open-agreements 0.1.0

package/dist/core/validation/license.js

@@ -0,0 +1,30 @@
+import { loadMetadata } from '../metadata.js';
+/**
+ * Validate a template's license metadata.
+ *
+ * The allow_derivatives field means "the committed source DOCX must not be
+ * modified" when false.  It does NOT prevent the tool from rendering filled
+ * output — that decision is made by the fill command based on directory
+ * context (templates/ vs external/).
+ */
+export function validateLicense(templateDir, templateId) {
+    const errors = [];
+    let metadata;
+    try {
+        metadata = loadMetadata(templateDir);
+    }
+    catch (err) {
+        return {
+            templateId,
+            valid: false,
+            errors: [`Failed to load metadata: ${err.message}`],
+        };
+    }
+    // CC-BY-4.0 and CC-BY-ND-4.0 require attribution text
+    if ((metadata.license === 'CC-BY-4.0' || metadata.license === 'CC-BY-ND-4.0') &&
+        !metadata.attribution_text.trim()) {
+        errors.push(`${metadata.license} license requires attribution_text to be non-empty.`);
+    }
+    return { templateId, valid: errors.length === 0, errors };
+}
+//# sourceMappingURL=license.js.map

package/dist/core/validation/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../../src/core/validation/license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQ9C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,UAAkB;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,UAAU;YACV,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,IACE,CAAC,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,QAAQ,CAAC,OAAO,KAAK,cAAc,CAAC;QACzE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,EACjC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,CAAC,OAAO,qDAAqD,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC"}

package/dist/core/validation/output.d.ts

@@ -0,0 +1,12 @@
+export interface OutputValidationResult {
+    valid: boolean;
+    errors: string[];
+    sourceHeadingCount: number;
+    outputHeadingCount: number;
+}
+/**
+ * Validate that a rendered DOCX preserves the heading structure of the source template.
+ * Extracts word/document.xml via AdmZip before scanning for heading styles.
+ */
+export declare function validateOutput(sourceDocxPath: string, outputDocxPath: string): OutputValidationResult;
+//# sourceMappingURL=output.d.ts.map

package/dist/core/validation/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/core/validation/output.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GACrB,sBAAsB,CAiCxB"}

package/dist/core/validation/output.js

@@ -0,0 +1,47 @@
+import AdmZip from 'adm-zip';
+/**
+ * Validate that a rendered DOCX preserves the heading structure of the source template.
+ * Extracts word/document.xml via AdmZip before scanning for heading styles.
+ */
+export function validateOutput(sourceDocxPath, outputDocxPath) {
+    const errors = [];
+    let sourceXml;
+    let outputXml;
+    try {
+        sourceXml = extractDocumentXml(sourceDocxPath);
+        outputXml = extractDocumentXml(outputDocxPath);
+    }
+    catch (err) {
+        return {
+            valid: false,
+            errors: [`Failed to read files: ${err.message}`],
+            sourceHeadingCount: 0,
+            outputHeadingCount: 0,
+        };
+    }
+    const sourceHeadings = countHeadings(sourceXml);
+    const outputHeadings = countHeadings(outputXml);
+    if (sourceHeadings !== outputHeadings) {
+        errors.push(`Heading count mismatch: source has ${sourceHeadings} headings, output has ${outputHeadings}. ` +
+            'Template rendering may have dropped or duplicated content.');
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        sourceHeadingCount: sourceHeadings,
+        outputHeadingCount: outputHeadings,
+    };
+}
+function extractDocumentXml(docxPath) {
+    const zip = new AdmZip(docxPath);
+    const entry = zip.getEntry('word/document.xml');
+    if (!entry)
+        return '';
+    return entry.getData().toString('utf-8');
+}
+function countHeadings(xml) {
+    const headingPattern = /w:val="Heading\d"/g;
+    const matches = xml.match(headingPattern);
+    return matches ? matches.length : 0;
+}
+//# sourceMappingURL=output.js.map

package/dist/core/validation/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/core/validation/output.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAS7B;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,cAAsB,EACtB,cAAsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,SAAiB,CAAC;IACtB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC/C,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC;YAC3D,kBAAkB,EAAE,CAAC;YACrB,kBAAkB,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAEhD,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,sCAAsC,cAAc,yBAAyB,cAAc,IAAI;YAC/F,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,kBAAkB,EAAE,cAAc;QAClC,kBAAkB,EAAE,cAAc;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,cAAc,GAAG,oBAAoB,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/core/validation/recipe.d.ts

@@ -0,0 +1,19 @@
+export interface RecipeValidationResult {
+    recipeId: string;
+    valid: boolean;
+    scaffold: boolean;
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Validate a recipe directory:
+ * - No .docx files (copyrighted content must not be committed)
+ * - metadata.yaml validates against schema
+ * - For non-scaffold recipes: replacements.json, schema.json present and valid
+ * - Replacement values must be valid {identifier} tags
+ * - In strict mode: scaffolds are errors, all files required
+ */
+export declare function validateRecipe(recipeDir: string, recipeId: string, options?: {
+    strict?: boolean;
+}): RecipeValidationResult;
+//# sourceMappingURL=recipe.d.ts.map

package/dist/core/validation/recipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe.d.ts","sourceRoot":"","sources":["../../../src/core/validation/recipe.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AASD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,sBAAsB,CA8IxB"}

package/dist/core/validation/recipe.js

@@ -0,0 +1,148 @@
+import { readdirSync, existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { validateRecipeMetadata, loadRecipeMetadata } from '../metadata.js';
+import { CleanConfigSchema } from '../metadata.js';
+/** Pattern for valid template tags within replacement values */
+const TAG_RE = /\{[a-z_][a-z0-9_]*\}/g;
+/** Pattern for any curly-brace token (to detect control tags) */
+const ANY_BRACE_RE = /\{[^}]+\}/g;
+/** Only simple identifiers inside braces are allowed */
+const SAFE_TAG_RE = /^\{[a-z_][a-z0-9_]*\}$/;
+/**
+ * Validate a recipe directory:
+ * - No .docx files (copyrighted content must not be committed)
+ * - metadata.yaml validates against schema
+ * - For non-scaffold recipes: replacements.json, schema.json present and valid
+ * - Replacement values must be valid {identifier} tags
+ * - In strict mode: scaffolds are errors, all files required
+ */
+export function validateRecipe(recipeDir, recipeId, options) {
+    const errors = [];
+    const warnings = [];
+    const strict = options?.strict ?? false;
+    // Check for .docx files (forbidden in recipe dirs)
+    const files = readdirSync(recipeDir);
+    const docxFiles = files.filter((f) => f.toLowerCase().endsWith('.docx'));
+    if (docxFiles.length > 0) {
+        errors.push(`Copyrighted .docx file(s) found: ${docxFiles.join(', ')}. Recipes must not contain source documents.`);
+    }
+    // Validate metadata
+    const metaResult = validateRecipeMetadata(recipeDir);
+    if (!metaResult.valid) {
+        errors.push(...metaResult.errors.map((e) => `metadata: ${e}`));
+        return { recipeId, valid: false, scaffold: false, errors, warnings };
+    }
+    // Scaffold detection: if only metadata.yaml exists, this is a scaffold
+    const hasReplacements = existsSync(join(recipeDir, 'replacements.json'));
+    const hasSchema = existsSync(join(recipeDir, 'schema.json'));
+    const isScaffold = !hasReplacements && !hasSchema;
+    if (isScaffold) {
+        if (strict) {
+            errors.push('Scaffold recipe (metadata-only): not runnable. Use non-strict mode to allow scaffolds.');
+        }
+        else {
+            warnings.push('Scaffold recipe (metadata-only): not runnable');
+        }
+        return { recipeId, valid: errors.length === 0, scaffold: true, errors, warnings };
+    }
+    // Validate replacements.json
+    if (hasReplacements) {
+        try {
+            const raw = readFileSync(join(recipeDir, 'replacements.json'), 'utf-8');
+            const replacements = JSON.parse(raw);
+            if (typeof replacements !== 'object' || replacements === null) {
+                errors.push('replacements.json must be a JSON object');
+            }
+            else {
+                for (const [key, value] of Object.entries(replacements)) {
+                    if (typeof value !== 'string') {
+                        errors.push(`replacements.json: value for "${key}" must be a string`);
+                        continue;
+                    }
+                    // Value must contain at least one {identifier} tag
+                    const tags = value.match(TAG_RE);
+                    if (!tags || tags.length === 0) {
+                        errors.push(`replacements.json: value for "${key}" must contain at least one {identifier} tag, got "${value}"`);
+                    }
+                    // All curly-brace tokens in value must be safe identifiers (no control tags)
+                    const allBraces = value.match(ANY_BRACE_RE);
+                    if (allBraces) {
+                        for (const token of allBraces) {
+                            if (!SAFE_TAG_RE.test(token)) {
+                                errors.push(`replacements.json: unsafe tag "${token}" in value for "${key}". Only {identifier} tags allowed.`);
+                            }
+                        }
+                    }
+                    // Value must not contain the source key (infinite loop prevention)
+                    if (value.includes(key)) {
+                        errors.push(`replacements.json: value for "${key}" contains the key itself (would cause infinite loop)`);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            errors.push(`replacements.json: ${err.message}`);
+        }
+    }
+    else {
+        if (strict) {
+            errors.push('replacements.json not found (required for runnable recipes)');
+        }
+        else {
+            warnings.push('replacements.json not found (required for runnable recipes)');
+        }
+    }
+    // schema.json is required for non-scaffold recipes
+    if (!hasSchema) {
+        if (strict) {
+            errors.push('schema.json not found (required for runnable recipes)');
+        }
+        else {
+            warnings.push('schema.json not found (required for runnable recipes)');
+        }
+    }
+    // Validate schema.json field coverage
+    if (hasSchema && hasReplacements) {
+        try {
+            const schema = JSON.parse(readFileSync(join(recipeDir, 'schema.json'), 'utf-8'));
+            const replacements = JSON.parse(readFileSync(join(recipeDir, 'replacements.json'), 'utf-8'));
+            const schemaFields = new Set((schema.fields ?? schema).map?.((f) => f.name) ?? Object.keys(schema));
+            // Check that replacement targets reference schema fields
+            for (const value of Object.values(replacements)) {
+                const tagMatch = value.match(/^\{(\w+)\}$/);
+                if (tagMatch) {
+                    const fieldName = tagMatch[1];
+                    if (!schemaFields.has(fieldName)) {
+                        warnings.push(`Replacement target {${fieldName}} not found in schema.json`);
+                    }
+                }
+            }
+        }
+        catch {
+            // Already validated above
+        }
+    }
+    // Validate clean.json if present
+    const cleanPath = join(recipeDir, 'clean.json');
+    if (existsSync(cleanPath)) {
+        try {
+            const raw = readFileSync(cleanPath, 'utf-8');
+            CleanConfigSchema.parse(JSON.parse(raw));
+        }
+        catch {
+            errors.push(`clean.json: invalid format`);
+        }
+    }
+    // Warn if source_sha256 is missing (fill will skip integrity verification)
+    try {
+        const meta = loadRecipeMetadata(recipeDir);
+        if (!meta.source_sha256) {
+            warnings.push('No source_sha256 in metadata — fill will skip integrity verification');
+        }
+    }
+    catch {
+        // metadata validation already handled above
+    }
+    return { recipeId, valid: errors.length === 0, scaffold: false, errors, warnings };
+}
+//# sourceMappingURL=recipe.js.map

package/dist/core/validation/recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe.js","sourceRoot":"","sources":["../../../src/core/validation/recipe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,gEAAgE;AAChE,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,iEAAiE;AACjE,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,wDAAwD;AACxD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,QAAgB,EAChB,OAA8B;IAE9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC;IAExC,mDAAmD;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACtH,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvE,CAAC;IAED,uEAAuE;IACvE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC;IAElD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;IAED,6BAA6B;IAC7B,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;YACxE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,oBAAoB,CAAC,CAAC;wBACtE,SAAS;oBACX,CAAC;oBAED,mDAAmD;oBACnD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,CACT,iCAAiC,GAAG,sDAAsD,KAAK,GAAG,CACnG,CAAC;oBACJ,CAAC;oBAED,6EAA6E;oBAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;oBAC5C,IAAI,SAAS,EAAE,CAAC;wBACd,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;4BAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gCAC7B,MAAM,CAAC,IAAI,CACT,kCAAkC,KAAK,mBAAmB,GAAG,oCAAoC,CAClG,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,mEAAmE;oBACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,MAAM,CAAC,IAAI,CACT,iCAAiC,GAAG,uDAAuD,CAC5F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAE7F,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CACxF,CAAC;YAEF,yDAAyD;YACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAI,KAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACxD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;wBACjC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,SAAS,4BAA4B,CAAC,CAAC;oBAC9E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC"}

package/dist/core/validation/template.d.ts

@@ -0,0 +1,11 @@
+export interface TemplateValidationResult {
+    templateId: string;
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Validate that a template's metadata fields match the placeholders in its DOCX file.
+ */
+export declare function validateTemplate(templateDir: string, templateId: string): TemplateValidationResult;
+//# sourceMappingURL=template.d.ts.map

package/dist/core/validation/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../../src/core/validation/template.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA+BD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAmFlG"}

package/dist/core/validation/template.js

@@ -0,0 +1,159 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import AdmZip from 'adm-zip';
+import { loadMetadata } from '../metadata.js';
+/**
+ * Extract text content from a DOCX file by unzipping and reading word/document.xml.
+ * Concatenates <w:t> text within each <w:p> paragraph, then joins paragraphs with
+ * newlines to prevent false {tag} matches across element boundaries.
+ */
+function extractDocxText(docxPath) {
+    const zip = new AdmZip(docxPath);
+    const documentXml = zip.getEntry('word/document.xml');
+    if (!documentXml)
+        return '';
+    const xml = documentXml.getData().toString('utf-8');
+    const paragraphs = [];
+    const paraRegex = /<w:p[\s>][\s\S]*?<\/w:p>/g;
+    let paraMatch;
+    while ((paraMatch = paraRegex.exec(xml)) !== null) {
+        const paraXml = paraMatch[0];
+        const textParts = [];
+        const tRegex = /<w:t[^>]*>([^<]*)<\/w:t>/g;
+        let tMatch;
+        while ((tMatch = tRegex.exec(paraXml)) !== null) {
+            textParts.push(tMatch[1]);
+        }
+        if (textParts.length > 0) {
+            paragraphs.push(textParts.join(''));
+        }
+    }
+    return paragraphs.join('\n');
+}
+/**
+ * Validate that a template's metadata fields match the placeholders in its DOCX file.
+ */
+export function validateTemplate(templateDir, templateId) {
+    const errors = [];
+    const warnings = [];
+    let metadata;
+    try {
+        metadata = loadMetadata(templateDir);
+    }
+    catch (err) {
+        return {
+            templateId,
+            valid: false,
+            errors: [`Failed to load metadata: ${err.message}`],
+            warnings: [],
+        };
+    }
+    const templatePath = join(templateDir, 'template.docx');
+    if (!existsSync(templatePath)) {
+        return {
+            templateId,
+            valid: false,
+            errors: ['template.docx not found in template directory'],
+            warnings: [],
+        };
+    }
+    // Extract text from DOCX and find {tag} placeholders and {IF field} conditionals
+    const text = extractDocxText(templatePath);
+    const placeholderRegex = /\{(\w+)\}/g;
+    const foundTags = new Set();
+    let match;
+    while ((match = placeholderRegex.exec(text)) !== null) {
+        foundTags.add(match[1]);
+    }
+    // Also find fields used in IF conditions (boolean fields appear here, not as {field})
+    const conditionalRegex = /\{IF !?(\w+)\}/g;
+    const foundConditionalFields = new Set();
+    let condMatch;
+    while ((condMatch = conditionalRegex.exec(text)) !== null) {
+        foundConditionalFields.add(condMatch[1]);
+    }
+    const metadataFieldNames = new Set(metadata.fields.map((f) => f.name));
+    // Security: scan for docx-templates control/code tags that should not exist
+    // in open-source templates. Only simple {identifier} tags are allowed.
+    const rawXml = extractRawDocumentXml(templatePath);
+    if (rawXml) {
+        scanForUnsafeTemplateTags(rawXml, errors);
+    }
+    // Check for fields in metadata but not in DOCX
+    for (const fieldName of metadataFieldNames) {
+        // A field can appear as {field} (simple tag) or in {IF field}/{IF !field} (conditional)
+        const inDocx = foundTags.has(fieldName) || foundConditionalFields.has(fieldName);
+        if (!inDocx) {
+            const field = metadata.fields.find((f) => f.name === fieldName);
+            if (field?.required) {
+                errors.push(`Required field "${fieldName}" defined in metadata but not found as {${fieldName}} in template.docx`);
+            }
+            else {
+                warnings.push(`Optional field "${fieldName}" defined in metadata but not found as {${fieldName}} in template.docx`);
+            }
+        }
+    }
+    // Check for placeholders in DOCX but not in metadata
+    // Skip control tokens (IF, END) that aren't field names
+    const controlTokens = new Set(['IF', 'END']);
+    for (const tag of foundTags) {
+        if (controlTokens.has(tag))
+            continue;
+        if (!metadataFieldNames.has(tag)) {
+            warnings.push(`Placeholder {${tag}} found in template.docx but not defined in metadata fields`);
+        }
+    }
+    return { templateId, valid: errors.length === 0, errors, warnings };
+}
+/**
+ * Extract raw word/document.xml string from a DOCX file.
+ */
+function extractRawDocumentXml(docxPath) {
+    const zip = new AdmZip(docxPath);
+    const entry = zip.getEntry('word/document.xml');
+    if (!entry)
+        return null;
+    return entry.getData().toString('utf-8');
+}
+/** Allowed tag pattern: simple {identifier}, {IF [!]identifier}, or {END-IF}. */
+const SAFE_TAG_RE = /^\{(?:[a-zA-Z_][a-zA-Z0-9_]*|IF !?[a-zA-Z_][a-zA-Z0-9_]*|END-IF)\}$/;
+/**
+ * Scan the raw OOXML text content for any {…} tokens and reject ones that
+ * are not simple identifiers. This blocks docx-templates control tags
+ * ({#if}, {/if}, {>partial}, {= expression}, etc.) that could execute
+ * arbitrary code in the Node VM sandbox.
+ *
+ * We extract text from <w:t> elements and scan for curly-brace tokens,
+ * then also check across run boundaries within paragraphs.
+ */
+function scanForUnsafeTemplateTags(xml, errors) {
+    // Extract all text content from <w:t> elements and reassemble per-paragraph
+    const paragraphs = [];
+    const paraRegex = /<w:p[\s>][\s\S]*?<\/w:p>/g;
+    let paraMatch;
+    while ((paraMatch = paraRegex.exec(xml)) !== null) {
+        const paraXml = paraMatch[0];
+        const textParts = [];
+        const tRegex = /<w:t[^>]*>([^<]*)<\/w:t>/g;
+        let tMatch;
+        while ((tMatch = tRegex.exec(paraXml)) !== null) {
+            textParts.push(tMatch[1]);
+        }
+        if (textParts.length > 0) {
+            paragraphs.push(textParts.join(''));
+        }
+    }
+    const fullText = paragraphs.join('\n');
+    // Find all {…} tokens in the reassembled text
+    const tokenRegex = /\{[^}]+\}/g;
+    let tokenMatch;
+    while ((tokenMatch = tokenRegex.exec(fullText)) !== null) {
+        const token = tokenMatch[0];
+        if (!SAFE_TAG_RE.test(token)) {
+            errors.push(`Unsafe template tag "${token}" found in template.docx. ` +
+                `Only simple {identifier}, {IF [!]identifier}, and {END-IF} tags are allowed. ` +
+                `Control tags ({#...}, {/...}, {>...}, {=...}) are not permitted in open-source templates.`);
+        }
+    }
+}
+//# sourceMappingURL=template.js.map

package/dist/core/validation/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../../src/core/validation/template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,IAAI,SAAS,CAAC;IACd,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,IAAI,MAAM,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,UAAkB;IACtE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,UAAU;YACV,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC;YAC9D,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,UAAU;YACV,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,+CAA+C,CAAC;YACzD,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,YAAY,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,sFAAsF;IACtF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;IAC3C,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IACjD,IAAI,SAAS,CAAC;IACd,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1D,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,+CAA+C;IAC/C,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,wFAAwF;QACxF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,mBAAmB,SAAS,2CAA2C,SAAS,oBAAoB,CACrG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CACX,mBAAmB,SAAS,2CAA2C,SAAS,oBAAoB,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,wDAAwD;IACxD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CACX,gBAAgB,GAAG,6DAA6D,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,GAAW,EAAE,MAAgB;IAC9D,4EAA4E;IAC5E,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,IAAI,SAAS,CAAC;IACd,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,IAAI,MAAM,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEvC,8CAA8C;IAC9C,MAAM,UAAU,GAAG,YAAY,CAAC;IAChC,IAAI,UAAU,CAAC;IACf,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CACT,wBAAwB,KAAK,4BAA4B;gBACzD,+EAA+E;gBAC/E,2FAA2F,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { fillTemplate, type FillOptions, type FillResult } from './core/engine.js';
+export { loadMetadata, validateMetadata, loadRecipeMetadata, validateRecipeMetadata, loadCleanConfig, TemplateMetadataSchema, RecipeMetadataSchema, CleanConfigSchema, LicenseEnum, FieldDefinitionSchema, type TemplateMetadata, type RecipeMetadata, type CleanConfig, type FieldDefinition, type License, } from './core/metadata.js';
+export { runExternalFill, type ExternalFillOptions, type ExternalFillResult, } from './core/external/index.js';
+export { loadExternalMetadata, validateExternalMetadata, ExternalMetadataSchema, type ExternalMetadata, } from './core/metadata.js';
+export { validateTemplate, type TemplateValidationResult } from './core/validation/template.js';
+export { validateLicense, type LicenseValidationResult } from './core/validation/license.js';
+export { validateOutput, type OutputValidationResult } from './core/validation/output.js';
+export { validateRecipe, type RecipeValidationResult } from './core/validation/recipe.js';
+export { validateExternal, type ExternalValidationResult } from './core/validation/external.js';
+export { runRecipe, cleanDocument, patchDocument, verifyOutput, ensureSourceDocx, type RecipeRunOptions, type RecipeRunResult, type VerifyResult, type VerifyCheck, } from './core/recipe/index.js';
+export type { ToolCommandAdapter } from './core/command-generation/types.js';
+export { ClaudeCodeAdapter } from './core/command-generation/adapters/claude.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnF,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,OAAO,GACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAGhG,OAAO,EACL,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+// Public API exports
+// Template engine
+export { fillTemplate } from './core/engine.js';
+// Metadata schemas and loaders
+export { loadMetadata, validateMetadata, loadRecipeMetadata, validateRecipeMetadata, loadCleanConfig, TemplateMetadataSchema, RecipeMetadataSchema, CleanConfigSchema, LicenseEnum, FieldDefinitionSchema, } from './core/metadata.js';
+// External template engine
+export { runExternalFill, } from './core/external/index.js';
+// Metadata schemas and loaders (external)
+export { loadExternalMetadata, validateExternalMetadata, ExternalMetadataSchema, } from './core/metadata.js';
+// Template validation
+export { validateTemplate } from './core/validation/template.js';
+export { validateLicense } from './core/validation/license.js';
+export { validateOutput } from './core/validation/output.js';
+export { validateRecipe } from './core/validation/recipe.js';
+export { validateExternal } from './core/validation/external.js';
+// Recipe engine
+export { runRecipe, cleanDocument, patchDocument, verifyOutput, ensureSourceDocx, } from './core/recipe/index.js';
+export { ClaudeCodeAdapter } from './core/command-generation/adapters/claude.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAqC,MAAM,kBAAkB,CAAC;AAEnF,+BAA+B;AAC/B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,qBAAqB,GAMtB,MAAM,oBAAoB,CAAC;AAE5B,2BAA2B;AAC3B,OAAO,EACL,eAAe,GAGhB,MAAM,0BAA0B,CAAC;AAElC,0CAA0C;AAC1C,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAE5B,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAiC,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,eAAe,EAAgC,MAAM,8BAA8B,CAAC;AAC7F,OAAO,EAAE,cAAc,EAA+B,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAA+B,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAiC,MAAM,+BAA+B,CAAC;AAEhG,gBAAgB;AAChB,OAAO,EACL,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,gBAAgB,GAKjB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/utils/paths.d.ts

@@ -0,0 +1,15 @@
+/** Root of the open-agreements package */
+export declare function getPackageRoot(): string;
+/** Templates directory */
+export declare function getTemplatesDir(): string;
+/** Resolve a specific template directory by ID */
+export declare function resolveTemplateDir(templateId: string): string;
+/** External templates directory */
+export declare function getExternalDir(): string;
+/** Resolve a specific external template directory by ID */
+export declare function resolveExternalDir(externalId: string): string;
+/** Recipes directory */
+export declare function getRecipesDir(): string;
+/** Resolve a specific recipe directory by ID */
+export declare function resolveRecipeDir(recipeId: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/utils/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAMA,0CAA0C;AAC1C,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAYD,0BAA0B;AAC1B,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,mCAAmC;AACnC,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAwB;AACxB,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/utils/paths.js

@@ -0,0 +1,43 @@
+import { join, dirname, resolve, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+/** Root of the open-agreements package */
+export function getPackageRoot() {
+    // From dist/utils/paths.js → go up to package root
+    return join(__dirname, '..', '..');
+}
+/** Resolve a child directory, rejecting path traversal (e.g. "../../etc") */
+function resolveChildDir(parentDir, childId, label) {
+    const resolved = resolve(join(parentDir, childId));
+    const rel = relative(resolve(parentDir), resolved);
+    if (rel.startsWith('..') || rel.startsWith(sep + sep)) {
+        throw new Error(`Invalid ${label} ID: ${childId}`);
+    }
+    return resolved;
+}
+/** Templates directory */
+export function getTemplatesDir() {
+    return join(getPackageRoot(), 'templates');
+}
+/** Resolve a specific template directory by ID */
+export function resolveTemplateDir(templateId) {
+    return resolveChildDir(getTemplatesDir(), templateId, 'template');
+}
+/** External templates directory */
+export function getExternalDir() {
+    return join(getPackageRoot(), 'external');
+}
+/** Resolve a specific external template directory by ID */
+export function resolveExternalDir(externalId) {
+    return resolveChildDir(getExternalDir(), externalId, 'external');
+}
+/** Recipes directory */
+export function getRecipesDir() {
+    return join(getPackageRoot(), 'recipes');
+}
+/** Resolve a specific recipe directory by ID */
+export function resolveRecipeDir(recipeId) {
+    return resolveChildDir(getRecipesDir(), recipeId, 'recipe');
+}
+//# sourceMappingURL=paths.js.map

package/dist/utils/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,0CAA0C;AAC1C,MAAM,UAAU,cAAc;IAC5B,mDAAmD;IACnD,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,SAAiB,EAAE,OAAe,EAAE,KAAa;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,eAAe,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,eAAe,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACnE,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC"}

package/external/LICENSE

@@ -0,0 +1,27 @@
+Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0)
+
+The DOCX files in this directory are redistributed under the CC BY-ND 4.0 license.
+They are unmodified copies of the originals published by their respective authors.
+
+You are free to:
+  - Share: copy and redistribute the material in any medium or format for any purpose,
+    even commercially.
+
+Under the following terms:
+  - Attribution: You must give appropriate credit, provide a link to the license, and
+    indicate if changes were made.
+  - NoDerivatives: If you remix, transform, or build upon the material, you may not
+    distribute the modified material.
+
+Full license text: https://creativecommons.org/licenses/by-nd/4.0/legalcode
+
+---
+
+Y Combinator Post-Money SAFE Documents
+Copyright Y Combinator
+Source: https://www.ycombinator.com/documents
+
+  - yc-safe-valuation-cap/template.docx — Post-Money SAFE, Valuation Cap Only
+  - yc-safe-discount/template.docx — Post-Money SAFE, Discount Only
+  - yc-safe-mfn/template.docx — Post-Money SAFE, MFN Only
+  - yc-safe-pro-rata-side-letter/template.docx — Pro Rata Side Letter