Prepare ForgeFlow for public release

scripts/generate-source-manifest.mjs

@@ -1,28 +1,44 @@
 import { createHash } from 'node:crypto';
-import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { readFile, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const excludedDirectories = new Set(['.git', '.forgeflow', 'artifacts', 'coverage', 'dist', 'node_modules', 'playwright-report', 'ForgeFlow-runtime-win-x64']);
 const excludedFiles = new Set(['SOURCE_MANIFEST.txt']);
+const execFileAsync = promisify(execFile);
 
-async function collect(directory, output = []) {
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    if (excludedDirectories.has(entry.name)) continue;
-    const absolute = path.join(directory, entry.name);
-    if (entry.isDirectory()) await collect(absolute, output);
-    else if (!excludedFiles.has(entry.name)) output.push(absolute);
+async function collect() {
+  const { stdout } = await execFileAsync(
+    'git',
+    ['ls-files', '--cached', '--others', '--exclude-standard', '-z'],
+    { cwd: root, encoding: 'buffer', maxBuffer: 16 * 1024 * 1024 },
+  );
+  const relativePaths = stdout
+    .toString('utf8')
+    .split('\0')
+    .filter(Boolean)
+    .filter((relative) => !excludedFiles.has(relative));
+
+  const existing = [];
+  for (const relative of relativePaths) {
+    const absolute = path.resolve(root, relative);
+    try {
+      if ((await stat(absolute)).isFile()) existing.push(absolute);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
   }
-  return output;
+  return existing;
 }
 
 const packageJson = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
-const files = (await collect(root)).sort((left, right) => left.localeCompare(right, 'en'));
+const files = (await collect()).sort((left, right) => left.localeCompare(right, 'en'));
 const lines = [
   `ForgeFlow ${packageJson.version} source manifest`,
   'SHA-256                                                          BYTES  PATH',
-  '(The manifest excludes itself, dependencies and generated release artifacts.)'
+  '(The manifest includes tracked and non-ignored source files, excluding itself.)'
 ];
 
 for (const absolute of files) {

scripts/verify.mjs

@@ -101,7 +101,7 @@ const required = [
   "docs/DIAGNOSTICS.md",
   "docs/DEPLOYMENT_SETUP.md",
   "docs/SSH_UNRAID_DEPLOYMENT.md",
-  "docs/LUMAOPS_SERVER_AUDIT.md",
+  "docs/DEPLOYMENT_MIGRATION_EXAMPLE.md",
   "docs/STATUS_ENDPOINT.md",
   "docs/TEST_MATRIX.md",
   "docs/RELEASE_NOTES_0.4.0.md",
@@ -235,8 +235,8 @@ const sshGuide = await readFile(
   path.join(root, "docs/SSH_UNRAID_DEPLOYMENT.md"),
   "utf8",
 );
-const audit = await readFile(
-  path.join(root, "docs/LUMAOPS_SERVER_AUDIT.md"),
+const migrationExample = await readFile(
+  path.join(root, "docs/DEPLOYMENT_MIGRATION_EXAMPLE.md"),
   "utf8",
 );
 const releaseNotes = await readFile(
@@ -264,11 +264,11 @@ if (
   );
 }
 if (
-  !audit.includes("d42d4a7f08240c478d07466e3fabec654dc71367") ||
-  !audit.includes("source/")
+  !migrationExample.includes("complete 40-character commit SHA") ||
+  !migrationExample.includes("source/")
 ) {
   throw new Error(
-    "LumaOps audit is missing the exact matching SHA or nested repository finding.",
+    "Deployment migration example is missing exact-SHA or nested repository guidance.",
   );
 }
 for (const phrase of [