@contractspec/bundle.workspace 3.7.0 → 3.7.3

package/dist/formatters/json.d.ts

@@ -26,7 +26,17 @@ export interface JsonFormatOptions {
  * CI JSON output structure (v1.0).
  */
 export interface CiJsonOutput extends BaseJsonOutput {
+    success: boolean;
     checks: CiCheckJson[];
+    categories: {
+        category: string;
+        label: string;
+        passed: boolean;
+        errors: number;
+        warnings: number;
+        notes: number;
+        durationMs: number;
+    }[];
     drift: {
         status: 'none' | 'detected';
         files: string[];
@@ -35,7 +45,11 @@ export interface CiJsonOutput extends BaseJsonOutput {
         pass: number;
         fail: number;
         warn: number;
+        note: number;
         total: number;
+        totalErrors: number;
+        totalWarnings: number;
+        totalNotes: number;
         durationMs: number;
         timestamp: string;
     };

package/dist/index.js

@@ -1,12 +1,16 @@
 // @bun
 var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -244,6 +248,8 @@ import { glob as globFn } from "glob";
 
 // src/adapters/fs.ts
 var DEFAULT_SPEC_PATTERNS = [
+  "**/*.command.ts",
+  "**/*.query.ts",
   "**/*.operation.ts",
   "**/*.operations.ts",
   "**/*.event.ts",
@@ -263,6 +269,10 @@ var DEFAULT_SPEC_PATTERNS = [
   "**/*.test-spec.ts",
   "**/contracts/*.ts",
   "**/contracts/index.ts",
+  "**/commands/*.ts",
+  "**/commands/index.ts",
+  "**/queries/*.ts",
+  "**/queries/index.ts",
   "**/operations/*.ts",
   "**/operations/index.ts",
   "**/operations.ts",
@@ -759,7 +769,8 @@ function createNodeAdapters(options = {}) {
 }
 // src/adapters/workspace.ts
 import { existsSync, readFileSync } from "fs";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "path";
+import { tmpdir } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve4 } from "path";
 var LOCK_FILES = {
   "bun.lockb": "bun",
   "bun.lock": "bun",
@@ -774,14 +785,24 @@ var MONOREPO_FILES = [
   "turbo.json",
   "rush.json"
 ];
+function isWithinDirectory(target, directory) {
+  const pathFromDirectory = relative3(directory, target);
+  return pathFromDirectory === "" || !pathFromDirectory.startsWith("..") && !isAbsolute3(pathFromDirectory);
+}
+function getTraversalBoundary(startDir) {
+  const resolvedStartDir = resolve4(startDir);
+  const tempRoot = resolve4(tmpdir());
+  return isWithinDirectory(resolvedStartDir, tempRoot) ? tempRoot : undefined;
+}
 function findPackageRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, "package.json"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -791,6 +812,7 @@ function findPackageRoot(startDir = process.cwd()) {
 function findWorkspaceRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
   let lastPackageJson = null;
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     for (const file of MONOREPO_FILES) {
       if (existsSync(join3(current, file))) {
@@ -813,7 +835,7 @@ function findWorkspaceRoot(startDir = process.cwd()) {
       }
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -942,12 +964,13 @@ function checkHasWorkspaces(dir) {
 }
 function findMetaRepoRoot(startDir) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, ".gitmodules"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -1815,7 +1838,7 @@ ${task.existingCode}`;
 import { spawn } from "child_process";
 import { mkdir as mkdir3, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { join as join4 } from "path";
-import { homedir, tmpdir } from "os";
+import { homedir, tmpdir as tmpdir2 } from "os";
 import { existsSync as existsSync2 } from "fs";
 
 class CursorAgent {
@@ -1832,7 +1855,7 @@ class CursorAgent {
   }
   async generate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-agent-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-agent-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       const result = await this.executeWithBestMethod(task, workDir);
       await this.cleanupWorkDir(workDir);
@@ -1846,7 +1869,7 @@ class CursorAgent {
   }
   async validate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-validate-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-validate-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       await this.setupValidationWorkspace(task, workDir);
       const result = await this.executeWithBestMethod({
@@ -3075,9 +3098,7 @@ async function analyzeDeps(adapters, options = {}) {
   for (const file of files) {
     const content = await fs5.readFile(file);
     const relativePath = fs5.relative(".", file);
-    const nameMatch = content.match(/name:\s*['"]([^'"]+)['"]/);
-    const inferredName = nameMatch?.[1] ? nameMatch[1] : fs5.basename(file).replace(/\.[jt]s$/, "").replace(/\.(contracts|contract|operation|operations|event|presentation|workflow|data-view|migration|telemetry|experiment|app-config|integration|knowledge)$/, "");
-    const finalName = inferredName || "unknown";
+    const finalName = fs5.basename(file).replace(/\.[jt]s$/, "").replace(/\.(contracts|contract|command|query|operation|operations|event|presentation|workflow|data-view|migration|telemetry|experiment|app-config|integration|knowledge)$/, "") || "unknown";
     const dependencies = parseImportedSpecNames(content, file);
     addContractNode(graph, finalName, relativePath, dependencies);
   }
@@ -6657,6 +6678,271 @@ async function checkContractsLibrary(fs5, ctx) {
     };
   }
 }
+// src/services/stability/policy.ts
+var STABILITY_POLICY_PATH = "config/stability-policy.json";
+function normalizePath(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function toStringArray(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean);
+}
+async function loadStabilityPolicy(fs5, workspaceRoot) {
+  const policyPath = fs5.join(workspaceRoot, STABILITY_POLICY_PATH);
+  if (!await fs5.exists(policyPath)) {
+    return;
+  }
+  try {
+    const content = await fs5.readFile(policyPath);
+    const parsed = JSON.parse(content);
+    return {
+      version: typeof parsed.version === "number" && Number.isFinite(parsed.version) ? parsed.version : 1,
+      criticalPackages: toStringArray(parsed.criticalPackages).map(normalizePath),
+      criticalFeatureKeys: toStringArray(parsed.criticalFeatureKeys),
+      smokePackages: toStringArray(parsed.smokePackages)
+    };
+  } catch {
+    return;
+  }
+}
+function getPackageTier(relativePackagePath, policy) {
+  const normalizedPath = normalizePath(relativePackagePath);
+  if (policy?.criticalPackages.includes(normalizedPath)) {
+    return "critical";
+  }
+  return "non-critical";
+}
+function isCriticalFeatureKey(featureKey, policy) {
+  return Boolean(featureKey && policy?.criticalFeatureKeys.includes(featureKey));
+}
+function getStabilityPolicyPath(workspaceRoot) {
+  return normalizePath(`${normalizePath(workspaceRoot)}/${STABILITY_POLICY_PATH}`);
+}
+
+// src/services/stability/package-audit.ts
+var TEST_FILE_PATTERNS = ["**/*.{test,spec}.{ts,tsx,js,jsx,mts,cts}"];
+var TEST_IGNORES = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/.next/**",
+  "**/.turbo/**",
+  "**/coverage/**"
+];
+function toRecord(value) {
+  if (!value || typeof value !== "object") {
+    return {};
+  }
+  return Object.entries(value).reduce((acc, [key, entry]) => {
+    if (typeof entry === "string") {
+      acc[key] = entry;
+    }
+    return acc;
+  }, {});
+}
+function usesPassWithNoTests(scripts) {
+  return Object.entries(scripts).some(([name, command]) => {
+    return name.startsWith("test") && /pass[- ]with[- ]no[- ]tests/i.test(command);
+  });
+}
+async function discoverPackages(fs5, workspaceRoot, policy) {
+  const packageJsonFiles = await fs5.glob({
+    pattern: "packages/**/package.json",
+    cwd: workspaceRoot,
+    ignore: TEST_IGNORES
+  });
+  const descriptors = [];
+  for (const packageJsonFile of packageJsonFiles) {
+    const packagePath = fs5.dirname(packageJsonFile);
+    const relativePackagePath = fs5.relative(workspaceRoot, packagePath);
+    try {
+      const packageJson = JSON.parse(await fs5.readFile(packageJsonFile));
+      const scripts = toRecord(packageJson.scripts);
+      const testFiles = await fs5.glob({
+        patterns: TEST_FILE_PATTERNS,
+        cwd: packagePath,
+        ignore: TEST_IGNORES
+      });
+      descriptors.push({
+        packageName: packageJson.name ?? relativePackagePath,
+        packagePath: relativePackagePath.replace(/\\/g, "/"),
+        hasBuildScript: typeof scripts.build === "string",
+        hasTypecheckScript: typeof scripts.typecheck === "string",
+        hasLintScript: typeof scripts.lint === "string" || typeof scripts["lint:check"] === "string",
+        hasTestScript: typeof scripts.test === "string",
+        usesPassWithNoTests: usesPassWithNoTests(scripts),
+        testFileCount: testFiles.length,
+        tier: getPackageTier(relativePackagePath, policy)
+      });
+    } catch {
+      continue;
+    }
+  }
+  return descriptors;
+}
+function createCriticalFindings(descriptor) {
+  const findings = [];
+  if (!descriptor.hasBuildScript) {
+    findings.push({
+      code: "critical-missing-build-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing build script"
+    });
+  }
+  if (!descriptor.hasTypecheckScript) {
+    findings.push({
+      code: "critical-missing-typecheck-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing typecheck script"
+    });
+  }
+  if (!descriptor.hasLintScript) {
+    findings.push({
+      code: "critical-missing-lint-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing lint or lint:check script"
+    });
+  }
+  if (!descriptor.hasTestScript) {
+    findings.push({
+      code: "critical-missing-test-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing test script"
+    });
+  }
+  if (descriptor.testFileCount === 0) {
+    findings.push({
+      code: "critical-missing-test-files",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "No real test files found"
+    });
+  }
+  if (descriptor.usesPassWithNoTests) {
+    findings.push({
+      code: "critical-pass-with-no-tests",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Uses pass-with-no-tests in a critical package"
+    });
+  }
+  return findings;
+}
+function createGeneralFindings(descriptor) {
+  const findings = [];
+  if (descriptor.testFileCount > 0 && !descriptor.hasTestScript) {
+    findings.push({
+      code: "tests-without-test-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Has test files on disk but no test script"
+    });
+  }
+  if (descriptor.hasBuildScript && descriptor.testFileCount === 0 && !descriptor.hasTestScript) {
+    findings.push({
+      code: "build-without-tests",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Has a build script but no test script or test files"
+    });
+  }
+  return findings;
+}
+async function auditWorkspacePackages(fs5, workspaceRoot, policy) {
+  const packages = await discoverPackages(fs5, workspaceRoot, policy);
+  const findings = [];
+  for (const descriptor of packages) {
+    if (descriptor.tier === "critical") {
+      findings.push(...createCriticalFindings(descriptor));
+    }
+    findings.push(...createGeneralFindings(descriptor));
+  }
+  const criticalPackages = packages.filter((descriptor) => descriptor.tier === "critical").map((descriptor) => ({
+    packageName: descriptor.packageName,
+    packagePath: descriptor.packagePath,
+    hasBuildScript: descriptor.hasBuildScript,
+    hasTypecheckScript: descriptor.hasTypecheckScript,
+    hasLintScript: descriptor.hasLintScript,
+    hasTestScript: descriptor.hasTestScript,
+    usesPassWithNoTests: descriptor.usesPassWithNoTests,
+    testFileCount: descriptor.testFileCount
+  }));
+  return { findings, criticalPackages };
+}
+
+// src/services/doctor/checks/package-stability.ts
+function summarizeFindings(findings) {
+  return findings.slice(0, 5).map((finding) => `${finding.packagePath}: ${finding.message}`).join("; ");
+}
+function createCheckResult(name, findings, failureCodes, successMessage) {
+  if (findings.length === 0) {
+    return {
+      category: "workspace",
+      name,
+      status: "pass",
+      message: successMessage,
+      context: { findings: [] }
+    };
+  }
+  const failingFindings = findings.filter((finding) => {
+    return finding.tier === "critical" || failureCodes.has(finding.code);
+  });
+  return {
+    category: "workspace",
+    name,
+    status: failingFindings.length > 0 ? "fail" : "warn",
+    message: `${findings.length} package issue(s) found`,
+    details: summarizeFindings(findings),
+    context: { findings }
+  };
+}
+async function runPackageStabilityChecks(fs5, ctx) {
+  const policy = await loadStabilityPolicy(fs5, ctx.workspaceRoot);
+  if (!policy) {
+    return [];
+  }
+  const report = await auditWorkspacePackages(fs5, ctx.workspaceRoot, policy);
+  const criticalPackageCodes = new Set([
+    "critical-missing-build-script",
+    "critical-missing-typecheck-script",
+    "critical-missing-lint-script",
+    "critical-missing-test-script",
+    "critical-missing-test-files",
+    "critical-pass-with-no-tests"
+  ]);
+  const qualityGateFindings = report.findings.filter((finding) => criticalPackageCodes.has(finding.code));
+  const testsWithoutScript = report.findings.filter((finding) => finding.code === "tests-without-test-script");
+  const buildWithoutTests = report.findings.filter((finding) => finding.code === "build-without-tests");
+  return [
+    {
+      category: "workspace",
+      name: "Critical Package Gates",
+      status: qualityGateFindings.length > 0 ? "fail" : "pass",
+      message: qualityGateFindings.length > 0 ? `${qualityGateFindings.length} critical package gate failure(s)` : `All ${report.criticalPackages.length} critical packages meet build, lint, typecheck, and test requirements`,
+      details: qualityGateFindings.length > 0 ? summarizeFindings(qualityGateFindings) : ctx.verbose ? `Policy: ${getStabilityPolicyPath(ctx.workspaceRoot)}` : undefined,
+      context: {
+        policyPath: getStabilityPolicyPath(ctx.workspaceRoot),
+        criticalPackages: report.criticalPackages,
+        findings: qualityGateFindings
+      }
+    },
+    createCheckResult("Package Test Scripts", testsWithoutScript, new Set, "All tested packages expose a test script"),
+    createCheckResult("Buildable Packages Without Tests", buildWithoutTests, new Set, "All buildable packages have tests or explicit test scripts")
+  ];
+}
+
 // src/services/doctor/checks/workspace.ts
 var CONTRACT_PATHS = ["src/contracts", "contracts", "src/specs", "specs"];
 async function runWorkspaceChecks(fs5, ctx) {
@@ -6666,6 +6952,7 @@ async function runWorkspaceChecks(fs5, ctx) {
   results.push(await checkContractsDirectory(fs5, ctx));
   results.push(await checkContractFiles(fs5, ctx));
   results.push(await checkOutputDirectory(fs5, ctx));
+  results.push(...await runPackageStabilityChecks(fs5, ctx));
   return results;
 }
 function checkMonorepoStatus(ctx) {
@@ -6847,12 +7134,15 @@ async function checkOutputDirectory(fs5, ctx) {
         details: ctx.verbose ? `Resolved to: ${outputPath}` : undefined
       };
     }
-    if (ctx.isMonorepo && ctx.packageRoot === ctx.workspaceRoot && !config.outputDir) {
+    const isDefaultWorkspaceOutput = outputDir === "./src" || outputDir === "src";
+    const usesPackageScopedConfig = Array.isArray(config.packages) && config.packages.length > 0;
+    if (ctx.isMonorepo && ctx.packageRoot === ctx.workspaceRoot && isDefaultWorkspaceOutput && (usesPackageScopedConfig || configInfo.level === "workspace")) {
       return {
         category: "workspace",
         name: "Output Directory",
         status: "pass",
-        message: "Monorepo root detected (using package directories)"
+        message: "Monorepo root detected (using package directories)",
+        details: ctx.verbose ? `Resolved default output to packages via ${configInfo.path}` : undefined
       };
     }
     return {
@@ -7005,8 +7295,9 @@ async function checkApiKey(fs5, ctx, prompts) {
   }
 }
 // src/services/doctor/checks/layers.ts
-async function runLayerChecks(fs5, _ctx) {
+async function runLayerChecks(fs5, ctx) {
   const results = [];
+  const policy = await loadStabilityPolicy(fs5, ctx.workspaceRoot);
   const discovery = await discoverLayers({
     fs: fs5,
     logger: {
@@ -7027,7 +7318,7 @@ async function runLayerChecks(fs5, _ctx) {
   }, {});
   results.push(checkHasFeatures(discovery.stats.features));
   results.push(checkHasExamples(discovery.stats.examples));
-  results.push(checkFeatureOwners(discovery.inventory.features));
+  results.push(checkFeatureOwners(discovery.inventory.features, policy, ctx));
   results.push(checkExampleEntrypoints(discovery.inventory.examples));
   results.push(checkWorkspaceConfigs(discovery.inventory.workspaceConfigs));
   return results;
@@ -7066,27 +7357,43 @@ function checkHasExamples(count) {
     details: "Create an example.ts file to package reusable templates"
   };
 }
-function checkFeatureOwners(features) {
+function checkFeatureOwners(features, policy, ctx) {
   const missingOwners = [];
+  const criticalMissingOwners = [];
   for (const [key, feature] of features) {
-    if (!feature.owners?.length) {
-      missingOwners.push(key);
+    const hasOwnerMetadata = Boolean(feature.owners?.length) || /owners\s*:\s*(?!\[\s*\])/.test(feature.sourceBlock ?? "");
+    if (!hasOwnerMetadata) {
+      if (isCriticalFeatureKey(key, policy)) {
+        criticalMissingOwners.push(key);
+      } else {
+        missingOwners.push(key);
+      }
     }
   }
-  if (missingOwners.length === 0) {
+  if (criticalMissingOwners.length === 0 && missingOwners.length === 0) {
     return {
       category: "layers",
       name: "Feature Owners",
       status: features.size > 0 ? "pass" : "skip",
-      message: features.size > 0 ? "All features have owners defined" : "No features to check"
+      message: features.size > 0 ? "All features have owners defined" : "No features to check",
+      context: features.size > 0 ? {
+        policyPath: policy ? getStabilityPolicyPath(ctx.workspaceRoot) : undefined,
+        criticalMissingFeatures: [],
+        missingFeatures: []
+      } : undefined
     };
   }
   return {
     category: "layers",
     name: "Feature Owners",
-    status: "warn",
-    message: `${missingOwners.length} feature(s) missing owners`,
-    details: `Features: ${missingOwners.slice(0, 3).join(", ")}${missingOwners.length > 3 ? "..." : ""}`
+    status: criticalMissingOwners.length > 0 ? "fail" : "warn",
+    message: criticalMissingOwners.length > 0 ? `${criticalMissingOwners.length} critical feature(s) missing owners` : `${missingOwners.length} feature(s) missing owners`,
+    details: criticalMissingOwners.length > 0 ? `Critical features: ${criticalMissingOwners.join(", ")}` : `Features: ${missingOwners.slice(0, 3).join(", ")}${missingOwners.length > 3 ? "..." : ""}`,
+    context: {
+      policyPath: policy ? getStabilityPolicyPath(ctx.workspaceRoot) : undefined,
+      criticalMissingFeatures: criticalMissingOwners,
+      missingFeatures: missingOwners
+    }
   };
 }
 function checkExampleEntrypoints(examples) {
@@ -7623,7 +7930,7 @@ async function runDoctorChecks(adapters, options) {
   const result = await runDoctor(adapters, {
     workspaceRoot,
     skipAi: true,
-    categories: ["cli", "config", "deps", "workspace"]
+    categories: ["cli", "config", "deps", "workspace", "layers"]
   });
   for (const check of result.checks) {
     if (check.status === "fail") {
@@ -7632,7 +7939,7 @@ async function runDoctorChecks(adapters, options) {
         severity: "error",
         message: `${check.name}: ${check.message}`,
         category: "doctor",
-        context: { details: check.details }
+        context: { details: check.details, ...check.context ?? {} }
       });
     } else if (check.status === "warn") {
       issues.push({
@@ -7640,7 +7947,7 @@ async function runDoctorChecks(adapters, options) {
         severity: "warning",
         message: `${check.name}: ${check.message}`,
         category: "doctor",
-        context: { details: check.details }
+        context: { details: check.details, ...check.context ?? {} }
       });
     }
   }
@@ -8577,7 +8884,7 @@ init_config();
 // src/services/drift.ts
 import path4 from "path";
 import { mkdtemp, rm as rm3 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
+import { tmpdir as tmpdir3 } from "os";
 
 // src/services/generate-artifacts.ts
 import path3 from "path";
@@ -8737,7 +9044,7 @@ async function generateArtifacts(adapters, contractsDir, generatedDir, rootPath)
 
 // src/services/drift.ts
 async function detectDrift(adapters, contractsDir, generatedDir) {
-  const tempDir = await mkdtemp(path4.join(tmpdir2(), "contractspec-drift-"));
+  const tempDir = await mkdtemp(path4.join(tmpdir3(), "contractspec-drift-"));
   try {
     await generateArtifacts(adapters, contractsDir, tempDir);
     const differences = [];
@@ -16838,20 +17145,36 @@ function formatAsJson(result, options = {}) {
     line: issue.line,
     details: issue.context
   }));
+  const pass = result.categories.filter((category) => category.passed).length;
   const fail = result.totalErrors;
   const warn = result.totalWarnings;
+  const note = result.totalNotes;
   const output = {
     schemaVersion: "1.0",
+    success: result.success,
     checks,
+    categories: result.categories.map((category) => ({
+      category: category.category,
+      label: category.label,
+      passed: category.passed,
+      errors: category.errors,
+      warnings: category.warnings,
+      notes: category.notes,
+      durationMs: category.durationMs
+    })),
     drift: {
       status: driftResult?.hasDrift ? "detected" : "none",
       files: driftResult?.files ?? []
     },
     summary: {
-      pass: 0,
+      pass,
       fail,
       warn,
-      total: fail + warn,
+      note,
+      total: pass + fail + warn + note,
+      totalErrors: result.totalErrors,
+      totalWarnings: result.totalWarnings,
+      totalNotes: result.totalNotes,
       durationMs: result.durationMs,
       timestamp: result.timestamp
     },

package/dist/node/index.js

@@ -1,12 +1,16 @@
 import { createRequire } from "node:module";
 var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -244,6 +248,8 @@ import { glob as globFn } from "glob";
 
 // src/adapters/fs.ts
 var DEFAULT_SPEC_PATTERNS = [
+  "**/*.command.ts",
+  "**/*.query.ts",
   "**/*.operation.ts",
   "**/*.operations.ts",
   "**/*.event.ts",
@@ -263,6 +269,10 @@ var DEFAULT_SPEC_PATTERNS = [
   "**/*.test-spec.ts",
   "**/contracts/*.ts",
   "**/contracts/index.ts",
+  "**/commands/*.ts",
+  "**/commands/index.ts",
+  "**/queries/*.ts",
+  "**/queries/index.ts",
   "**/operations/*.ts",
   "**/operations/index.ts",
   "**/operations.ts",
@@ -759,7 +769,8 @@ function createNodeAdapters(options = {}) {
 }
 // src/adapters/workspace.ts
 import { existsSync, readFileSync } from "node:fs";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve4 } from "node:path";
 var LOCK_FILES = {
   "bun.lockb": "bun",
   "bun.lock": "bun",
@@ -774,14 +785,24 @@ var MONOREPO_FILES = [
   "turbo.json",
   "rush.json"
 ];
+function isWithinDirectory(target, directory) {
+  const pathFromDirectory = relative3(directory, target);
+  return pathFromDirectory === "" || !pathFromDirectory.startsWith("..") && !isAbsolute3(pathFromDirectory);
+}
+function getTraversalBoundary(startDir) {
+  const resolvedStartDir = resolve4(startDir);
+  const tempRoot = resolve4(tmpdir());
+  return isWithinDirectory(resolvedStartDir, tempRoot) ? tempRoot : undefined;
+}
 function findPackageRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, "package.json"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -791,6 +812,7 @@ function findPackageRoot(startDir = process.cwd()) {
 function findWorkspaceRoot(startDir = process.cwd()) {
   let current = resolve4(startDir);
   let lastPackageJson = null;
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     for (const file of MONOREPO_FILES) {
       if (existsSync(join3(current, file))) {
@@ -813,7 +835,7 @@ function findWorkspaceRoot(startDir = process.cwd()) {
       }
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -942,12 +964,13 @@ function checkHasWorkspaces(dir) {
 }
 function findMetaRepoRoot(startDir) {
   let current = resolve4(startDir);
+  const traversalBoundary = getTraversalBoundary(startDir);
   while (true) {
     if (existsSync(join3(current, ".gitmodules"))) {
       return current;
     }
     const parent = dirname3(current);
-    if (parent === current) {
+    if (parent === current || current === traversalBoundary) {
       break;
     }
     current = parent;
@@ -1815,7 +1838,7 @@ ${task.existingCode}`;
 import { spawn } from "child_process";
 import { mkdir as mkdir3, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { join as join4 } from "path";
-import { homedir, tmpdir } from "os";
+import { homedir, tmpdir as tmpdir2 } from "os";
 import { existsSync as existsSync2 } from "fs";
 
 class CursorAgent {
@@ -1832,7 +1855,7 @@ class CursorAgent {
   }
   async generate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-agent-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-agent-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       const result = await this.executeWithBestMethod(task, workDir);
       await this.cleanupWorkDir(workDir);
@@ -1846,7 +1869,7 @@ class CursorAgent {
   }
   async validate(task) {
     try {
-      const workDir = join4(tmpdir(), `cursor-validate-${Date.now()}`);
+      const workDir = join4(tmpdir2(), `cursor-validate-${Date.now()}`);
       await mkdir3(workDir, { recursive: true });
       await this.setupValidationWorkspace(task, workDir);
       const result = await this.executeWithBestMethod({
@@ -3075,9 +3098,7 @@ async function analyzeDeps(adapters, options = {}) {
   for (const file of files) {
     const content = await fs5.readFile(file);
     const relativePath = fs5.relative(".", file);
-    const nameMatch = content.match(/name:\s*['"]([^'"]+)['"]/);
-    const inferredName = nameMatch?.[1] ? nameMatch[1] : fs5.basename(file).replace(/\.[jt]s$/, "").replace(/\.(contracts|contract|operation|operations|event|presentation|workflow|data-view|migration|telemetry|experiment|app-config|integration|knowledge)$/, "");
-    const finalName = inferredName || "unknown";
+    const finalName = fs5.basename(file).replace(/\.[jt]s$/, "").replace(/\.(contracts|contract|command|query|operation|operations|event|presentation|workflow|data-view|migration|telemetry|experiment|app-config|integration|knowledge)$/, "") || "unknown";
     const dependencies = parseImportedSpecNames(content, file);
     addContractNode(graph, finalName, relativePath, dependencies);
   }
@@ -6657,6 +6678,271 @@ async function checkContractsLibrary(fs5, ctx) {
     };
   }
 }
+// src/services/stability/policy.ts
+var STABILITY_POLICY_PATH = "config/stability-policy.json";
+function normalizePath(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function toStringArray(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean);
+}
+async function loadStabilityPolicy(fs5, workspaceRoot) {
+  const policyPath = fs5.join(workspaceRoot, STABILITY_POLICY_PATH);
+  if (!await fs5.exists(policyPath)) {
+    return;
+  }
+  try {
+    const content = await fs5.readFile(policyPath);
+    const parsed = JSON.parse(content);
+    return {
+      version: typeof parsed.version === "number" && Number.isFinite(parsed.version) ? parsed.version : 1,
+      criticalPackages: toStringArray(parsed.criticalPackages).map(normalizePath),
+      criticalFeatureKeys: toStringArray(parsed.criticalFeatureKeys),
+      smokePackages: toStringArray(parsed.smokePackages)
+    };
+  } catch {
+    return;
+  }
+}
+function getPackageTier(relativePackagePath, policy) {
+  const normalizedPath = normalizePath(relativePackagePath);
+  if (policy?.criticalPackages.includes(normalizedPath)) {
+    return "critical";
+  }
+  return "non-critical";
+}
+function isCriticalFeatureKey(featureKey, policy) {
+  return Boolean(featureKey && policy?.criticalFeatureKeys.includes(featureKey));
+}
+function getStabilityPolicyPath(workspaceRoot) {
+  return normalizePath(`${normalizePath(workspaceRoot)}/${STABILITY_POLICY_PATH}`);
+}
+
+// src/services/stability/package-audit.ts
+var TEST_FILE_PATTERNS = ["**/*.{test,spec}.{ts,tsx,js,jsx,mts,cts}"];
+var TEST_IGNORES = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/.next/**",
+  "**/.turbo/**",
+  "**/coverage/**"
+];
+function toRecord(value) {
+  if (!value || typeof value !== "object") {
+    return {};
+  }
+  return Object.entries(value).reduce((acc, [key, entry]) => {
+    if (typeof entry === "string") {
+      acc[key] = entry;
+    }
+    return acc;
+  }, {});
+}
+function usesPassWithNoTests(scripts) {
+  return Object.entries(scripts).some(([name, command]) => {
+    return name.startsWith("test") && /pass[- ]with[- ]no[- ]tests/i.test(command);
+  });
+}
+async function discoverPackages(fs5, workspaceRoot, policy) {
+  const packageJsonFiles = await fs5.glob({
+    pattern: "packages/**/package.json",
+    cwd: workspaceRoot,
+    ignore: TEST_IGNORES
+  });
+  const descriptors = [];
+  for (const packageJsonFile of packageJsonFiles) {
+    const packagePath = fs5.dirname(packageJsonFile);
+    const relativePackagePath = fs5.relative(workspaceRoot, packagePath);
+    try {
+      const packageJson = JSON.parse(await fs5.readFile(packageJsonFile));
+      const scripts = toRecord(packageJson.scripts);
+      const testFiles = await fs5.glob({
+        patterns: TEST_FILE_PATTERNS,
+        cwd: packagePath,
+        ignore: TEST_IGNORES
+      });
+      descriptors.push({
+        packageName: packageJson.name ?? relativePackagePath,
+        packagePath: relativePackagePath.replace(/\\/g, "/"),
+        hasBuildScript: typeof scripts.build === "string",
+        hasTypecheckScript: typeof scripts.typecheck === "string",
+        hasLintScript: typeof scripts.lint === "string" || typeof scripts["lint:check"] === "string",
+        hasTestScript: typeof scripts.test === "string",
+        usesPassWithNoTests: usesPassWithNoTests(scripts),
+        testFileCount: testFiles.length,
+        tier: getPackageTier(relativePackagePath, policy)
+      });
+    } catch {
+      continue;
+    }
+  }
+  return descriptors;
+}
+function createCriticalFindings(descriptor) {
+  const findings = [];
+  if (!descriptor.hasBuildScript) {
+    findings.push({
+      code: "critical-missing-build-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing build script"
+    });
+  }
+  if (!descriptor.hasTypecheckScript) {
+    findings.push({
+      code: "critical-missing-typecheck-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing typecheck script"
+    });
+  }
+  if (!descriptor.hasLintScript) {
+    findings.push({
+      code: "critical-missing-lint-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing lint or lint:check script"
+    });
+  }
+  if (!descriptor.hasTestScript) {
+    findings.push({
+      code: "critical-missing-test-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Missing test script"
+    });
+  }
+  if (descriptor.testFileCount === 0) {
+    findings.push({
+      code: "critical-missing-test-files",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "No real test files found"
+    });
+  }
+  if (descriptor.usesPassWithNoTests) {
+    findings.push({
+      code: "critical-pass-with-no-tests",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Uses pass-with-no-tests in a critical package"
+    });
+  }
+  return findings;
+}
+function createGeneralFindings(descriptor) {
+  const findings = [];
+  if (descriptor.testFileCount > 0 && !descriptor.hasTestScript) {
+    findings.push({
+      code: "tests-without-test-script",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Has test files on disk but no test script"
+    });
+  }
+  if (descriptor.hasBuildScript && descriptor.testFileCount === 0 && !descriptor.hasTestScript) {
+    findings.push({
+      code: "build-without-tests",
+      tier: descriptor.tier,
+      packageName: descriptor.packageName,
+      packagePath: descriptor.packagePath,
+      message: "Has a build script but no test script or test files"
+    });
+  }
+  return findings;
+}
+async function auditWorkspacePackages(fs5, workspaceRoot, policy) {
+  const packages = await discoverPackages(fs5, workspaceRoot, policy);
+  const findings = [];
+  for (const descriptor of packages) {
+    if (descriptor.tier === "critical") {
+      findings.push(...createCriticalFindings(descriptor));
+    }
+    findings.push(...createGeneralFindings(descriptor));
+  }
+  const criticalPackages = packages.filter((descriptor) => descriptor.tier === "critical").map((descriptor) => ({
+    packageName: descriptor.packageName,
+    packagePath: descriptor.packagePath,
+    hasBuildScript: descriptor.hasBuildScript,
+    hasTypecheckScript: descriptor.hasTypecheckScript,
+    hasLintScript: descriptor.hasLintScript,
+    hasTestScript: descriptor.hasTestScript,
+    usesPassWithNoTests: descriptor.usesPassWithNoTests,
+    testFileCount: descriptor.testFileCount
+  }));
+  return { findings, criticalPackages };
+}
+
+// src/services/doctor/checks/package-stability.ts
+function summarizeFindings(findings) {
+  return findings.slice(0, 5).map((finding) => `${finding.packagePath}: ${finding.message}`).join("; ");
+}
+function createCheckResult(name, findings, failureCodes, successMessage) {
+  if (findings.length === 0) {
+    return {
+      category: "workspace",
+      name,
+      status: "pass",
+      message: successMessage,
+      context: { findings: [] }
+    };
+  }
+  const failingFindings = findings.filter((finding) => {
+    return finding.tier === "critical" || failureCodes.has(finding.code);
+  });
+  return {
+    category: "workspace",
+    name,
+    status: failingFindings.length > 0 ? "fail" : "warn",
+    message: `${findings.length} package issue(s) found`,
+    details: summarizeFindings(findings),
+    context: { findings }
+  };
+}
+async function runPackageStabilityChecks(fs5, ctx) {
+  const policy = await loadStabilityPolicy(fs5, ctx.workspaceRoot);
+  if (!policy) {
+    return [];
+  }
+  const report = await auditWorkspacePackages(fs5, ctx.workspaceRoot, policy);
+  const criticalPackageCodes = new Set([
+    "critical-missing-build-script",
+    "critical-missing-typecheck-script",
+    "critical-missing-lint-script",
+    "critical-missing-test-script",
+    "critical-missing-test-files",
+    "critical-pass-with-no-tests"
+  ]);
+  const qualityGateFindings = report.findings.filter((finding) => criticalPackageCodes.has(finding.code));
+  const testsWithoutScript = report.findings.filter((finding) => finding.code === "tests-without-test-script");
+  const buildWithoutTests = report.findings.filter((finding) => finding.code === "build-without-tests");
+  return [
+    {
+      category: "workspace",
+      name: "Critical Package Gates",
+      status: qualityGateFindings.length > 0 ? "fail" : "pass",
+      message: qualityGateFindings.length > 0 ? `${qualityGateFindings.length} critical package gate failure(s)` : `All ${report.criticalPackages.length} critical packages meet build, lint, typecheck, and test requirements`,
+      details: qualityGateFindings.length > 0 ? summarizeFindings(qualityGateFindings) : ctx.verbose ? `Policy: ${getStabilityPolicyPath(ctx.workspaceRoot)}` : undefined,
+      context: {
+        policyPath: getStabilityPolicyPath(ctx.workspaceRoot),
+        criticalPackages: report.criticalPackages,
+        findings: qualityGateFindings
+      }
+    },
+    createCheckResult("Package Test Scripts", testsWithoutScript, new Set, "All tested packages expose a test script"),
+    createCheckResult("Buildable Packages Without Tests", buildWithoutTests, new Set, "All buildable packages have tests or explicit test scripts")
+  ];
+}
+
 // src/services/doctor/checks/workspace.ts
 var CONTRACT_PATHS = ["src/contracts", "contracts", "src/specs", "specs"];
 async function runWorkspaceChecks(fs5, ctx) {
@@ -6666,6 +6952,7 @@ async function runWorkspaceChecks(fs5, ctx) {
   results.push(await checkContractsDirectory(fs5, ctx));
   results.push(await checkContractFiles(fs5, ctx));
   results.push(await checkOutputDirectory(fs5, ctx));
+  results.push(...await runPackageStabilityChecks(fs5, ctx));
   return results;
 }
 function checkMonorepoStatus(ctx) {
@@ -6847,12 +7134,15 @@ async function checkOutputDirectory(fs5, ctx) {
         details: ctx.verbose ? `Resolved to: ${outputPath}` : undefined
       };
     }
-    if (ctx.isMonorepo && ctx.packageRoot === ctx.workspaceRoot && !config.outputDir) {
+    const isDefaultWorkspaceOutput = outputDir === "./src" || outputDir === "src";
+    const usesPackageScopedConfig = Array.isArray(config.packages) && config.packages.length > 0;
+    if (ctx.isMonorepo && ctx.packageRoot === ctx.workspaceRoot && isDefaultWorkspaceOutput && (usesPackageScopedConfig || configInfo.level === "workspace")) {
       return {
         category: "workspace",
         name: "Output Directory",
         status: "pass",
-        message: "Monorepo root detected (using package directories)"
+        message: "Monorepo root detected (using package directories)",
+        details: ctx.verbose ? `Resolved default output to packages via ${configInfo.path}` : undefined
       };
     }
     return {
@@ -7005,8 +7295,9 @@ async function checkApiKey(fs5, ctx, prompts) {
   }
 }
 // src/services/doctor/checks/layers.ts
-async function runLayerChecks(fs5, _ctx) {
+async function runLayerChecks(fs5, ctx) {
   const results = [];
+  const policy = await loadStabilityPolicy(fs5, ctx.workspaceRoot);
   const discovery = await discoverLayers({
     fs: fs5,
     logger: {
@@ -7027,7 +7318,7 @@ async function runLayerChecks(fs5, _ctx) {
   }, {});
   results.push(checkHasFeatures(discovery.stats.features));
   results.push(checkHasExamples(discovery.stats.examples));
-  results.push(checkFeatureOwners(discovery.inventory.features));
+  results.push(checkFeatureOwners(discovery.inventory.features, policy, ctx));
   results.push(checkExampleEntrypoints(discovery.inventory.examples));
   results.push(checkWorkspaceConfigs(discovery.inventory.workspaceConfigs));
   return results;
@@ -7066,27 +7357,43 @@ function checkHasExamples(count) {
     details: "Create an example.ts file to package reusable templates"
   };
 }
-function checkFeatureOwners(features) {
+function checkFeatureOwners(features, policy, ctx) {
   const missingOwners = [];
+  const criticalMissingOwners = [];
   for (const [key, feature] of features) {
-    if (!feature.owners?.length) {
-      missingOwners.push(key);
+    const hasOwnerMetadata = Boolean(feature.owners?.length) || /owners\s*:\s*(?!\[\s*\])/.test(feature.sourceBlock ?? "");
+    if (!hasOwnerMetadata) {
+      if (isCriticalFeatureKey(key, policy)) {
+        criticalMissingOwners.push(key);
+      } else {
+        missingOwners.push(key);
+      }
     }
   }
-  if (missingOwners.length === 0) {
+  if (criticalMissingOwners.length === 0 && missingOwners.length === 0) {
     return {
       category: "layers",
       name: "Feature Owners",
       status: features.size > 0 ? "pass" : "skip",
-      message: features.size > 0 ? "All features have owners defined" : "No features to check"
+      message: features.size > 0 ? "All features have owners defined" : "No features to check",
+      context: features.size > 0 ? {
+        policyPath: policy ? getStabilityPolicyPath(ctx.workspaceRoot) : undefined,
+        criticalMissingFeatures: [],
+        missingFeatures: []
+      } : undefined
     };
   }
   return {
     category: "layers",
     name: "Feature Owners",
-    status: "warn",
-    message: `${missingOwners.length} feature(s) missing owners`,
-    details: `Features: ${missingOwners.slice(0, 3).join(", ")}${missingOwners.length > 3 ? "..." : ""}`
+    status: criticalMissingOwners.length > 0 ? "fail" : "warn",
+    message: criticalMissingOwners.length > 0 ? `${criticalMissingOwners.length} critical feature(s) missing owners` : `${missingOwners.length} feature(s) missing owners`,
+    details: criticalMissingOwners.length > 0 ? `Critical features: ${criticalMissingOwners.join(", ")}` : `Features: ${missingOwners.slice(0, 3).join(", ")}${missingOwners.length > 3 ? "..." : ""}`,
+    context: {
+      policyPath: policy ? getStabilityPolicyPath(ctx.workspaceRoot) : undefined,
+      criticalMissingFeatures: criticalMissingOwners,
+      missingFeatures: missingOwners
+    }
   };
 }
 function checkExampleEntrypoints(examples) {
@@ -7623,7 +7930,7 @@ async function runDoctorChecks(adapters, options) {
   const result = await runDoctor(adapters, {
     workspaceRoot,
     skipAi: true,
-    categories: ["cli", "config", "deps", "workspace"]
+    categories: ["cli", "config", "deps", "workspace", "layers"]
   });
   for (const check of result.checks) {
     if (check.status === "fail") {
@@ -7632,7 +7939,7 @@ async function runDoctorChecks(adapters, options) {
         severity: "error",
         message: `${check.name}: ${check.message}`,
         category: "doctor",
-        context: { details: check.details }
+        context: { details: check.details, ...check.context ?? {} }
       });
     } else if (check.status === "warn") {
       issues.push({
@@ -7640,7 +7947,7 @@ async function runDoctorChecks(adapters, options) {
         severity: "warning",
         message: `${check.name}: ${check.message}`,
         category: "doctor",
-        context: { details: check.details }
+        context: { details: check.details, ...check.context ?? {} }
       });
     }
   }
@@ -8577,7 +8884,7 @@ init_config();
 // src/services/drift.ts
 import path4 from "path";
 import { mkdtemp, rm as rm3 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
+import { tmpdir as tmpdir3 } from "node:os";
 
 // src/services/generate-artifacts.ts
 import path3 from "path";
@@ -8737,7 +9044,7 @@ async function generateArtifacts(adapters, contractsDir, generatedDir, rootPath)
 
 // src/services/drift.ts
 async function detectDrift(adapters, contractsDir, generatedDir) {
-  const tempDir = await mkdtemp(path4.join(tmpdir2(), "contractspec-drift-"));
+  const tempDir = await mkdtemp(path4.join(tmpdir3(), "contractspec-drift-"));
   try {
     await generateArtifacts(adapters, contractsDir, tempDir);
     const differences = [];
@@ -16838,20 +17145,36 @@ function formatAsJson(result, options = {}) {
     line: issue.line,
     details: issue.context
   }));
+  const pass = result.categories.filter((category) => category.passed).length;
   const fail = result.totalErrors;
   const warn = result.totalWarnings;
+  const note = result.totalNotes;
   const output = {
     schemaVersion: "1.0",
+    success: result.success,
     checks,
+    categories: result.categories.map((category) => ({
+      category: category.category,
+      label: category.label,
+      passed: category.passed,
+      errors: category.errors,
+      warnings: category.warnings,
+      notes: category.notes,
+      durationMs: category.durationMs
+    })),
     drift: {
       status: driftResult?.hasDrift ? "detected" : "none",
       files: driftResult?.files ?? []
     },
     summary: {
-      pass: 0,
+      pass,
       fail,
       warn,
-      total: fail + warn,
+      note,
+      total: pass + fail + warn + note,
+      totalErrors: result.totalErrors,
+      totalWarnings: result.totalWarnings,
+      totalNotes: result.totalNotes,
       durationMs: result.durationMs,
       timestamp: result.timestamp
     },

package/dist/services/doctor/checks/layers.d.ts

@@ -8,4 +8,4 @@ import type { CheckContext, CheckResult } from '../types';
 /**
  * Run all layer health checks.
  */
-export declare function runLayerChecks(fs: FsAdapter, _ctx: CheckContext): Promise<CheckResult[]>;
+export declare function runLayerChecks(fs: FsAdapter, ctx: CheckContext): Promise<CheckResult[]>;

package/dist/services/doctor/checks/layers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/doctor/checks/package-stability.d.ts

@@ -0,0 +1,3 @@
+import type { FsAdapter } from '../../../ports/fs';
+import type { CheckContext, CheckResult } from '../types';
+export declare function runPackageStabilityChecks(fs: FsAdapter, ctx: CheckContext): Promise<CheckResult[]>;

package/dist/services/doctor/checks/package-stability.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/doctor/checks/workspace.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/doctor/types.d.ts

@@ -53,6 +53,8 @@ export interface CheckResult {
     fix?: FixAction;
     /** Additional details for debugging. */
     details?: string;
+    /** Structured context for machine-readable consumers. */
+    context?: Record<string, unknown>;
 }
 /**
  * Options for running the doctor.

package/dist/services/stability/package-audit.d.ts

@@ -0,0 +1,25 @@
+import type { FsAdapter } from '../../ports/fs';
+import type { StabilityPolicy, StabilityTier } from './policy';
+export type PackageAuditFindingCode = 'critical-missing-build-script' | 'critical-missing-typecheck-script' | 'critical-missing-lint-script' | 'critical-missing-test-script' | 'critical-missing-test-files' | 'critical-pass-with-no-tests' | 'tests-without-test-script' | 'build-without-tests';
+export interface PackageAuditFinding {
+    code: PackageAuditFindingCode;
+    tier: StabilityTier;
+    packageName: string;
+    packagePath: string;
+    message: string;
+}
+export interface CriticalPackageStatus {
+    packageName: string;
+    packagePath: string;
+    hasBuildScript: boolean;
+    hasTypecheckScript: boolean;
+    hasLintScript: boolean;
+    hasTestScript: boolean;
+    usesPassWithNoTests: boolean;
+    testFileCount: number;
+}
+export interface PackageAuditReport {
+    findings: PackageAuditFinding[];
+    criticalPackages: CriticalPackageStatus[];
+}
+export declare function auditWorkspacePackages(fs: FsAdapter, workspaceRoot: string, policy: StabilityPolicy): Promise<PackageAuditReport>;

package/dist/services/stability/policy.d.ts

@@ -0,0 +1,12 @@
+import type { FsAdapter } from '../../ports/fs';
+export type StabilityTier = 'critical' | 'non-critical';
+export interface StabilityPolicy {
+    version: number;
+    criticalPackages: string[];
+    criticalFeatureKeys: string[];
+    smokePackages: string[];
+}
+export declare function loadStabilityPolicy(fs: FsAdapter, workspaceRoot: string): Promise<StabilityPolicy | undefined>;
+export declare function getPackageTier(relativePackagePath: string, policy?: StabilityPolicy): StabilityTier;
+export declare function isCriticalFeatureKey(featureKey: string, policy?: StabilityPolicy): boolean;
+export declare function getStabilityPolicyPath(workspaceRoot: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractspec/bundle.workspace",
-  "version": "3.7.0",
+  "version": "3.7.3",
   "description": "Workspace utilities for monorepo development",
   "keywords": [
     "contractspec",
@@ -33,14 +33,14 @@
   "dependencies": {
     "@ai-sdk/anthropic": "3.0.58",
     "@ai-sdk/openai": "3.0.41",
-    "@contractspec/lib.ai-agent": "7.0.0",
-    "@contractspec/lib.ai-providers": "3.7.0",
-    "@contractspec/lib.contracts-spec": "3.7.0",
-    "@contractspec/lib.contracts-integrations": "3.7.0",
-    "@contractspec/lib.contracts-transformers": "3.7.0",
-    "@contractspec/lib.source-extractors": "2.7.0",
-    "@contractspec/module.workspace": "3.7.0",
-    "@contractspec/lib.utils-typescript": "3.7.0",
+    "@contractspec/lib.ai-agent": "7.0.3",
+    "@contractspec/lib.ai-providers": "3.7.3",
+    "@contractspec/lib.contracts-spec": "3.7.3",
+    "@contractspec/lib.contracts-integrations": "3.7.3",
+    "@contractspec/lib.contracts-transformers": "3.7.3",
+    "@contractspec/lib.source-extractors": "2.7.3",
+    "@contractspec/module.workspace": "3.7.3",
+    "@contractspec/lib.utils-typescript": "3.7.3",
     "ai": "6.0.116",
     "chalk": "^5.6.2",
     "chokidar": "^5.0.0",
@@ -52,12 +52,12 @@
     "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@contractspec/tool.typescript": "3.7.0",
+    "@contractspec/tool.typescript": "3.7.3",
     "@types/bun": "^1.3.10",
     "@types/micromatch": "^4.0.10",
     "@types/node": "^25.3.5",
     "typescript": "^5.9.3",
-    "@contractspec/tool.bun": "3.7.0"
+    "@contractspec/tool.bun": "3.7.3"
   },
   "exports": {
     ".": {