@devtrack-solution/codesdd 1.2.3 → 1.2.4

package/dist/core/sdd/agent-runtime-contract.js

@@ -0,0 +1,200 @@
+import { toJSONSchema, z } from 'zod';
+const JSON_SCHEMA_DRAFT = 'https://json-schema.org/draft/2020-12/schema';
+const FEATURE_REF_PATTERN = /^FEAT-\d{4}$/;
+export const agentRuntimeProviderSchema = z.enum(['deepagents', 'codex', 'opencode']);
+export const agentRuntimeModeSchema = z.enum(['read-only', 'plan', 'validate', 'apply-sandbox', 'apply-approved']);
+export const agentRuntimeSandboxSchema = z.enum(['read-only', 'workspace-write', 'danger-full-access']);
+export const agentRuntimeStatusSchema = z.enum(['planned', 'blocked']);
+export const opencodeExecutionStatusSchema = z.enum([
+    'planned',
+    'skipped',
+    'blocked',
+    'running',
+    'completed',
+    'failed',
+]);
+const agentRuntimeCommandSchema = z.object({
+    executable: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    stdin: z.string().optional(),
+});
+const agentRuntimeEvidenceArtifactSchema = z.object({
+    kind: z.string().min(1),
+    ref: z.string().min(1),
+    path: z.string().min(1).optional(),
+    sha256: z.string().min(1).optional(),
+});
+const agentRuntimeRiskSchema = z.object({
+    id: z.string().min(1),
+    severity: z.enum(['low', 'medium', 'high', 'critical']),
+    summary: z.string().min(1),
+    mitigation: z.string().min(1).optional(),
+});
+export const agentRuntimeCommandPlanRequestSchema = z.object({
+    schema_version: z.literal(1).default(1),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    provider: agentRuntimeProviderSchema,
+    mode: agentRuntimeModeSchema.default('plan'),
+    instruction: z.string().min(1),
+    cwd: z.string().min(1).default('.'),
+    model: z.string().min(1).optional(),
+    sandbox: agentRuntimeSandboxSchema.default('read-only'),
+    output_schema: z.string().min(1).optional(),
+    output_last_message: z.string().min(1).optional(),
+    agent: z.string().min(1).optional(),
+    session: z.string().min(1).optional(),
+    files: z.array(z.string().min(1)).default([]),
+    approval_grants: z.array(z.enum(['maintainer', 'architecture-board', 'security'])).default([]),
+});
+export const agentRuntimeCommandPlanSchema = z.object({
+    schema_version: z.literal(1),
+    created_at: z.string().datetime(),
+    status: agentRuntimeStatusSchema,
+    request: agentRuntimeCommandPlanRequestSchema,
+    provider: agentRuntimeProviderSchema,
+    command: agentRuntimeCommandSchema.optional(),
+    evidence_contract: z.enum(['agent-runtime-v2/deepagents', 'agent-runtime-v2/codex-exec', 'agent-runtime-v2/opencode-run']),
+    structured_output: z.boolean(),
+    reasons: z.array(z.string()).default([]),
+    policy: z.object({
+        direct_state_write_allowed: z.literal(false),
+        requires_codesdd_finalize: z.literal(true),
+        mutating_modes_require_approval: z.literal(true),
+    }),
+});
+export const opencodeExecutionEvidenceSchema = z.object({
+    schema_version: z.literal(1),
+    contract: z.literal('agent-runtime-v2/opencode-run'),
+    provider: z.literal('opencode'),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    run_id: z.string().min(1),
+    created_at: z.string().datetime(),
+    mode: agentRuntimeModeSchema,
+    status: opencodeExecutionStatusSchema,
+    command: agentRuntimeCommandSchema.extend({
+        executable: z.literal('opencode'),
+    }),
+    command_plan_ref: z.string().min(1).optional(),
+    cwd: z.string().min(1).default('.'),
+    exit_code: z.number().int().nullable().default(null),
+    started_at: z.string().datetime().optional(),
+    completed_at: z.string().datetime().optional(),
+    duration_ms: z.number().int().nonnegative().optional(),
+    structured_output: z.record(z.string(), z.unknown()).default({}),
+    stdout_excerpt: z.string().max(8000).optional(),
+    stderr_excerpt: z.string().max(8000).optional(),
+    artifacts: z.array(agentRuntimeEvidenceArtifactSchema).default([]),
+    validations: z.array(z.string().min(1)).default([]),
+    redactions: z.array(z.string().min(1)).default([]),
+    risks: z.array(agentRuntimeRiskSchema).default([]),
+    policy: z.object({
+        direct_state_write_allowed: z.literal(false),
+        requires_codesdd_finalize: z.literal(true),
+        raw_secret_output_allowed: z.literal(false),
+        transcript_storage: z.enum(['forbidden', 'redacted-excerpts-only']).default('redacted-excerpts-only'),
+    }),
+    finalize_intent: z.boolean().default(false),
+});
+export function buildAgentRuntimeCommandPlan(request, createdAt = new Date().toISOString()) {
+    const parsed = agentRuntimeCommandPlanRequestSchema.parse(request);
+    const reasons = collectPolicyReasons(parsed);
+    const status = reasons.length > 0 ? 'blocked' : 'planned';
+    const command = status === 'planned' ? buildCommand(parsed) : undefined;
+    return agentRuntimeCommandPlanSchema.parse({
+        schema_version: 1,
+        created_at: createdAt,
+        status,
+        request: parsed,
+        provider: parsed.provider,
+        command,
+        evidence_contract: evidenceContract(parsed.provider),
+        structured_output: true,
+        reasons,
+        policy: {
+            direct_state_write_allowed: false,
+            requires_codesdd_finalize: true,
+            mutating_modes_require_approval: true,
+        },
+    });
+}
+export function buildOpenCodeExecutionEvidence(evidence) {
+    return opencodeExecutionEvidenceSchema.parse(evidence);
+}
+export function buildAgentRuntimeJsonSchemas() {
+    return {
+        'agent-runtime-command-plan.yaml': {
+            ...toJSONSchema(agentRuntimeCommandPlanSchema),
+            $schema: JSON_SCHEMA_DRAFT,
+            title: 'CodeSDD Agent Runtime Command Plan',
+            description: 'Provider-normalized command plan for DeepAgents, Codex exec, and OpenCode run agent runtimes.',
+        },
+        'agent-runtime-opencode-run-evidence.yaml': {
+            ...toJSONSchema(opencodeExecutionEvidenceSchema),
+            $schema: JSON_SCHEMA_DRAFT,
+            title: 'CodeSDD Agent Runtime OpenCode Run Evidence',
+            description: 'Machine-readable OpenCode run evidence with redacted excerpts, artifacts, validations, and finalize policy.',
+        },
+    };
+}
+function collectPolicyReasons(request) {
+    const reasons = [];
+    const mutating = request.mode === 'apply-sandbox' || request.mode === 'apply-approved';
+    if (mutating && request.approval_grants.length === 0) {
+        reasons.push(`Mode ${request.mode} requires explicit approval evidence before agent execution.`);
+    }
+    if (request.provider !== 'deepagents' && request.mode === 'apply-approved') {
+        reasons.push('Codex and OpenCode apply-approved execution is not enabled until plugin evidence ingestion is complete.');
+    }
+    if (request.provider === 'codex' && request.sandbox === 'danger-full-access') {
+        reasons.push('Codex danger-full-access sandbox is forbidden by the default CodeSDD agent runtime contract.');
+    }
+    return reasons;
+}
+function buildCommand(request) {
+    if (request.provider === 'deepagents') {
+        return {
+            executable: 'codesdd',
+            args: ['sdd', 'agent', 'run', request.feature_ref, '--provider', 'deepagents', '--mode', request.mode],
+        };
+    }
+    if (request.provider === 'codex') {
+        const args = ['exec', '--json', '--cd', request.cwd, '--sandbox', request.sandbox];
+        if (request.model)
+            args.push('--model', request.model);
+        if (request.output_schema)
+            args.push('--output-schema', request.output_schema);
+        if (request.output_last_message)
+            args.push('--output-last-message', request.output_last_message);
+        for (const file of request.files) {
+            args.push('--image', file);
+        }
+        args.push(request.instruction);
+        return {
+            executable: 'codex',
+            args,
+        };
+    }
+    const args = ['run', '--format', 'json', '--dir', request.cwd];
+    if (request.model)
+        args.push('--model', request.model);
+    if (request.agent)
+        args.push('--agent', request.agent);
+    if (request.session)
+        args.push('--session', request.session);
+    for (const file of request.files) {
+        args.push('--file', file);
+    }
+    args.push(request.instruction);
+    return {
+        executable: 'opencode',
+        args,
+    };
+}
+function evidenceContract(provider) {
+    if (provider === 'codex')
+        return 'agent-runtime-v2/codex-exec';
+    if (provider === 'opencode')
+        return 'agent-runtime-v2/opencode-run';
+    return 'agent-runtime-v2/deepagents';
+}
+//# sourceMappingURL=agent-runtime-contract.js.map

package/dist/core/sdd/allocator-recovery.d.ts

@@ -0,0 +1,14 @@
+import type { ArtifactIdAllocatorState, ArtifactIdAllocatorType } from './artifact-id-allocator.js';
+export interface AllocatorRecoveryFinding {
+    code: 'counter-behind-reservations' | 'branch-lag';
+    message: string;
+    ref?: string;
+}
+export interface AllocatorRecoveryPlan {
+    recovered_counters: Partial<Record<ArtifactIdAllocatorType, number>>;
+    findings: AllocatorRecoveryFinding[];
+}
+export declare function buildAllocatorRecoveryPlan(state: ArtifactIdAllocatorState, options?: {
+    local_revisions?: Record<string, number>;
+}): AllocatorRecoveryPlan;
+//# sourceMappingURL=allocator-recovery.d.ts.map

package/dist/core/sdd/allocator-recovery.js

@@ -0,0 +1,30 @@
+export function buildAllocatorRecoveryPlan(state, options = {}) {
+    const recovered = { ...state.counters };
+    const findings = [];
+    for (const reservation of state.reservations) {
+        const current = recovered[reservation.artifact_type] ?? 0;
+        if (reservation.sequence > current) {
+            recovered[reservation.artifact_type] = reservation.sequence;
+            findings.push({
+                code: 'counter-behind-reservations',
+                message: `${reservation.artifact_type} counter recovered from ${current} to ${reservation.sequence}.`,
+                ref: reservation.artifact_id,
+            });
+        }
+    }
+    for (const [artifactId, remoteRevision] of Object.entries(state.canonical_revisions)) {
+        const localRevision = options.local_revisions?.[artifactId] ?? remoteRevision;
+        if (localRevision < remoteRevision) {
+            findings.push({
+                code: 'branch-lag',
+                message: `${artifactId} local revision ${localRevision} is behind canonical revision ${remoteRevision}.`,
+                ref: artifactId,
+            });
+        }
+    }
+    return {
+        recovered_counters: recovered,
+        findings,
+    };
+}
+//# sourceMappingURL=allocator-recovery.js.map

package/dist/core/sdd/allocator-security.d.ts

@@ -0,0 +1,18 @@
+import type { ArtifactIdAllocatorState, ArtifactIdAllocatorType } from './artifact-id-allocator.js';
+export interface AllocatorSecurityPolicy {
+    max_reservations_per_tenant?: number;
+    max_reservations_per_type?: Partial<Record<ArtifactIdAllocatorType, number>>;
+    replay_window_ms?: number;
+}
+export interface AllocatorSecurityDecision {
+    allowed: boolean;
+    code: 'allowed' | 'tenant-quota-exceeded' | 'type-quota-exceeded' | 'replay-window-expired';
+    reason: string;
+}
+export declare function evaluateAllocatorSecurityPolicy(state: ArtifactIdAllocatorState, input: {
+    tenant_id?: string;
+    artifact_type: ArtifactIdAllocatorType;
+    idempotency_key: string;
+    now: string;
+}, policy: AllocatorSecurityPolicy): AllocatorSecurityDecision;
+//# sourceMappingURL=allocator-security.d.ts.map

package/dist/core/sdd/allocator-security.js

@@ -0,0 +1,36 @@
+export function evaluateAllocatorSecurityPolicy(state, input, policy) {
+    if (policy.max_reservations_per_tenant !== undefined && input.tenant_id) {
+        const tenantReservations = state.reservations.filter((reservation) => reservation.tenant_id === input.tenant_id).length;
+        if (tenantReservations >= policy.max_reservations_per_tenant) {
+            return {
+                allowed: false,
+                code: 'tenant-quota-exceeded',
+                reason: `Tenant ${input.tenant_id} has reached reservation quota ${policy.max_reservations_per_tenant}.`,
+            };
+        }
+    }
+    const typeQuota = policy.max_reservations_per_type?.[input.artifact_type];
+    if (typeQuota !== undefined && (state.counters[input.artifact_type] ?? 0) >= typeQuota) {
+        return {
+            allowed: false,
+            code: 'type-quota-exceeded',
+            reason: `${input.artifact_type} reservation quota ${typeQuota} has been reached.`,
+        };
+    }
+    if (policy.replay_window_ms !== undefined) {
+        const existing = state.reservations.find((reservation) => reservation.idempotency_key === input.idempotency_key);
+        if (existing && new Date(input.now).getTime() - new Date(existing.reserved_at).getTime() > policy.replay_window_ms) {
+            return {
+                allowed: false,
+                code: 'replay-window-expired',
+                reason: `Idempotency key ${input.idempotency_key} is outside the replay window.`,
+            };
+        }
+    }
+    return {
+        allowed: true,
+        code: 'allowed',
+        reason: 'Allocator security policy allows the request.',
+    };
+}
+//# sourceMappingURL=allocator-security.js.map

package/dist/core/sdd/api-foundation-baseline.d.ts

@@ -0,0 +1,111 @@
+export declare const CODESDD_API_FOUNDATION_SHARED_BASELINE: {
+    readonly id: "foundation-api-shared-baseline";
+    readonly version: 1;
+    readonly foundation_reference: "devtrack-foundation-api";
+};
+export declare const CODESDD_API_SHARED_BASELINE_REQUIREMENTS: readonly ["openapi-swagger-docs", "env-example", "package-json-scripts", "application-usecase-boundary", "dto-validation", "structured-api-errors", "auth-authz-planning", "route-and-usecase-tests"];
+export declare const CODESDD_API_SHARED_BASELINE_QUALITY_GATES: readonly ["openapi-docs-required", "env-example-required", "package-scripts-required", "application-usecase-route-boundary", "dto-validation-required", "structured-error-contract-required", "authz-planning-required", "route-usecase-tests-required"];
+export type CodeSddApiSharedBaselineRequirementId = (typeof CODESDD_API_SHARED_BASELINE_REQUIREMENTS)[number];
+export interface CodeSddApiSharedBaselineRequirement {
+    id: CodeSddApiSharedBaselineRequirementId;
+    title: string;
+    foundation_reference: typeof CODESDD_API_FOUNDATION_SHARED_BASELINE.foundation_reference;
+    severity: 'P0';
+    phase: 'planning' | 'scaffold' | 'implementation' | 'validation';
+    quality_gate: (typeof CODESDD_API_SHARED_BASELINE_QUALITY_GATES)[number];
+    contract_rule_refs: readonly string[];
+    required_artifacts: readonly string[];
+    required_evidence: readonly string[];
+}
+export declare const CODESDD_API_SHARED_BASELINE_REQUIREMENT_DEFINITIONS: {
+    'openapi-swagger-docs': {
+        id: "openapi-swagger-docs";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "scaffold";
+        quality_gate: "openapi-docs-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'env-example': {
+        id: "env-example";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "scaffold";
+        quality_gate: "env-example-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'package-json-scripts': {
+        id: "package-json-scripts";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "scaffold";
+        quality_gate: "package-scripts-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'application-usecase-boundary': {
+        id: "application-usecase-boundary";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "implementation";
+        quality_gate: "application-usecase-route-boundary";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'dto-validation': {
+        id: "dto-validation";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "implementation";
+        quality_gate: "dto-validation-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'structured-api-errors': {
+        id: "structured-api-errors";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "implementation";
+        quality_gate: "structured-error-contract-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'auth-authz-planning': {
+        id: "auth-authz-planning";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "planning";
+        quality_gate: "authz-planning-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+    'route-and-usecase-tests': {
+        id: "route-and-usecase-tests";
+        title: string;
+        foundation_reference: "devtrack-foundation-api";
+        severity: "P0";
+        phase: "validation";
+        quality_gate: "route-usecase-tests-required";
+        contract_rule_refs: string[];
+        required_artifacts: string[];
+        required_evidence: string[];
+    };
+};
+export declare function getCodeSddApiSharedBaselineRequirements(): CodeSddApiSharedBaselineRequirement[];
+//# sourceMappingURL=api-foundation-baseline.d.ts.map

package/dist/core/sdd/api-foundation-baseline.js

@@ -0,0 +1,151 @@
+export const CODESDD_API_FOUNDATION_SHARED_BASELINE = {
+    id: 'foundation-api-shared-baseline',
+    version: 1,
+    foundation_reference: 'devtrack-foundation-api',
+};
+export const CODESDD_API_SHARED_BASELINE_REQUIREMENTS = [
+    'openapi-swagger-docs',
+    'env-example',
+    'package-json-scripts',
+    'application-usecase-boundary',
+    'dto-validation',
+    'structured-api-errors',
+    'auth-authz-planning',
+    'route-and-usecase-tests',
+];
+export const CODESDD_API_SHARED_BASELINE_QUALITY_GATES = [
+    'openapi-docs-required',
+    'env-example-required',
+    'package-scripts-required',
+    'application-usecase-route-boundary',
+    'dto-validation-required',
+    'structured-error-contract-required',
+    'authz-planning-required',
+    'route-usecase-tests-required',
+];
+export const CODESDD_API_SHARED_BASELINE_REQUIREMENT_DEFINITIONS = {
+    'openapi-swagger-docs': {
+        id: 'openapi-swagger-docs',
+        title: 'Swagger/OpenAPI documentation',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'scaffold',
+        quality_gate: 'openapi-docs-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-OPENAPI-001', 'DTAPI-P0-TOOL-BASELINE-001'],
+        required_artifacts: ['package.json', '.env.example', 'src/main.ts', 'src/presentation/**'],
+        required_evidence: [
+            '@nestjs/swagger dependency is present',
+            'DocumentBuilder and SwaggerModule bootstrap /docs',
+            'controllers and DTOs include Swagger decorators',
+        ],
+    },
+    'env-example': {
+        id: 'env-example',
+        title: '.env.example placeholder contract',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'scaffold',
+        quality_gate: 'env-example-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-TOOL-BASELINE-001'],
+        required_artifacts: ['.env.example'],
+        required_evidence: [
+            'runtime variables have placeholder values',
+            'Swagger server settings are represented when OpenAPI is enabled',
+            'no secret or credential values are emitted',
+        ],
+    },
+    'package-json-scripts': {
+        id: 'package-json-scripts',
+        title: 'Operational package scripts and runtime bootstrap',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'scaffold',
+        quality_gate: 'package-scripts-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-TOOL-BASELINE-001', 'DTAPI-P0-RUNTIME-SCRIPTS-001'],
+        required_artifacts: ['package.json', 'scripts/cleanup.sh', 'scripts/kill-port.js'],
+        required_evidence: [
+            'build, start, start:dev, start:prod, lint, test, coverage, e2e, cleanup, and cleanup:install scripts are present',
+            'cleanup removes dependency installs, build outputs, caches, lockfiles, and compilation residue unless an ADR preserves a canonical lockfile',
+            'start and start:dev run a configured-port preflight that terminates the listener before Nest starts',
+            'scripts can be invoked with npm or pnpm, while nested package-script calls use npm run/npm install so Docker images do not require pnpm',
+            'migration scripts are present when persistence is included',
+        ],
+    },
+    'application-usecase-boundary': {
+        id: 'application-usecase-boundary',
+        title: 'Application use-case and input-port boundary',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'implementation',
+        quality_gate: 'application-usecase-route-boundary',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-USECASE-001', 'DTAPI-P0-TOOL-BASELINE-001'],
+        required_artifacts: ['src/application/**', 'src/presentation/**'],
+        required_evidence: [
+            'each user-facing route calls an application input port',
+            'each input port delegates business orchestration to a use case',
+        ],
+    },
+    'dto-validation': {
+        id: 'dto-validation',
+        title: 'DTO validation and documented request shape',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'implementation',
+        quality_gate: 'dto-validation-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-OPENAPI-001'],
+        required_artifacts: ['src/main.ts', 'src/presentation/**/dtos/**'],
+        required_evidence: [
+            'global validation pipe is configured',
+            'request DTOs use class-validator decorators',
+            'DTOs include Swagger property metadata',
+        ],
+    },
+    'structured-api-errors': {
+        id: 'structured-api-errors',
+        title: 'Structured API error responses',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'implementation',
+        quality_gate: 'structured-error-contract-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-TOOL-BASELINE-001'],
+        required_artifacts: ['src/presentation/dtos/api-error-response.dto.ts', 'src/presentation/**'],
+        required_evidence: [
+            'controllers document error responses',
+            'error DTO avoids leaking internal provider or secret data',
+        ],
+    },
+    'auth-authz-planning': {
+        id: 'auth-authz-planning',
+        title: 'Authentication and authorization planning',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'planning',
+        quality_gate: 'authz-planning-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P0-AUTH-PLAN-001', 'DTAPI-P0-TOOL-BASELINE-001'],
+        required_artifacts: ['FEAT quality evidence', 'src/presentation/**/guards/**'],
+        required_evidence: [
+            'route public/protected decision is recorded',
+            'guard, decorator, role, permission, or policy choice is recorded',
+            'Swagger security scheme is documented for protected routes',
+        ],
+    },
+    'route-and-usecase-tests': {
+        id: 'route-and-usecase-tests',
+        title: 'Route and use-case test evidence',
+        foundation_reference: 'devtrack-foundation-api',
+        severity: 'P0',
+        phase: 'validation',
+        quality_gate: 'route-usecase-tests-required',
+        contract_rule_refs: ['DTAPI-P0-SHARED-BASELINE-001', 'DTAPI-P1-EVIDENCE-001'],
+        required_artifacts: ['test/**', 'coverage/**'],
+        required_evidence: [
+            'route/controller behavior is covered',
+            'application use-case behavior is covered',
+            'validation evidence is recorded in the FEAT quality artifact',
+        ],
+    },
+};
+export function getCodeSddApiSharedBaselineRequirements() {
+    return CODESDD_API_SHARED_BASELINE_REQUIREMENTS.map((requirementId) => CODESDD_API_SHARED_BASELINE_REQUIREMENT_DEFINITIONS[requirementId]);
+}
+//# sourceMappingURL=api-foundation-baseline.js.map