@planu/cli 4.14.1 → 5.1.1

package/dist/tools/tool-registry/group-quality-compliance.js

@@ -1,6 +1,6 @@
 import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
-import { safeLicensed, safeTracked } from '../safe-handler.js';
+import { safeGoverned, safeTracked } from '../safe-handler.js';
 import { projectIdSchema, withProject } from '../tool-registry-helpers.js';
 import { t } from '../../i18n/index.js';
 import { makeDeprecationStub } from './deprecated-stubs.js';
@@ -269,7 +269,7 @@ export function registerQualityComplianceGroupTools(s) {
             outputFormat: z.enum(['html', 'json']).optional().describe(FORMAT_DESCRIBE),
         },
         annotations: { title: 'Generate Compliance Report', readOnlyHint: true },
-    }, safeLicensed('generate_compliance_report', (args) => Promise.resolve(handleGenerateComplianceReport(args))));
+    }, safeGoverned('generate_compliance_report', (args) => Promise.resolve(handleGenerateComplianceReport(args))));
     s.registerTool('audit_log_export', {
         description: 'Export the project audit trail in CSV, JSON, or JSON-LD format. ' +
             'Supports optional date range filtering. ' +
@@ -290,7 +290,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Optional date range filter for audit entries'),
         },
         annotations: { title: 'Export Audit Log', readOnlyHint: true },
-    }, safeLicensed('audit_log_export', async (args) => handleAuditLogExport(args)));
+    }, safeGoverned('audit_log_export', async (args) => handleAuditLogExport(args)));
     s.registerTool('data_retention_policy', {
         description: 'Configure the data retention policy for the project. ' +
             'Specifies how long data should be retained and whether auto-deletion is enabled. ' +
@@ -320,7 +320,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Days before deletion to notify (default: 7)'),
         },
         annotations: { title: 'Configure Data Retention Policy', readOnlyHint: false },
-    }, safeLicensed('data_retention_policy', async (args) => handleDataRetentionPolicy(args)));
+    }, safeGoverned('data_retention_policy', async (args) => handleDataRetentionPolicy(args)));
     // ── Compliance gate ───────────────────────────────────────────────────────────
     s.registerTool('configure_compliance_gate', {
         description: 'Configure the compliance gate that runs automatically when a spec is sent to review. ' +
@@ -329,9 +329,9 @@ export function registerQualityComplianceGroupTools(s) {
             'Pro feature.',
         inputSchema: ConfigureComplianceGateSchema.shape,
         annotations: { title: 'Configure Compliance Gate', destructiveHint: false },
-    }, safeLicensed('configure_compliance_gate', async (args) => handleConfigureComplianceGate(args)));
+    }, safeGoverned('configure_compliance_gate', async (args) => handleConfigureComplianceGate(args)));
     s.registerTool('compliance_gate_status', {
-        description: 'Check the compliance gate configuration for this project. Returns the current mode and threshold. Free tool — no license required.',
+        description: 'Check the compliance gate configuration for this project. Returns the current mode and threshold.',
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root'),
         },
@@ -363,7 +363,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe(TEST_FORMAT_DESCRIBE),
         },
         annotations: { title: 'Generate Compliance Tests', readOnlyHint: true },
-    }, safeLicensed('generate_compliance_tests', async (args) => handleGenerateComplianceTests(args)));
+    }, safeGoverned('generate_compliance_tests', async (args) => handleGenerateComplianceTests(args)));
     s.registerTool('compliance_coverage_report', {
         description: 'List all compliance controls for the requested frameworks, showing their IDs, ' +
             'titles, descriptions, and matching keywords. ' +
@@ -380,7 +380,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe(COMPLIANCE_TEST_FRAMEWORK_DESCRIBE),
         },
         annotations: { title: 'Compliance Coverage Report', readOnlyHint: true },
-    }, safeLicensed('compliance_coverage_report', (args) => Promise.resolve(handleComplianceCoverageReport(args))));
+    }, safeGoverned('compliance_coverage_report', (args) => Promise.resolve(handleComplianceCoverageReport(args))));
     // ── Security ─────────────────────────────────────────────────────────────────
     s.registerTool('security_check', {
         description: t('tools.security_check.description'),
@@ -398,7 +398,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Absolute paths to code files to scan for insecure patterns'),
         },
-    }, safeLicensed('security_check', withProject((args) => handleSecurityCheck(args))));
+    }, safeGoverned('security_check', withProject((args) => handleSecurityCheck(args))));
     // ── Audit trail ──────────────────────────────────────────────────────────────
     s.registerTool('audit_trail', {
         description: 'Query the immutable audit log for a project. Supports filtering by specId, userId, eventType, and date range. Returns events with SHA-256 chain integrity status.',
@@ -430,7 +430,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Maximum number of events to return (default: 100, max: 1000).'),
         },
-    }, safeLicensed('audit_trail', withProject((args) => handleAuditTrail(args))));
+    }, safeGoverned('audit_trail', withProject((args) => handleAuditTrail(args))));
     s.registerTool('generate_attestation', {
         description: 'Generate a compliance attestation document for a specific spec. Includes full audit history, chain integrity verification, and event summary for SOC2/HIPAA/ISO27001 audits.',
         annotations: { readOnlyHint: true },
@@ -442,7 +442,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(500)
                 .describe('Spec ID to generate attestation for (e.g. SPEC-042).'),
         },
-    }, safeLicensed('generate_attestation', withProject((args) => handleGenerateAttestation(args))));
+    }, safeGoverned('generate_attestation', withProject((args) => handleGenerateAttestation(args))));
     s.registerTool('export_audit_trail', {
         description: 'Export the EU AI Act Article 12 immutable audit trail for every Planu tool invocation. ' +
             'Supports filtering by project, date range, or spec. Verifies SHA-256 chain integrity. ' +
@@ -478,7 +478,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Maximum number of entries to return.'),
         },
-    }, safeLicensed('export_audit_trail', (args) => Promise.resolve(handleExportAuditTrail(args))));
+    }, safeGoverned('export_audit_trail', (args) => Promise.resolve(handleExportAuditTrail(args))));
     // ── Schema parity ────────────────────────────────────────────────────────────
     s.registerTool('audit_schema_type_parity', {
         description: 'Scans all register-*.ts tool files in the project for mismatches between Zod optional ' +
@@ -493,7 +493,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(4096)
                 .describe('Absolute path to the project root to scan. The auditor will look for src/tools/register-*.ts and src/types/**/*.ts.'),
         },
-    }, safeLicensed('audit_schema_type_parity', async (args) => handleAuditSchemaParity(args)));
+    }, safeGoverned('audit_schema_type_parity', async (args) => handleAuditSchemaParity(args)));
     s.registerTool('fix_schema_type_parity', {
         description: 'Automatically fixes Zod/TypeScript optional parity issues found by audit_schema_type_parity. ' +
             'Adds "?" to TypeScript type definitions for fields that are marked .optional() in Zod schemas. ' +
@@ -510,7 +510,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .default(true)
                 .describe('When true (default), shows what would change without writing any files. Set to false to apply the fixes.'),
         },
-    }, safeLicensed('fix_schema_type_parity', async (args) => handleFixSchemaParity(args)));
+    }, safeGoverned('fix_schema_type_parity', async (args) => handleFixSchemaParity(args)));
     // ── Schema generator ─────────────────────────────────────────────────────────
     s.registerTool('generate_validation_schema', {
         description: 'Analyze a spec and generate validation schema code (Zod, Yup, or Valibot). ' +
@@ -605,7 +605,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Spec ID to analyze (e.g., "SPEC-001"), or "all" to analyze every spec in the project'),
         },
         annotations: { title: 'Spec Test Coverage', readOnlyHint: true },
-    }, safeLicensed('spec_coverage', withProject((args) => handleSpecCoverage(args))));
+    }, safeGoverned('spec_coverage', withProject((args) => handleSpecCoverage(args))));
     // ── Eval skill ───────────────────────────────────────────────────────────────
     s.registerTool('eval_skill', {
         description: 'Evaluate the quality of a Claude skill file against a set of test scenarios. ' +
@@ -838,7 +838,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Evaluation mode: strict (default) requires score >=70; lenient requires >=60'),
         },
         outputSchema: CheckReadinessOutputSchema,
-    }, safeLicensed('check_readiness', withProject((args) => handleCheckReadiness(args))));
+    }, safeGoverned('check_readiness', withProject((args) => handleCheckReadiness(args))));
     // ── SPEC-961: Architecture lint ─────────────────────────────────────────────
     s.registerTool('architecture_lint', {
         description: 'Scan project codebase for Clean Architecture and SOLID principle violations. Reports handler bloat, layer violations, and missing repository patterns.',
@@ -857,7 +857,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Glob patterns to exclude (default: node_modules, .git, dist)'),
             failFast: z.boolean().optional().describe('Stop on first error (default: false)'),
         },
-    }, safeLicensed('architecture_lint', withProject((args) => handleArchitectureLint(args))));
+    }, safeGoverned('architecture_lint', withProject((args) => handleArchitectureLint(args))));
     // ── SPEC-962: SOLID check ───────────────────────────────────────────────────
     s.registerTool('solid_check', {
         description: 'Scan project codebase for SOLID principle violations. Reports SRP, OCP, LSP, ISP, and DIP issues with a scored report (0-100) and per-principle breakdown.',
@@ -870,7 +870,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Glob patterns to exclude (default: node_modules, .git, dist)'),
             failFast: z.boolean().optional().describe('Stop on first error (default: false)'),
         },
-    }, safeLicensed('solid_check', withProject((args) => handleSolidCheck({
+    }, safeGoverned('solid_check', withProject((args) => handleSolidCheck({
         projectPath: args.projectPath,
         exclude: args.exclude,
         failFast: args.failFast,
@@ -917,7 +917,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Fail on first failing endpoint (default: false)'),
         },
-    }, safeLicensed('verify_integrations', withProject((args) => handleVerifyIntegrations({
+    }, safeGoverned('verify_integrations', withProject((args) => handleVerifyIntegrations({
         projectPath: args.projectPath,
         endpoints: args.endpoints,
         timeout: args.timeout,
@@ -954,7 +954,7 @@ export function registerQualityComplianceGroupTools(s) {
             ...projectIdSchema,
             specId: SpecIdSchema.describe('Spec ID to generate handoff package for'),
         },
-    }, safeLicensed('package_handoff', withProject((args) => handlePackageHandoff(args))));
+    }, safeGoverned('package_handoff', withProject((args) => handlePackageHandoff(args))));
     // ── Approval ─────────────────────────────────────────────────────────────────
     s.registerTool('configure_approval_policy', {
         description: 'Define the approval policy for a project: how many approvals are required, ' +
@@ -980,7 +980,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Roles allowed to approve specs. If empty or omitted, any reviewer can approve.'),
         },
         annotations: { title: 'Configure Approval Policy', destructiveHint: false },
-    }, safeLicensed('configure_approval_policy', (args) => handleConfigureApprovalPolicy(args)));
+    }, safeGoverned('configure_approval_policy', (args) => handleConfigureApprovalPolicy(args)));
     s.registerTool('issue_reviewer_token', {
         description: '[SPEC-722] Issue a signed reviewer token for approve_spec. ' +
             'Must be called from a DIFFERENT session than the one that created the spec. ' +
@@ -1002,7 +1002,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Host/agent platform identifier (e.g. "claude-code", "cursor").'),
         },
         annotations: { title: 'Issue Reviewer Token', destructiveHint: false },
-    }, safeLicensed('issue_reviewer_token', (args) => handleIssueReviewerToken(args)));
+    }, safeGoverned('issue_reviewer_token', (args) => handleIssueReviewerToken(args)));
     s.registerTool('approve_spec', {
         description: '[SPEC-722] Record that a reviewer has approved a spec. ' +
             'Requires a signed reviewerToken (from issue_reviewer_token) and the plannerToken ' +
@@ -1036,7 +1036,7 @@ export function registerQualityComplianceGroupTools(s) {
                 'Allows approval from the same model if the panel was heterogeneous.'),
         },
         annotations: { title: 'Approve Spec', destructiveHint: true },
-    }, safeLicensed('approve_spec', (args) => handleApproveSpec(args)));
+    }, safeGoverned('approve_spec', (args) => handleApproveSpec(args)));
     s.registerTool('request_changes', {
         description: 'Request changes on a spec. The spec is moved back to draft and prior approvals are cleared. ' +
             'A comment explaining the required changes is mandatory.',
@@ -1068,7 +1068,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Role of the reviewer (e.g. "tech-lead", "qa").'),
         },
         annotations: { title: 'Request Changes', destructiveHint: true },
-    }, safeLicensed('request_changes', (args) => handleRequestChanges(args)));
+    }, safeGoverned('request_changes', (args) => handleRequestChanges(args)));
     s.registerTool('approval_status', {
         description: 'Show the current approval status for a spec: who approved, how many are needed, ' +
             'time in review, and SLA breach warning if applicable.',
@@ -1103,7 +1103,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Raw spec content to analyze when specId is not available'),
         },
-    }, safeLicensed('data_governance', withProject((args) => handleDataGovernance(args))));
+    }, safeGoverned('data_governance', withProject((args) => handleDataGovernance(args))));
     s.registerTool('legal_compliance_report', {
         description: 'Generate a legal compliance report for the project. ' +
             'Shows detected legal domains, applicable regulations by country, ' +
@@ -1113,7 +1113,7 @@ export function registerQualityComplianceGroupTools(s) {
         inputSchema: {
             ...projectIdSchema,
         },
-    }, safeLicensed('legal_compliance_report', withProject((args) => handleLegalComplianceReport(args))));
+    }, safeGoverned('legal_compliance_report', withProject((args) => handleLegalComplianceReport(args))));
     // ── SPEC-322: API Contract Validation ────────────────────────────────────────
     s.registerTool('validate_api_contract', {
         description: 'Validate an OpenAPI 3.x/Swagger or GraphQL SDL contract against the actual implementation in a project. ' +

package/dist/tools/tool-registry/inventory.d.ts

@@ -0,0 +1,2 @@
+export { OFFICIAL_SDD_TOOL_NAMES, readCanonicalToolNames, } from '../../config/official-sdd-tools.js';
+//# sourceMappingURL=inventory.d.ts.map

package/dist/tools/tool-registry/inventory.js

@@ -0,0 +1,2 @@
+export { OFFICIAL_SDD_TOOL_NAMES, readCanonicalToolNames, } from '../../config/official-sdd-tools.js';
+//# sourceMappingURL=inventory.js.map

package/dist/tools/tool-registry-helpers.d.ts

@@ -14,17 +14,17 @@ interface MaybeProjectArgs {
  * Wraps a handler that requires a resolved projectId.
  * Resolves projectId from projectId or projectPath; returns missingProjectIdError if neither.
  *
- * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeLicensed callback):
+ * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeGoverned callback):
  * ```ts
  * // Before:
- * safeLicensed('tool', async (args) => {
+ * safeGoverned('tool', async (args) => {
  *   const pid = resolveProjectId(args as { projectId?: string; projectPath?: string });
  *   if (!pid) return missingProjectIdError;
  *   return handleFoo({ ...args, projectId: pid } as FooInput);
  * })
  *
  * // After:
- * safeLicensed('tool', withProject((args) => handleFoo(args as never)))
+ * safeGoverned('tool', withProject((args) => handleFoo(args as never)))
  * ```
  */
 export declare function withProject<T extends MaybeProjectArgs>(handler: (args: T & {

package/dist/tools/tool-registry-helpers.js

@@ -16,17 +16,17 @@ export const projectIdSchema = {
  * Wraps a handler that requires a resolved projectId.
  * Resolves projectId from projectId or projectPath; returns missingProjectIdError if neither.
  *
- * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeLicensed callback):
+ * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeGoverned callback):
  * ```ts
  * // Before:
- * safeLicensed('tool', async (args) => {
+ * safeGoverned('tool', async (args) => {
  *   const pid = resolveProjectId(args as { projectId?: string; projectPath?: string });
  *   if (!pid) return missingProjectIdError;
  *   return handleFoo({ ...args, projectId: pid } as FooInput);
  * })
  *
  * // After:
- * safeLicensed('tool', withProject((args) => handleFoo(args as never)))
+ * safeGoverned('tool', withProject((args) => handleFoo(args as never)))
  * ```
  */
 export function withProject(handler) {

package/dist/tools/tool-usage-report/registered-tools.d.ts

@@ -1,5 +1,5 @@
 /**
- * Returns a deduplicated list of all tool names registered in license-plans.json.
+ * Returns the live tool inventory captured by the canonical registry.
  */
 export declare function readRegisteredToolNames(): Promise<string[]>;
 //# sourceMappingURL=registered-tools.d.ts.map

package/dist/tools/tool-usage-report/registered-tools.js

@@ -1,21 +1,9 @@
 // tools/tool-usage-report/registered-tools.ts — SPEC-574
-// Reads all tool names registered in license-plans.json (freeTools + proTools + alwaysAllowed).
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-function loadLicensePlans() {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const configPath = join(__dirname, '../../config/license-plans.json');
-    const raw = readFileSync(configPath, 'utf-8');
-    return JSON.parse(raw);
-}
+import { readCanonicalToolNames } from '../tool-registry/inventory.js';
 /**
- * Returns a deduplicated list of all tool names registered in license-plans.json.
+ * Returns the live tool inventory captured by the canonical registry.
  */
 export function readRegisteredToolNames() {
-    const plans = loadLicensePlans();
-    const allTools = new Set([...plans.freeTools, ...plans.proTools, ...plans.alwaysAllowed]);
-    return Promise.resolve([...allTools].sort());
+    return Promise.resolve(readCanonicalToolNames().sort());
 }
 //# sourceMappingURL=registered-tools.js.map

package/dist/tools/update-status/approval-gates.js

@@ -10,6 +10,9 @@ export async function checkComplianceGate(specId, projectId, projectPath) {
     try {
         const { scoreCompliance } = await import('../../engine/verifier/compliance-scorer.js');
         const result = await scoreCompliance(specId, projectPath);
+        if (result.totalCriteria === 0 && result.criteriaDetails.length === 0) {
+            return { skipped: true, score: null, issues: [], blocked: false };
+        }
         const score = result.score;
         const issues = result.criteriaDetails
             .filter((detail) => detail.status === 'unverified')

package/dist/tools/update-status/batch.d.ts

@@ -1,3 +1,7 @@
-import type { ToolResult, UpdateStatusBatchInput } from '../../types/index.js';
-export declare function handleUpdateStatusBatch(input: UpdateStatusBatchInput): Promise<ToolResult>;
+import type { SpecStatus, ToolResult, UpdateStatusBatchInput } from '../../types/index.js';
+type UncheckedUpdateStatusBatchInput = Omit<UpdateStatusBatchInput, 'status'> & {
+    status: SpecStatus;
+};
+export declare function handleUpdateStatusBatch(input: UncheckedUpdateStatusBatchInput): Promise<ToolResult>;
+export {};
 //# sourceMappingURL=batch.d.ts.map

package/dist/tools/update-status/batch.js

@@ -6,7 +6,60 @@ function firstText(result) {
     const first = result.content[0];
     return first?.type === 'text' ? first.text : JSON.stringify(result.structuredContent ?? {});
 }
+/** SPEC-1349: extract the gate failure code + actionable next step from a per-spec transition result. */
+function failureDetails(result) {
+    const structured = result.structuredContent;
+    const code = typeof structured?.error === 'string' ? structured.error : undefined;
+    const nextAction = typeof structured?.fixHint === 'string' ? structured.fixHint : undefined;
+    return { code, nextAction };
+}
+const MAX_NARRATIVE_FAILURE_ROWS = 5;
+/** SPEC-1349: render up to MAX_NARRATIVE_FAILURE_ROWS per-spec reasons, capping token cost. */
+function renderFailureNarrative(failed) {
+    if (failed.length === 0) {
+        return [];
+    }
+    const shown = failed.slice(0, MAX_NARRATIVE_FAILURE_ROWS);
+    const remaining = failed.length - shown.length;
+    const lines = ['Failed specs:', ...shown.map((row) => `- ${row.specId}: ${row.message}`)];
+    if (remaining > 0) {
+        const dominantCode = shown[0]?.code;
+        const sameCause = dominantCode !== undefined && failed.every((row) => row.code === dominantCode);
+        lines.push(sameCause
+            ? `...and ${String(remaining)} more with the same cause.`
+            : `...and ${String(remaining)} more (see structuredContent.failed for details).`);
+    }
+    return lines;
+}
+/** SPEC-1349: when every failure shares one gate cause, surface a single aggregated next step. */
+function dominantFailureNextAction(failed) {
+    if (failed.length === 0) {
+        return undefined;
+    }
+    const firstCode = failed[0]?.code;
+    if (firstCode === undefined) {
+        return undefined;
+    }
+    const allSameCause = failed.every((row) => row.code === firstCode);
+    if (!allSameCause) {
+        return undefined;
+    }
+    return failed[0]?.nextAction;
+}
 export async function handleUpdateStatusBatch(input) {
+    if (input.status === 'done') {
+        const fixHint = 'Close each spec individually with update_status(done) and its full implementation review evidence.';
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `BATCH_DONE_UNSUPPORTED: Batch done transitions are not supported.\nFix: ${fixHint}`,
+                },
+            ],
+            isError: true,
+            structuredContent: { error: 'BATCH_DONE_UNSUPPORTED', code: 422, fixHint },
+        };
+    }
     const uniqueSpecIds = [...new Set(input.specIds)].sort();
     if (uniqueSpecIds.length === 0) {
         return {
@@ -57,7 +110,7 @@ export async function handleUpdateStatusBatch(input) {
                     skipped.push({ specId, message });
                 }
                 else {
-                    failed.push({ specId, message });
+                    failed.push({ specId, message, ...failureDetails(result) });
                 }
             }
             else {
@@ -81,11 +134,14 @@ export async function handleUpdateStatusBatch(input) {
         /* reliability-cleanup: POST_BATCH_STRICT_CLEANUP — validation remains fail-closed */
         reportClassifiedDegradation('POST_BATCH_STRICT_CLEANUP', error);
     }
+    const aggregatedNextAction = dominantFailureNextAction(failed);
     const text = [
         `Batch status transition complete: ${input.status}`,
         `Updated: ${updated.length}`,
         `Skipped: ${skipped.length}`,
         `Failed: ${failed.length}`,
+        ...renderFailureNarrative(failed),
+        ...(aggregatedNextAction ? [`Next action: ${aggregatedNextAction}`] : []),
     ].join('\n');
     return {
         content: [{ type: 'text', text }],
@@ -95,6 +151,7 @@ export async function handleUpdateStatusBatch(input) {
             skipped,
             failed,
             sideEffectsFlushed: ['strict-planu-cleanup'],
+            ...(aggregatedNextAction ? { nextAction: aggregatedNextAction } : {}),
         },
     };
 }

package/dist/tools/update-status/dod-gates.d.ts

@@ -83,6 +83,21 @@ export interface DoneGateResult {
     forcedBypassWarning: string | null;
     freshnessLease: ValidationFreshnessLease | null;
 }
+/**
+ * SPEC-1356 (T-A1): auto-derive the sha256 digest of the persisted
+ * `validation-report.json` so callers no longer have to compute it by hand.
+ * Reads and hashes the exact same bytes `checkDoneReviewDigest` would validate
+ * against, using the same hardened path/identity checks. Returns the digest, or
+ * the exact blocking `ToolResult` when the report cannot be safely read (e.g.
+ * validate has not run yet). Exported for direct unit testing and for the
+ * orchestration layer (`update-status/index.ts`) that no longer requires the
+ * caller to supply `implementationReviewDigest`.
+ */
+export declare function deriveDoneReviewDigest(specId: string, projectId: string): Promise<{
+    digest: string;
+} | {
+    error: ToolResult;
+}>;
 /**
  * SPEC-725: Check the validation-report artifact gate before marking done.
  * SPEC-1050: Fail closed. A done transition requires a fresh validation-report
@@ -99,7 +114,7 @@ export declare function checkSpecReviewGate(specId: string, projectId: string, _
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, _force: boolean | undefined, _forceReason?: string, verifyReceipt?: DoneReceiptVerifier): Promise<DoneGateResult>;
+export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, _force: boolean | undefined, _forceReason?: string, verifyReceipt?: DoneReceiptVerifier, implementationReviewDigest?: string): Promise<DoneGateResult>;
 export { checkQaGate } from './qa-gate.js';
 export { checkApprovedFormatGate, checkComplianceGate, type ComplianceGateResult, } from './approval-gates.js';
 /**