feat(cli): node-fdd-pack now aggressively audits presentation layer template bindings against payload structures during compile

Author: Corey B

lib/node-fdd/src/pack.js

@@ -25,6 +25,28 @@ async function main() {
         mutable = await fs.readFile(mutablePath, 'utf8');
     }
 
+    const warnings = [];
+    const autosaveRegex = /name=["']([^"']+)["'][^>]*?autosave/g;
+    const autosaveReverseRegex = /autosave[^>]*?name=["']([^"']+)["']/g;
+    const actionRegex = /fdd-target=["']([^"']+)["']/g;
+
+    let match;
+    while ((match = autosaveRegex.exec(template)) !== null) {
+        if (match[1].startsWith('fdd-data')) warnings.push(`[WARN] Autosave input bound to cryptographic payload: "${match[1]}". This mutation will reject silently in production.`);
+    }
+    while ((match = autosaveReverseRegex.exec(template)) !== null) {
+        if (match[1].startsWith('fdd-data')) warnings.push(`[WARN] Autosave input bound to cryptographic payload: "${match[1]}". This mutation will reject silently in production.`);
+    }
+    while ((match = actionRegex.exec(template)) !== null) {
+        if (match[1].startsWith('fdd-data')) warnings.push(`[WARN] Declarative action target bound to cryptographic payload: "${match[1]}". The OpenFDD standard strictly restricts mutations to the 'user-notes' structure.`);
+    }
+
+    if (warnings.length > 0) {
+        console.log("\n⚠️ OPENFDD COMPILER WARNINGS ⚠️");
+        warnings.forEach(w => console.log(w));
+        console.log("----------------------------------\n");
+    }
+
     const fdd = `<fdd-container extension=".fdd">
   <script type="application/vc+json" id="fdd-data">
     ${vc.split('\n').join('\n    ')}