memento-mori-jester 0.1.102 → 0.1.103

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Memento Mori Jester are tracked here.
 
 ## Unreleased
 
+## 0.1.103
+
+- Added `npm run pack:contents:check` to verify dry-run package contents include the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example.
+- Wired `pack:dry` and `npm test` through the package contents smoke so release dry runs also exclude repo-local promo, site, private, cache, GitHub workflow, and credential-shaped files.
+- Updated README, release docs, production-readiness docs, roadmap, and release notes for the package surface guard.
+
 ## 0.1.102
 
 - Added a checked public-safe support examples quickstart for a 60-second maintainer handoff from incoming report to lifecycle map, blank worksheet, filled synthetic example, backlog record, and backlog review.

package/README.md

@@ -555,6 +555,7 @@ Run `npm run support:check` after editing issue templates, support docs, the rep
 Run `npm run promo:card` to regenerate the repo-local social preview card after changing its copy or design.
 Run `npm run promo:check` after editing promo assets; it checks the current demo video, stills, docs, and fixture evidence numbers stay in sync.
 Run `npm run site:check` after editing the repo-local landing page; it verifies the start command, demo links, social card, repo, release, and npm links.
+Run `npm run pack:contents:check` when package contents change; it verifies the dry-run package includes the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example, while excluding repo-local promo, site, private, cache, and credential-shaped files.
 
 For vulnerabilities, private code exposure, or credential-handling concerns, follow [SECURITY.md](SECURITY.md) instead of opening a public issue with sensitive details.
 
@@ -568,6 +569,7 @@ npm.cmd run consumer:quickstart:check
 npm.cmd run reports:check
 npm.cmd run promo:check
 npm.cmd run production:check
+npm.cmd run pack:contents:check
 npm.cmd run pack:dry
 git tag -a v0.1.x -m "Memento Mori Jester v0.1.x"
 git push origin main

package/ROADMAP.md

@@ -6,6 +6,7 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Recently Shipped
 
+- Checked package contents support manifest smoke in v0.1.103, proving dry-run packages include the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example while excluding repo-local/private-ish files.
 - Checked support examples quickstart in v0.1.102, giving maintainers a 60-second handoff path from incoming report to map, worksheet, synthetic example, backlog record, and backlog review.
 - Checked support examples index in v0.1.101, telling maintainers when to use the lifecycle map, blank worksheet, and filled synthetic example.
 - Checked filled support lifecycle worksheet example in v0.1.100, showing a synthetic `docs-example` report through report, triage, response, closeout, prioritization, backlog record, and backlog review.

package/docs/PRODUCTION_READINESS.md

@@ -9,6 +9,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - GitHub Releases and npm publishing are automated from annotated `v*` tags through GitHub Actions trusted publishing.
 - CI runs tests and a package dry run on every push to `main` and pull request.
 - The local playground, GitHub Action, MCP setup snippets, preset examples, fixtures, and release notes ship in the npm package.
+- Package dry runs include a support examples manifest smoke so the index, quickstart, lifecycle map, blank worksheet, and filled synthetic example keep shipping from the tarball.
 - Repo-local promo assets stay outside the npm package, but `npm run promo:check` keeps the current demo video, stills, social card, docs, and fixture evidence numbers aligned.
 - The repo-local landing page stays outside the npm package, but `npm run site:check` keeps its start command and public links aligned.
 
@@ -16,7 +17,8 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 
 - `package.json` includes repository, homepage, bugs, binaries, exports, public package files, and public publish access.
 - `package-lock.json` version matches `package.json`.
-- `npm run pack:dry` confirms the package includes `dist`, `docs`, `examples`, `scripts`, `README.md`, `CHANGELOG.md`, `ROADMAP.md`, and `LICENSE`.
+- `npm run pack:dry` confirms the package includes `dist`, `docs`, `examples`, `scripts`, `README.md`, `CHANGELOG.md`, `ROADMAP.md`, and `LICENSE`, then runs `npm run pack:contents:check`.
+- `npm run pack:contents:check` verifies the dry-run package includes the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example, and excludes repo-local promo, site, private, cache, GitHub workflow, and credential-shaped files.
 - `SECURITY.md` ships with the package so vulnerability reporting guidance is visible from the repository and npm tarball.
 - `prepublishOnly` runs tests and a package dry run for local publish attempts.
 
@@ -70,6 +72,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - `npm run support:check` verifies issue templates, support docs, the report gallery feedback template, support examples quickstart, support examples index, support lifecycle map, support lifecycle worksheet, filled worksheet example, support lifecycle overview, outcome prioritization guide, backlog records, backlog review checklist, maintainer triage playbook, response snippets, and closeout checklist stay public-safe and ask for useful redacted context.
 - `npm run promo:card` regenerates the deterministic social preview card, and `npm run promo:check` verifies current repo-local promo assets against the current fixture evidence before maintainers post or refresh the demo.
 - `npm run site:check` verifies the static landing page before maintainers post or host it.
+- `npm run pack:contents:check` verifies the npm package surface keeps the support examples manifest files available while excluding repo-only or private-ish paths.
 - npm publish has a manual workflow fallback, but the normal release path is tag-driven trusted publishing.
 
 ## Static Guard
@@ -93,6 +96,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - support triage checks are wired into `npm test`.
 - promo freshness checks are wired into `npm test`.
 - site checks are wired into `npm test`.
+- package contents checks are wired into `npm test` and `npm run pack:dry`.
 
 `npm test` runs this check after the TypeScript build and unit tests.
 

package/docs/RELEASE.md

@@ -21,6 +21,7 @@ npm.cmd run support:check
 npm.cmd run promo:card:check
 npm.cmd run promo:check
 npm.cmd run site:check
+npm.cmd run pack:contents:check
 npm.cmd run pack:dry
 git diff --check
 ```
@@ -89,6 +90,7 @@ npx.cmd -y memento-mori-jester@latest config validate --config jester-security.c
 npm.cmd run consumer:quickstart:check -- --package memento-mori-jester@latest
 npm.cmd run reports:check -- --package memento-mori-jester@latest
 npm.cmd run support:check
+npm.cmd run pack:contents:check
 ```
 
 ## 4. MCP Copy-Paste

package/docs/RELEASE_NOTES_v0.1.103.md

@@ -0,0 +1,45 @@
+# Memento Mori Jester v0.1.103
+
+## Summary
+
+This release adds a checked package contents smoke so maintainers can prove the npm package surface still ships the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example while keeping repo-local/private-ish files out.
+
+## Changes
+
+- Added `scripts/check-package-contents.mjs`.
+- Added `npm run pack:contents:check`.
+- Updated `npm run pack:dry` so the normal dry-pack path also verifies package contents.
+- Wired the package contents check into `npm test` and `npm run production:check`.
+- Updated README, release docs, production-readiness docs, roadmap, and changelog.
+
+## Public Interface Changes
+
+- No CLI, MCP, config schema, rule, scoring, GitHub Action, or release automation changes.
+- New maintainer script:
+  - `npm run pack:contents:check`
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run promo:card:check
+npm.cmd run promo:check
+npm.cmd run support:check
+npm.cmd run production:check
+npm.cmd run pack:contents:check
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js doctor
+node .\dist\cli.js summary --kind command "git reset --hard"
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.103 package contents support manifest smoke"
+```
+
+## Post-Publish Smoke
+
+```powershell
+npm.cmd view memento-mori-jester version --silent
+npx.cmd -y memento-mori-jester@latest doctor
+npx.cmd -y memento-mori-jester@latest summary --kind command "git reset --hard"
+npm.cmd run pack:contents:check
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memento-mori-jester",
-  "version": "0.1.102",
+  "version": "0.1.103",
   "description": "A local court-jester sidecar for AI coding agents: review plans, commands, diffs, and final claims before they get too pleased with themselves.",
   "type": "module",
   "repository": {
@@ -40,7 +40,7 @@
     "build": "tsc -p tsconfig.json",
     "start": "node dist/server.js",
     "start:mcp": "node dist/server.js",
-    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run ci:adoption:check && npm run consumer:quickstart:check && npm run reports:check && npm run support:check && npm run promo:check && npm run site:check && npm run production:check",
+    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run ci:adoption:check && npm run consumer:quickstart:check && npm run reports:check && npm run support:check && npm run promo:check && npm run site:check && npm run pack:contents:check && npm run production:check",
     "doctor": "node dist/cli.js doctor",
     "demo:svg": "node scripts/render-demo-svg.mjs",
     "demo:svg:check": "node scripts/render-demo-svg.mjs --check",
@@ -57,7 +57,8 @@
     "promo:check": "node scripts/check-promo-freshness.mjs",
     "site:check": "node scripts/check-site.mjs",
     "production:check": "node scripts/check-production-readiness.mjs",
-    "pack:dry": "npm pack --dry-run",
+    "pack:contents:check": "node scripts/check-package-contents.mjs",
+    "pack:dry": "npm pack --dry-run && npm run pack:contents:check",
     "prepare": "npm run build",
     "prepublishOnly": "npm test && npm run pack:dry"
   },

package/scripts/check-package-contents.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const root = join(scriptDir, "..");
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const npmExecPath = process.env.npm_execpath;
+const failures = [];
+const packageJson = readJson("package.json");
+
+const requiredPackageFiles = [
+  "dist/cli.js",
+  "dist/core.js",
+  "docs/RELEASE.md",
+  `docs/RELEASE_NOTES_v${packageJson.version}.md`,
+  "examples/support/support-examples-index.md",
+  "examples/support/support-examples-index.json",
+  "examples/support/support-examples-quickstart.md",
+  "examples/support/support-examples-quickstart.json",
+  "examples/support/support-lifecycle-map.md",
+  "examples/support/support-lifecycle-map.json",
+  "examples/support/support-lifecycle-worksheet.md",
+  "examples/support/support-lifecycle-worksheet.json",
+  "examples/support/support-lifecycle-filled-example.md",
+  "examples/support/support-lifecycle-filled-example.json",
+  "README.md",
+  "CHANGELOG.md",
+  "ROADMAP.md",
+  "SECURITY.md",
+  "LICENSE"
+];
+
+const requiredSupportFiles = [
+  "examples/support/support-examples-index.md",
+  "examples/support/support-examples-index.json",
+  "examples/support/support-examples-quickstart.md",
+  "examples/support/support-examples-quickstart.json",
+  "examples/support/support-lifecycle-map.md",
+  "examples/support/support-lifecycle-map.json",
+  "examples/support/support-lifecycle-worksheet.md",
+  "examples/support/support-lifecycle-worksheet.json",
+  "examples/support/support-lifecycle-filled-example.md",
+  "examples/support/support-lifecycle-filled-example.json"
+];
+
+const forbiddenPackagePathRules = [
+  { name: "repo-local promo assets", pattern: /^promo\// },
+  { name: "repo-local site assets", pattern: /^site\// },
+  { name: "GitHub workflow or issue-template files", pattern: /^\.github\// },
+  { name: "git metadata", pattern: /^\.git(?:\/|$)/ },
+  { name: "dependency or generated caches", pattern: /(^|\/)(?:node_modules|coverage|tmp|temp|\.next|dist-debug)(?:\/|$)/ },
+  { name: "private or secret-named directories", pattern: /(^|\/)(?:private|secrets?|internal)(?:\/|$)/i },
+  { name: "environment or credential files", pattern: /(^|\/)(?:\.env(?:\..*)?|\.npmrc|npm-debug\.log|yarn-error\.log|pnpm-debug\.log|.*\.(?:pem|p12|key))$/i }
+];
+
+const unsafeContentPatterns = [
+  { name: "private key block", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OpenAI-looking secret key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { name: "Anthropic-looking secret key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub-looking token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/ },
+  { name: "AWS access key id", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "Slack-looking token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
+  { name: "absolute Unix home path", pattern: /(?:^|[\s"'`])\/(?:Users|home)\/[A-Za-z0-9._-]+/ },
+  { name: "absolute Windows user path", pattern: /[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\/ }
+];
+
+const pack = dryRunPack();
+const files = new Set(pack.files.map((file) => normalizePath(file.path)));
+
+if (pack.name !== packageJson.name) {
+  failures.push(`Dry-run package name should be ${packageJson.name}. Saw ${pack.name}.`);
+}
+
+if (pack.version !== packageJson.version) {
+  failures.push(`Dry-run package version should be ${packageJson.version}. Saw ${pack.version}.`);
+}
+
+for (const file of requiredPackageFiles) {
+  if (!files.has(file)) {
+    failures.push(`Package dry run should include ${file}.`);
+  }
+}
+
+for (const file of pack.files) {
+  const path = normalizePath(file.path);
+  for (const rule of forbiddenPackagePathRules) {
+    if (rule.pattern.test(path)) {
+      failures.push(`Package dry run should exclude ${rule.name}: ${path}.`);
+    }
+  }
+}
+
+for (const path of requiredSupportFiles) {
+  requireFile(path);
+  if (!existsSync(join(root, path))) {
+    continue;
+  }
+
+  const content = read(path);
+  for (const unsafe of unsafeContentPatterns) {
+    if (unsafe.pattern.test(content)) {
+      failures.push(`${path} appears to contain ${unsafe.name}; package support examples must stay public-safe.`);
+    }
+  }
+}
+
+if (failures.length > 0) {
+  console.error("Package contents check failed:");
+  for (const failure of failures) {
+    console.error(`- ${failure}`);
+  }
+  process.exit(1);
+}
+
+console.log("Package contents check passed.");
+console.log(`PASS package ${pack.name}@${pack.version}`);
+console.log(`PASS support examples included: ${requiredSupportFiles.length} files`);
+console.log("PASS promo, site, GitHub workflow, cache, private, and credential-shaped files excluded");
+
+function dryRunPack() {
+  const output = runNpm(["pack", "--dry-run", "--json", "--ignore-scripts"]);
+  const parsed = parsePackJson(output);
+  if (!Array.isArray(parsed) || parsed.length !== 1 || typeof parsed[0] !== "object") {
+    fail("npm pack --dry-run --json should return one package entry.");
+  }
+
+  const [pack] = parsed;
+  if (!Array.isArray(pack.files)) {
+    fail("npm pack --dry-run --json output should include a files array.");
+  }
+
+  return pack;
+}
+
+function parsePackJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) {
+    fail("npm pack --dry-run --json returned no output.");
+  }
+
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    const start = trimmed.indexOf("[");
+    const end = trimmed.lastIndexOf("]");
+    if (start >= 0 && end > start) {
+      return JSON.parse(trimmed.slice(start, end + 1));
+    }
+    fail(`Could not parse npm pack JSON output:\n${trimmed}`);
+  }
+}
+
+function read(path) {
+  return readFileSync(join(root, path), "utf8");
+}
+
+function readJson(path) {
+  return JSON.parse(read(path));
+}
+
+function requireFile(path) {
+  if (!existsSync(join(root, path))) {
+    failures.push(`${path} is missing.`);
+  }
+}
+
+function normalizePath(path) {
+  return path.replaceAll("\\", "/");
+}
+
+function runNpm(commandArgs) {
+  if (npmExecPath) {
+    return run(process.execPath, [npmExecPath, ...commandArgs]);
+  }
+
+  return run(npmCommand, commandArgs);
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 20 * 1024 * 1024,
+    env: {
+      ...process.env,
+      npm_config_audit: "false",
+      npm_config_fund: "false"
+    }
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (result.status !== 0) {
+    const detail = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    fail(`${command} ${commandArgs.join(" ")} failed${detail ? `:\n${detail}` : "."}`);
+  }
+
+  return result.stdout;
+}
+
+function fail(message) {
+  throw new Error(message);
+}

package/scripts/check-production-readiness.mjs

@@ -72,6 +72,7 @@ for (const path of [
   "scripts/doctor-framework-tuning.mjs",
   "scripts/check-ci-adoption.mjs",
   "scripts/check-consumer-quickstart.mjs",
+  "scripts/check-package-contents.mjs",
   "scripts/check-report-gallery.mjs",
   "scripts/check-support-triage.mjs",
   "scripts/check-fixtures.mjs",
@@ -157,6 +158,7 @@ requireText("README.md", /support-lifecycle\.md/, "support lifecycle overview li
 requireText("README.md", /outcome-prioritization\.md/, "support outcome prioritization link");
 requireText("README.md", /backlog-review\.md/, "support backlog review link");
 requireText("README.md", /backlog-records\.md/, "support backlog records link");
+requireText("README.md", /pack:contents:check/, "package contents check guidance");
 requireText("README.md", /report gallery feedback/i, "report gallery feedback guidance");
 requireText("README.md", /License: PolyForm Noncommercial/, "the noncommercial license badge");
 requireText("docs/PRODUCTION_READINESS.md", /npm package/i, "npm package readiness");
@@ -189,6 +191,8 @@ requireText("docs/PRODUCTION_READINESS.md", /filled worksheet example/i, "filled
 requireText("docs/PRODUCTION_READINESS.md", /outcome prioritization guide/i, "support outcome prioritization readiness");
 requireText("docs/PRODUCTION_READINESS.md", /backlog review/i, "support backlog review readiness");
 requireText("docs/PRODUCTION_READINESS.md", /backlog records/i, "support backlog records readiness");
+requireText("docs/PRODUCTION_READINESS.md", /pack:contents:check/, "package contents check readiness");
+requireText("docs/PRODUCTION_READINESS.md", /support examples manifest/i, "support examples manifest package readiness");
 requireText("docs/PRODUCTION_READINESS.md", /quiet-pass/, "quiet-pass fixture readiness");
 requireText("docs/CLI.md", /jester doctor --json/, "doctor JSON CLI docs");
 requireText("docs/CLI.md", /quiet-pass fixture/, "quiet-pass fixture CLI docs");
@@ -434,6 +438,12 @@ requireText("scripts/check-ci-adoption.mjs", /framework:tuning:doctor/, "adoptio
 requireText("scripts/check-consumer-quickstart.mjs", /consumer-quickstart/, "consumer quickstart checker target");
 requireText("scripts/check-consumer-quickstart.mjs", /memento-mori-jester@latest/, "consumer quickstart registry verification option");
 requireText("scripts/check-consumer-quickstart.mjs", /framework:tuning:doctor/, "consumer quickstart tuning doctor guard");
+requireText("scripts/check-package-contents.mjs", /support-examples-index\.md/, "package contents support examples index guard");
+requireText("scripts/check-package-contents.mjs", /support-examples-quickstart\.md/, "package contents support examples quickstart guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-map\.md/, "package contents support lifecycle map guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-worksheet\.md/, "package contents support lifecycle worksheet guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-filled-example\.md/, "package contents filled worksheet example guard");
+requireText("scripts/check-package-contents.mjs", /promo|site|private|credential/, "package contents forbidden file guard");
 requireText("scripts/check-report-gallery.mjs", /report-gallery\.json/, "report gallery checker target");
 requireText("scripts/check-report-gallery.mjs", /memento-mori-jester@latest/, "report gallery registry verification option");
 requireText("scripts/check-report-gallery.mjs", /destructive-command-summary/, "report gallery summary guard");
@@ -460,6 +470,8 @@ requireText("package.json", /"ci:adoption:check": "node scripts\/check-ci-adopti
 requireText("package.json", /"consumer:quickstart:check": "node scripts\/check-consumer-quickstart\.mjs"/, "consumer quickstart check script");
 requireText("package.json", /"reports:check": "node scripts\/check-report-gallery\.mjs"/, "report gallery check script");
 requireText("package.json", /"support:check": "node scripts\/check-support-triage\.mjs"/, "support triage check script");
+requireText("package.json", /"pack:contents:check": "node scripts\/check-package-contents\.mjs"/, "package contents check script");
+requireText("package.json", /"pack:dry": "npm pack --dry-run && npm run pack:contents:check"/, "package dry run contents guard");
 requireText("package.json", /"promo:card": "node scripts\/render-social-card\.mjs"/, "social card render script");
 requireText("package.json", /"promo:card:check": "node scripts\/render-social-card\.mjs --check"/, "social card stale check script");
 requireText("package.json", /"promo:check": "node scripts\/check-promo-freshness\.mjs"/, "promo freshness check script");
@@ -474,6 +486,7 @@ requireText("package.json", /npm run reports:check/, "report gallery check in np
 requireText("package.json", /npm run support:check/, "support triage check in npm test");
 requireText("package.json", /npm run promo:check/, "promo freshness check in npm test");
 requireText("package.json", /npm run site:check/, "site check in npm test");
+requireText("package.json", /npm run pack:contents:check/, "package contents check in npm test");
 requireText("scripts/check-promo-freshness.mjs", /--require-package-version/, "optional strict package-version promo check");
 requireText("scripts/check-promo-freshness.mjs", /social-card\.svg/, "social-card freshness check");
 requireText("scripts/check-site.mjs", /site\/index\.html/, "site index check");