ci/scripts/validate-pack.js

const { execSync } = require("child_process");

const ALLOWED_ENTRIES = ["dist/", "opencode/", "templates/", "LICENSE", "README.md", "package.json"];

function validatePack() {
  let output;
  try {
    output = execSync("npm pack --dry-run --json", { encoding: "utf-8" });
  } catch (err) {
    console.error("Failed to run npm pack --dry-run:", err.message);
    process.exit(1);
  }

  let packFiles;
  try {
    const parsed = JSON.parse(output);
    packFiles = Array.isArray(parsed) ? parsed[0].files : parsed.files;
  } catch (err) {
    console.error("Failed to parse npm pack output:", err.message);
    process.exit(1);
  }

  if (!packFiles || !Array.isArray(packFiles)) {
    console.error("No files array found in npm pack output");
    process.exit(1);
  }

  const paths = packFiles.map((f) => f.path || f);

  const unexpected = [];
  for (const p of paths) {
    const top = p.split("/")[0] || p;
    const allowed = ALLOWED_ENTRIES.some((entry) => {
      const e = entry.replace(/\/$/, "");
      return top === e || top === entry || p === entry;
    });
    if (!allowed) {
      unexpected.push(p);
    }
  }

  if (unexpected.length > 0) {
    console.error("Unexpected files in npm pack output:");
    for (const f of unexpected) {
      console.error(`  - ${f}`);
    }
    console.error("");
    console.error("Allowed top-level entries:", ALLOWED_ENTRIES.join(", "));
    process.exit(1);
  }

  console.log("npm pack validation passed — all entries are allowed.");
}

validatePack();