) -> $OUT_FILE"

package/assets/docs/UI.Visualization/pack-reference-foundation.ps1

@@ -0,0 +1,159 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+    Pack a verified UI feature reference template into a single AW-Spec text pack file.
+
+.DESCRIPTION
+    Walks -SourceDir (a templates/features/<Name>.SimpleSample folder for UI features),
+    excludes build/IDE artifacts, JS output, template meta-files, and secret-bearing files,
+    and writes every remaining file into one pack file using <<<FILE>>> / <<<ENDFILE>>>
+    markers. Text files are stored verbatim (UTF-8, LF); binary files are base64-encoded.
+    The resulting pack file is consumed by /aw-spec-addcomponent or /aw-spec-implement
+    unpack workflows.
+
+    This is the UI counterpart of pack-reference-foundation.ps1 in docs/VerticalSlice/.
+
+.EXAMPLE
+    ./pack-reference-foundation.ps1 `
+        -SourceDir ../../../../templates/features/UIVisualization.SimpleSample `
+        -OutFile   ./UI.Visualization.Reference.pack.txt `
+        -Sentinel  UI.Visualization `
+        -Foundation UI.Visualization.Reference
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $SourceDir,
+    [string] $OutFile,
+    [string] $Sentinel   = 'UI.Visualization',
+    [string] $Foundation = 'UI.Visualization.Reference',
+    [switch] $AllowSecrets
+)
+
+$ErrorActionPreference = 'Stop'
+
+$src = (Resolve-Path -LiteralPath $SourceDir).Path
+if (-not (Test-Path -LiteralPath $src -PathType Container)) {
+    throw "SourceDir is not a folder: $SourceDir"
+}
+if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
+
+# Entire subtree excluded if any path segment matches one of these.
+$excludeDirs  = @(
+    'bin','obj','.vs','.git','.idea','.vscode','TestResults',
+    'node_modules','packages','App_Data','artifacts',
+    '.next','.turbo','dist','out','coverage','.cache','logs'
+)
+
+# Files excluded by leaf-name glob — build noise, local dbs, secret-bearing files,
+# macOS metadata, and template meta-files that must never appear in unpacked output.
+$excludeFiles = @(
+    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
+    '.env','*.env.*','.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
+    '.DS_Store',
+    '*.my-ref.*',           # template annotation files
+    '*TemplateConfig.config',
+    '*.tsbuildinfo',
+    'next-env.d.ts'
+)
+
+# Content patterns that indicate a real secret.
+$secretPatterns = @(
+    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
+    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
+    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
+    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
+)
+
+function Test-Excluded([string] $relPath) {
+    foreach ($seg in ($relPath -split '[\\/]')) {
+        if ($excludeDirs -contains $seg) { return $true }
+    }
+    $leaf = Split-Path $relPath -Leaf
+    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
+    return $false
+}
+
+function Test-Binary([byte[]] $bytes) {
+    $n = [Math]::Min(8000, $bytes.Length)
+    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
+    return $false
+}
+
+# Collect + filter
+$picked = New-Object System.Collections.Generic.List[object]
+foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
+    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
+    if (Test-Excluded $rel) { continue }
+    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
+}
+$picked = @($picked | Sort-Object Rel)
+if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
+
+# Secret scan
+$findings = New-Object System.Collections.Generic.List[string]
+foreach ($p in $picked) {
+    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
+    foreach ($pat in $secretPatterns) {
+        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
+    }
+}
+if ($findings.Count -gt 0) {
+    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
+    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
+}
+
+# Sentinel sanity check
+$hits = 0
+foreach ($p in $picked) {
+    try {
+        $t = [System.IO.File]::ReadAllText($p.Full)
+        if ($t.Contains($Sentinel)) { $hits++ }
+    } catch { }
+}
+if ($hits -eq 0) {
+    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you author the sample under that exact name?"
+} else {
+    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
+}
+
+# Build the pack
+$sb = [System.Text.StringBuilder]::new()
+function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
+
+AddLine '# AW-SPEC REFERENCE PACK'
+AddLine "# foundation: $Foundation"
+AddLine "# sentinel: $Sentinel"
+AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
+AddLine "# files: $($picked.Count)"
+AddLine '# format: aw-spec-pack/v1'
+AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
+AddLine '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
+AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
+AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
+AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
+AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
+AddLine '# ============================================================'
+AddLine ''
+
+foreach ($p in $picked) {
+    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
+    if (Test-Binary $bytes) {
+        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
+        AddLine ([Convert]::ToBase64String($bytes))
+        AddLine '<<<ENDFILE>>>'
+    } else {
+        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
+        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
+        [void]$sb.Append($text)
+        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
+        AddLine '<<<ENDFILE>>>'
+    }
+}
+
+$outDir = Split-Path -Parent $OutFile
+if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
+    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
+}
+[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
+
+Write-Host "Packed $($picked.Count) file(s) -> $OutFile"