aw-spec-cli 0.1.4 → 0.1.6

package/assets/docs/UI.Visualization/pack-foundation.ps1

@@ -1,165 +0,0 @@
-#requires -Version 5.1
-<#
-.SYNOPSIS
-    Pack the UI.Visualization foundation template into a single AW-Spec text pack file.
-
-.DESCRIPTION
-    Walks -SourceDir (templates/AppWeaver.UI.Visualization/), excludes build/IDE artifacts,
-    JS/Next.js output folders, and secret-bearing files, and writes every remaining file into
-    one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
-    (UTF-8, LF); binary files are base64-encoded. The resulting pack file is consumed by
-    /aw-spec-foundation (see PACKAGING.md).
-
-    This is the UI counterpart of pack-foundation.ps1 in docs/VerticalSlice/.
-
-.EXAMPLE
-    # From platform/AppWeaver.Spec/docs/UI.Visualization/
-    ./pack-foundation.ps1 `
-        -SourceDir ../../../../templates/AppWeaver.UI.Visualization `
-        -OutFile   ./UI.Visualization.pack.txt
-
-.EXAMPLE
-    # Override sentinel and foundation name
-    ./pack-foundation.ps1 `
-        -SourceDir ../../../../templates/AppWeaver.UI.Visualization `
-        -OutFile   ./UI.Visualization.pack.txt `
-        -Sentinel  UI.Visualization `
-        -Foundation UI.Visualization
-#>
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory)] [string] $SourceDir,
-    [string] $OutFile,
-    [string] $Sentinel   = 'UI.Visualization',
-    [string] $Foundation = 'UI.Visualization',
-    [switch] $AllowSecrets
-)
-
-$ErrorActionPreference = 'Stop'
-
-$src = (Resolve-Path -LiteralPath $SourceDir).Path
-if (-not (Test-Path -LiteralPath $src -PathType Container)) {
-    throw "SourceDir is not a folder: $SourceDir"
-}
-if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
-
-# Entire subtree excluded if any path segment matches one of these.
-# UI additions: .next, .turbo, dist, out, coverage, .cache
-$excludeDirs  = @(
-    'bin','obj','.vs','.git','.idea','.vscode','TestResults',
-    'node_modules','packages','App_Data','artifacts',
-    '.next','.turbo','dist','out','coverage','.cache','logs'
-)
-
-# Files excluded by name glob (build noise, generated files, and secret-bearing files).
-# NOTE: the root '.env' is intentionally NOT excluded — it carries required sample config.
-# Per-environment overrides ('.env.local', '.env.production', ...) stay excluded via the glob.
-$excludeFiles = @(
-    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
-    '.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
-    '.DS_Store',        # macOS metadata
-    '*.tsbuildinfo',    # TypeScript incremental build cache
-    'next-env.d.ts'     # Next.js auto-generated — regenerated on first npm run dev
-)
-
-# Content patterns that indicate a real secret; packing aborts on a hit unless -AllowSecrets.
-$secretPatterns = @(
-    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
-    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
-    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
-    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
-)
-
-function Test-Excluded([string] $relPath) {
-    foreach ($seg in ($relPath -split '[\\/]')) {
-        if ($excludeDirs -contains $seg) { return $true }
-    }
-    $leaf = Split-Path $relPath -Leaf
-    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
-    return $false
-}
-
-function Test-Binary([byte[]] $bytes) {
-    $n = [Math]::Min(8000, $bytes.Length)
-    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
-    return $false
-}
-
-# Collect + filter
-$picked = New-Object System.Collections.Generic.List[object]
-foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
-    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
-    if (Test-Excluded $rel) { continue }
-    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
-}
-$picked = @($picked | Sort-Object Rel)
-if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
-
-# Secret scan — fail closed so credentials never get baked into the committed bundle.
-$findings = New-Object System.Collections.Generic.List[string]
-foreach ($p in $picked) {
-    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
-    foreach ($pat in $secretPatterns) {
-        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
-    }
-}
-if ($findings.Count -gt 0) {
-    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
-    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
-}
-
-# Sentinel sanity check
-$hits = 0
-foreach ($p in $picked) {
-    try {
-        $t = [System.IO.File]::ReadAllText($p.Full)
-        if ($t.Contains($Sentinel)) { $hits++ }
-    } catch { }
-}
-if ($hits -eq 0) {
-    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you author the template under that exact name?"
-} else {
-    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
-}
-
-# Build the pack (explicit LF newlines throughout)
-$sb = [System.Text.StringBuilder]::new()
-function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
-
-AddLine '# AW-SPEC FOUNDATION PACK'
-AddLine "# foundation: $Foundation"
-AddLine "# sentinel: $Sentinel"
-AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
-AddLine "# files: $($picked.Count)"
-AddLine '# format: aw-spec-pack/v1'
-AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
-AddLine '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
-AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
-AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
-AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
-AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
-AddLine '# ============================================================'
-AddLine ''
-
-foreach ($p in $picked) {
-    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
-    if (Test-Binary $bytes) {
-        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
-        AddLine ([Convert]::ToBase64String($bytes))
-        AddLine '<<<ENDFILE>>>'
-    } else {
-        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
-        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
-        [void]$sb.Append($text)
-        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
-        AddLine '<<<ENDFILE>>>'
-    }
-}
-
-$outDir = Split-Path -Parent $OutFile
-if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
-    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
-}
-[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
-
-Write-Host "Packed $($picked.Count) file(s) -> $OutFile"

package/assets/docs/UI.Visualization/pack-foundation.sh

@@ -1,206 +0,0 @@
-#!/usr/bin/env bash
-#
-# pack-foundation.sh — bash/macOS port of pack-foundation.ps1
-#
-# SYNOPSIS
-#   Pack the UI.Visualization foundation template into a single AW-Spec text pack file.
-#
-# DESCRIPTION
-#   Walks --source-dir (templates/AppWeaver.UI.Visualization/), excludes build/IDE artifacts,
-#   JS/Next.js output folders, and secret-bearing files, and writes every remaining file into
-#   one pack file using <<<FILE>>> / <<<ENDFILE>>> markers. Text files are stored verbatim
-#   (UTF-8, LF); binary files are base64-encoded. Format-compatible with unpack-foundation.ps1.
-#
-# EXAMPLE
-#   # From platform/AppWeaver.Spec/docs/UI.Visualization/
-#   ./pack-foundation.sh \
-#       --source-dir ../../../../templates/AppWeaver.UI.Visualization \
-#       --out-file   ./UI.Visualization.pack.txt
-#
-set -euo pipefail
-
-# ------------------------------------------------------------------ defaults ---
-SENTINEL='AppWeaver.UI.Visualization'
-FOUNDATION='AppWeaver.UI.Visualization'
-SOURCE_DIR=''
-OUT_FILE=''
-ALLOW_SECRETS=0
-
-usage() {
-  cat >&2 <<'EOF'
-Usage: pack-foundation.sh --source-dir <dir> [--out-file <file>] [--sentinel <name>]
-                          [--foundation <name>] [--allow-secrets]
-
-  -s, --source-dir <dir>   templates/AppWeaver.UI.Visualization folder  (required)
-  -o, --out-file <file>    Output pack file  (default: ./<foundation>.pack.txt)
-      --sentinel <name>    Sentinel app name  (default: UI.Visualization)
-      --foundation <name>  Foundation name    (default: UI.Visualization)
-      --allow-secrets      Pack even if credential markers are detected
-  -h, --help               Show this help
-
-Positional fallback: pack-foundation.sh <source-dir> [out-file]
-EOF
-}
-
-# -------------------------------------------------------------- arg parsing ---
-while [ $# -gt 0 ]; do
-  case "$1" in
-    -s|--source-dir)  SOURCE_DIR="${2:?--source-dir needs a value}"; shift 2 ;;
-    -o|--out-file)    OUT_FILE="${2:?--out-file needs a value}";     shift 2 ;;
-    --sentinel)       SENTINEL="${2:?--sentinel needs a value}";     shift 2 ;;
-    --foundation)     FOUNDATION="${2:?--foundation needs a value}"; shift 2 ;;
-    --allow-secrets)  ALLOW_SECRETS=1; shift ;;
-    -h|--help)        usage; exit 0 ;;
-    --)               shift; break ;;
-    -*)               echo "Error: unknown option: $1" >&2; usage; exit 2 ;;
-    *)
-      if   [ -z "$SOURCE_DIR" ]; then SOURCE_DIR="$1"
-      elif [ -z "$OUT_FILE"   ]; then OUT_FILE="$1"
-      else echo "Error: unexpected argument: $1" >&2; usage; exit 2
-      fi
-      shift ;;
-  esac
-done
-
-[ -n "$SOURCE_DIR" ] || { echo "Error: --source-dir is required." >&2; usage; exit 2; }
-[ -d "$SOURCE_DIR" ] || { echo "Error: SourceDir is not a folder: $SOURCE_DIR" >&2; exit 1; }
-
-SRC="$(cd "$SOURCE_DIR" && pwd -P)"
-[ -n "$OUT_FILE" ] || OUT_FILE="$(pwd)/$FOUNDATION.pack.txt"
-
-# -------------------------------------------------------------- exclusions ---
-# Entire subtree excluded if any path segment matches one of these.
-# UI additions over VerticalSlice: .turbo, dist, out, coverage, .cache
-EXCLUDE_DIRS=(
-  bin obj .vs .git .idea .vscode TestResults
-  node_modules packages App_Data artifacts
-  .next .turbo dist out coverage .cache logs
-)
-
-# Files excluded by leaf-name glob.
-# NOTE: the root '.env' is intentionally NOT excluded — it carries required sample config.
-EXCLUDE_FILES=(
-  '*.user' '*.suo' '*.DotSettings.user' '*.db' '*.db-shm' '*.db-wal' '*.sqlite' '*.log'
-  '.env.*' '*.pfx' '*.pem' '*.key' '*.snk' 'id_rsa' 'id_rsa.pub' 'secrets.json'
-  '.DS_Store'       # macOS metadata
-  '*.tsbuildinfo'   # TypeScript incremental build cache
-  'next-env.d.ts'   # Next.js auto-generated — regenerated on first npm run dev
-)
-
-# Content patterns that indicate a real secret; packing aborts on a hit unless --allow-secrets.
-SECRET_NAMES=('NuGet ClearTextPassword' 'Private key block' 'AWS access key id' 'Azure DevOps PAT-ish')
-SECRET_RX=(
-  'ClearTextPassword'
-  'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY'
-  'AKIA[0-9A-Z]{16}'
-  '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]'
-)
-
-is_excluded() {  # $1 = repo-relative path with '/' separators
-  local rel="$1" seg leaf g
-  local -a segs
-  IFS='/' read -ra segs <<< "$rel"
-  for seg in "${segs[@]}"; do
-    for g in "${EXCLUDE_DIRS[@]}"; do
-      [ "$seg" = "$g" ] && return 0
-    done
-  done
-  leaf="${rel##*/}"
-  for g in "${EXCLUDE_FILES[@]}"; do
-    # shellcheck disable=SC2254
-    case "$leaf" in $g) return 0 ;; esac
-  done
-  return 1
-}
-
-is_binary() {
-  local f="$1" n1 n2
-  n1="$(head -c 8000 "$f" | wc -c | tr -d '[:space:]')"
-  n2="$(head -c 8000 "$f" | LC_ALL=C tr -d '\000' | wc -c | tr -d '[:space:]')"
-  [ "$n1" != "$n2" ]
-}
-
-# ----------------------------------------------------------- collect + sort ---
-picked=()
-while IFS= read -r full; do
-  rel="${full#"$SRC"/}"
-  is_excluded "$rel" && continue
-  picked+=("$rel")
-done < <(find "$SRC" -type f | LC_ALL=C sort)
-
-[ "${#picked[@]}" -gt 0 ] || { echo "Error: No files to pack under: $SRC" >&2; exit 1; }
-
-# ----------------------------------------------------------- secret scan -----
-findings=()
-for rel in "${picked[@]}"; do
-  f="$SRC/$rel"
-  for i in "${!SECRET_RX[@]}"; do
-    if LC_ALL=C grep -aEq -- "${SECRET_RX[$i]}" "$f" 2>/dev/null; then
-      findings+=("  $rel  ->  ${SECRET_NAMES[$i]}")
-    fi
-  done
-done
-if [ "${#findings[@]}" -gt 0 ]; then
-  if [ "$ALLOW_SECRETS" -eq 1 ]; then
-    echo "WARNING: Potential secret(s) detected — packing anyway (--allow-secrets):" >&2
-    printf '%s\n' "${findings[@]}" >&2
-  else
-    echo "Error: Potential secret(s) detected — refusing to pack:" >&2
-    printf '%s\n' "${findings[@]}" >&2
-    exit 1
-  fi
-fi
-
-# ----------------------------------------------------------- sentinel check --
-hits=0
-for rel in "${picked[@]}"; do
-  if LC_ALL=C grep -aFq -- "$SENTINEL" "$SRC/$rel" 2>/dev/null; then
-    hits=$((hits + 1))
-  fi
-done
-if [ "$hits" -eq 0 ]; then
-  echo "WARNING: Sentinel '$SENTINEL' not found in any file. Did you author the template under that exact name?" >&2
-else
-  echo "Sentinel '$SENTINEL' found in $hits file(s)."
-fi
-
-# ----------------------------------------------------------- write the pack --
-outdir="$(dirname "$OUT_FILE")"
-[ -d "$outdir" ] || mkdir -p "$outdir"
-
-{
-  printf '%s\n' '# AW-SPEC FOUNDATION PACK'
-  printf '# foundation: %s\n' "$FOUNDATION"
-  printf '# sentinel: %s\n'   "$SENTINEL"
-  printf '# generated: %s\n'  "$(date -u +%Y-%m-%dT%H:%M:%S.0000000Z)"
-  printf '# files: %s\n'      "${#picked[@]}"
-  printf '%s\n' '# format: aw-spec-pack/v1'
-  printf '%s\n' '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
-  printf '%s\n' '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
-  printf '%s\n' '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
-  printf '%s\n' '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
-  printf '%s\n' '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
-  printf '%s\n' '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
-  printf '%s\n' '# ============================================================'
-  printf '\n'
-} > "$OUT_FILE"
-
-for rel in "${picked[@]}"; do
-  f="$SRC/$rel"
-  if is_binary "$f"; then
-    {
-      printf '<<<FILE path="%s" encoding="base64">>>\n' "$rel"
-      base64 < "$f" | tr -d '\n'
-      printf '\n'
-      printf '%s\n' '<<<ENDFILE>>>'
-    } >> "$OUT_FILE"
-  else
-    {
-      printf '<<<FILE path="%s">>>\n' "$rel"
-      awk '{ sub(/\r$/, ""); print }' "$f"
-      printf '%s\n' '<<<ENDFILE>>>'
-    } >> "$OUT_FILE"
-  fi
-done
-
-echo "Packed ${#picked[@]} file(s) -> $OUT_FILE"

package/assets/docs/UI.Visualization/pack-reference-foundation.ps1

@@ -1,159 +0,0 @@
-#requires -Version 5.1
-<#
-.SYNOPSIS
-    Pack a verified UI feature reference template into a single AW-Spec text pack file.
-
-.DESCRIPTION
-    Walks -SourceDir (a templates/features/<Name>.SimpleSample folder for UI features),
-    excludes build/IDE artifacts, JS output, template meta-files, and secret-bearing files,
-    and writes every remaining file into one pack file using <<<FILE>>> / <<<ENDFILE>>>
-    markers. Text files are stored verbatim (UTF-8, LF); binary files are base64-encoded.
-    The resulting pack file is consumed by /aw-spec-addcomponent or /aw-spec-implement
-    unpack workflows.
-
-    This is the UI counterpart of pack-reference-foundation.ps1 in docs/VerticalSlice/.
-
-.EXAMPLE
-    ./pack-reference-foundation.ps1 `
-        -SourceDir ../../../../templates/features/UIVisualization.SimpleSample `
-        -OutFile   ./UI.Visualization.Reference.pack.txt `
-        -Sentinel  UI.Visualization `
-        -Foundation UI.Visualization.Reference
-#>
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory)] [string] $SourceDir,
-    [string] $OutFile,
-    [string] $Sentinel   = 'UI.Visualization',
-    [string] $Foundation = 'UI.Visualization.Reference',
-    [switch] $AllowSecrets
-)
-
-$ErrorActionPreference = 'Stop'
-
-$src = (Resolve-Path -LiteralPath $SourceDir).Path
-if (-not (Test-Path -LiteralPath $src -PathType Container)) {
-    throw "SourceDir is not a folder: $SourceDir"
-}
-if (-not $OutFile) { $OutFile = Join-Path (Get-Location).Path "$Foundation.pack.txt" }
-
-# Entire subtree excluded if any path segment matches one of these.
-$excludeDirs  = @(
-    'bin','obj','.vs','.git','.idea','.vscode','TestResults',
-    'node_modules','packages','App_Data','artifacts',
-    '.next','.turbo','dist','out','coverage','.cache','logs'
-)
-
-# Files excluded by leaf-name glob — build noise, local dbs, secret-bearing files,
-# macOS metadata, and template meta-files that must never appear in unpacked output.
-$excludeFiles = @(
-    '*.user','*.suo','*.DotSettings.user','*.db','*.db-shm','*.db-wal','*.sqlite','*.log',
-    '.env','*.env.*','.env.*','*.pfx','*.pem','*.key','*.snk','id_rsa','id_rsa.pub','secrets.json',
-    '.DS_Store',
-    '*.my-ref.*',           # template annotation files
-    '*TemplateConfig.config',
-    '*.tsbuildinfo',
-    'next-env.d.ts'
-)
-
-# Content patterns that indicate a real secret.
-$secretPatterns = @(
-    @{ Name = 'NuGet ClearTextPassword'; Rx = 'ClearTextPassword' }
-    @{ Name = 'Private key block';       Rx = 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' }
-    @{ Name = 'AWS access key id';       Rx = 'AKIA[0-9A-Z]{16}' }
-    @{ Name = 'Azure DevOps PAT-ish';    Rx = '[A-Za-z0-9]{52}AZDO[A-Za-z0-9]' }
-)
-
-function Test-Excluded([string] $relPath) {
-    foreach ($seg in ($relPath -split '[\\/]')) {
-        if ($excludeDirs -contains $seg) { return $true }
-    }
-    $leaf = Split-Path $relPath -Leaf
-    foreach ($g in $excludeFiles) { if ($leaf -like $g) { return $true } }
-    return $false
-}
-
-function Test-Binary([byte[]] $bytes) {
-    $n = [Math]::Min(8000, $bytes.Length)
-    for ($i = 0; $i -lt $n; $i++) { if ($bytes[$i] -eq 0) { return $true } }
-    return $false
-}
-
-# Collect + filter
-$picked = New-Object System.Collections.Generic.List[object]
-foreach ($f in (Get-ChildItem -LiteralPath $src -Recurse -File -Force)) {
-    $rel = ($f.FullName.Substring($src.Length).TrimStart('\','/')) -replace '\\','/'
-    if (Test-Excluded $rel) { continue }
-    $picked.Add([pscustomobject]@{ Rel = $rel; Full = $f.FullName })
-}
-$picked = @($picked | Sort-Object Rel)
-if ($picked.Count -eq 0) { throw "No files to pack under: $src" }
-
-# Secret scan
-$findings = New-Object System.Collections.Generic.List[string]
-foreach ($p in $picked) {
-    try { $t = [System.IO.File]::ReadAllText($p.Full) } catch { continue }
-    foreach ($pat in $secretPatterns) {
-        if ($t -match $pat.Rx) { $findings.Add("  $($p.Rel)  ->  $($pat.Name)") }
-    }
-}
-if ($findings.Count -gt 0) {
-    $msg = "Potential secret(s) detected — refusing to pack (rotate + remove them, or pass -AllowSecrets):`n" + ($findings -join "`n")
-    if ($AllowSecrets) { Write-Warning $msg } else { throw $msg }
-}
-
-# Sentinel sanity check
-$hits = 0
-foreach ($p in $picked) {
-    try {
-        $t = [System.IO.File]::ReadAllText($p.Full)
-        if ($t.Contains($Sentinel)) { $hits++ }
-    } catch { }
-}
-if ($hits -eq 0) {
-    Write-Warning "Sentinel '$Sentinel' not found in any file. Did you author the sample under that exact name?"
-} else {
-    Write-Host "Sentinel '$Sentinel' found in $hits file(s)."
-}
-
-# Build the pack
-$sb = [System.Text.StringBuilder]::new()
-function AddLine([string] $s) { [void]$sb.Append($s); [void]$sb.Append("`n") }
-
-AddLine '# AW-SPEC REFERENCE PACK'
-AddLine "# foundation: $Foundation"
-AddLine "# sentinel: $Sentinel"
-AddLine "# generated: $([DateTime]::UtcNow.ToString('o'))"
-AddLine "# files: $($picked.Count)"
-AddLine '# format: aw-spec-pack/v1'
-AddLine '# --- replacement contract (ordinal, case-sensitive, longest-first) ---'
-AddLine '#   <Sentinel>           -> <AppName>            (dotted:       package.json name as dotted)'
-AddLine '#   <Sentinel _-form>    -> <AppName _-form>     (underscored:  identifiers)'
-AddLine '#   <sentinel --form>    -> <appname --form>     (lower-hyphen: npm package name, docker image)'
-AddLine '#   <sentinel .-form>    -> <appname lower-dot>  (lower-dot:    lowercased identifiers)'
-AddLine '# Applied to file CONTENTS and file/dir PATHS. Never touch other AppWeaver.* tokens.'
-AddLine '# ============================================================'
-AddLine ''
-
-foreach ($p in $picked) {
-    $bytes = [System.IO.File]::ReadAllBytes($p.Full)
-    if (Test-Binary $bytes) {
-        AddLine "<<<FILE path=`"$($p.Rel)`" encoding=`"base64`">>>"
-        AddLine ([Convert]::ToBase64String($bytes))
-        AddLine '<<<ENDFILE>>>'
-    } else {
-        $text = ([System.IO.File]::ReadAllText($p.Full)) -replace "`r`n", "`n"
-        AddLine "<<<FILE path=`"$($p.Rel)`">>>"
-        [void]$sb.Append($text)
-        if (-not $text.EndsWith("`n")) { [void]$sb.Append("`n") }
-        AddLine '<<<ENDFILE>>>'
-    }
-}
-
-$outDir = Split-Path -Parent $OutFile
-if ($outDir -and -not (Test-Path -LiteralPath $outDir)) {
-    New-Item -ItemType Directory -Force -Path $outDir | Out-Null
-}
-[System.IO.File]::WriteAllText($OutFile, $sb.ToString(), [System.Text.UTF8Encoding]::new($false))
-
-Write-Host "Packed $($picked.Count) file(s) -> $OutFile"