export function validatePackageSync(projectRoot) {
  // Step 1: Get pack files
  const packFiles = getPackFiles(projectRoot);
  if (packFiles === null) {
    throw new Error('Failed to run npm pack --dry-run');
  }

  // Step 2: Classify each file using audit_layers.py
  const classifications = classifyFiles(packFiles, projectRoot);

  // Step 3: Find violations (anything not L1)
  const violations = [];
  for (const file of packFiles) {
    const info = classifications[file];
    if (info.layer !== 'L1') {
      violations.push({ 
        path: file, 
        layer: info.layer, 
        reason: info.reason 
      });
    }
  }

  return {
    status: violations.length === 0 ? 'PASSED' : 'FAILED',
    totalFiles: packFiles.length,
    violations,
  };
}

{
  "scripts": {
    "prepublishOnly": "node bin/pre-publish-gate.js"
  }
}

def classify_path(path: Path, repo_root: Path, is_file: bool = True) -> Tuple[str, str]:
    """
    Classify a path into layer.
    Returns: (layer, reason)
    """
    rel_path = str(path.relative_to(repo_root))
    
    # Priority: DELETE > NEVER > L3 > L2 > L1 > REVIEW
    
    # Check DELETE patterns
    for pattern in DELETE_PATTERNS:
        if pattern in rel_path:
            return ("DELETE", "Obsolete — replaced by newer implementation")
    
    # Check NEVER patterns (secrets)
    for pattern in NEVER_PATTERNS:
        if pattern.search(rel_path):
            return ("NEVER", "Secrets/sensitive config")
    
    # Check L3 patterns (personal data)
    for prefix in L3_PATTERNS:
        if rel_path.startswith(prefix):
            # Exception: .gitkeep is always L1
            if path.name == ".gitkeep":
                return ("L1", "Empty structure marker")
            return ("L3", "Personal data")
    
    # Check L2 patterns (premium content)
    for prefix in L2_PATTERNS:
        if rel_path.startswith(prefix):
            if path.name == ".gitkeep":
                return ("L1", "Empty structure marker")
            return ("L2", "Premium content")
    
    # Check L1 patterns (core engine)
    for prefix in L1_PATTERNS:
        if rel_path.startswith(prefix):
            return ("L1", "Core engine")
    
    # Default: REVIEW (needs human decision)
    return ("REVIEW", "Unclear (needs classification)")

#!/usr/bin/env python3
"""
Creation Validator - Validates file creation against layer rules.

Prevents:
- Creating L3 files in L1 directories
- Creating NEVER files anywhere
- Creating files in wrong layer
"""

import sys
import json
from pathlib import Path

def validate_creation(file_path: str) -> dict:
    """
    Validates file creation.
    Returns: {"continue": bool, "feedback": str}
    """
    path = Path(file_path)
    
    # Check if file is in NEVER category
    if is_never_file(path):
        return {
            "continue": False,
            "feedback": f"[BLOCKED] Cannot create {path.name} - contains secrets"
        }
    
    # Check layer compliance
    expected_layer = get_expected_layer(path)
    if expected_layer == "VIOLATION":
        return {
            "continue": False,
            "feedback": f"[BLOCKED] {path} violates layer rules"
        }
    
    return {"continue": True}

name: Validate Package

on:
  pull_request:
  push:
    branches: [main]

jobs:
  validate:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          npm ci
          pip install pyyaml
      
      - name: Validate package layers
        run: |
          node bin/validate-package.js --json > validation.json
          cat validation.json
          
          # Fail if status is not PASSED
          if [ "$(jq -r '.status' validation.json)" != "PASSED" ]; then
            echo "Validation FAILED"
            jq '.violations' validation.json
            exit 1
          fi
      
      - name: Run security gate
        run: |
          node bin/pre-publish-gate.js