@prestyj/cli 5.29.1 → 5.30.1

package/dist/core/checklist-items.d.ts

@@ -0,0 +1,189 @@
+/** Days after which a recorded check comes back as due. */
+export declare const CHECKLIST_STALE_DAYS = 30;
+/** The record lives at the project root (not under `.ezcoder/`, which many projects ignore). */
+export declare const CHECKLIST_FILE = ".ez-checklist.json";
+export declare const CHECKLIST_GROUPS: readonly ["Foundations", "Source control", "Code quality", "Design & UX", "Safety", "Performance", "Shipping", "Handover"];
+export type ChecklistGroup = (typeof CHECKLIST_GROUPS)[number];
+export interface ChecklistItem {
+    readonly id: string;
+    readonly group: ChecklistGroup;
+    readonly title: string;
+    /** A short, first-person purpose hint shown as the item's tooltip. */
+    readonly description: string;
+    /** What the agent should inspect, written as instructions. */
+    readonly check: string;
+    /** Bundled skill to load before checking, when one fits. */
+    readonly skill?: string;
+    /** Built-in setup command that fixes most gaps, when one exists. */
+    readonly setupCommand?: string;
+    /** Detailed review lenses for items no bundled skill covers; rendered into the run prompt only. */
+    readonly guide?: readonly string[];
+}
+/** In recommended run order. */
+export declare const CHECKLIST_ITEMS: readonly [{
+    readonly id: "agent-setup";
+    readonly group: "Foundations";
+    readonly title: "Agent setup";
+    readonly description: "I start here so the agent knows the project. /init can create or update project instructions.";
+    readonly check: "A context file (AGENTS.md or CLAUDE.md) exists, its commands and architecture notes match the code today, and the project has the skills its recurring work needs.";
+    readonly setupCommand: "init";
+}, {
+    readonly id: "docs";
+    readonly group: "Foundations";
+    readonly title: "README & setup docs";
+    readonly description: "I check this so someone new can get the project running without asking me.";
+    readonly check: "The README says what the project is and how to install, run and test it; an example env file lists required settings; a licence file exists.";
+}, {
+    readonly id: "naming";
+    readonly group: "Foundations";
+    readonly title: "Shared vocabulary";
+    readonly description: "I use this to keep names consistent and big decisions written down.";
+    readonly check: "Each domain concept has one name across code and docs, a glossary (CONTEXT.md or similar) exists for non-trivial domains, and hard-to-reverse decisions are recorded (ADRs).";
+    readonly skill: "shared-language";
+}, {
+    readonly id: "git-github";
+    readonly group: "Source control";
+    readonly title: "Git & GitHub";
+    readonly description: "I use this to check the repo setup, ignore rules and protection for main.";
+    readonly check: "The project is a Git repo with a GitHub remote, .gitignore covers build output and local files, the main branch is protected (ruleset or branch protection, via `gh` when available), and no large binaries are committed.";
+    readonly setupCommand: "setup-ci";
+}, {
+    readonly id: "secrets";
+    readonly group: "Source control";
+    readonly title: "Secrets kept out";
+    readonly description: "I check this for keys and passwords that slipped into the code or Git history.";
+    readonly check: "No API keys, tokens, passwords or private keys in tracked files or Git history; env files are ignored; secrets are read from the environment or a secret store.";
+    readonly skill: "bulletproof";
+}, {
+    readonly id: "quality-tools";
+    readonly group: "Code quality";
+    readonly title: "Lint, format & type checks";
+    readonly description: "I use this to catch formatting, lint and type errors before they pile up.";
+    readonly check: "A linter, formatter and type checker (where the language has one) are configured, have scripts to run them, and pass when run now.";
+}, {
+    readonly id: "tests";
+    readonly group: "Code quality";
+    readonly title: "Tests";
+    readonly description: "I use this to check that tests pass and cover the parts that really matter.";
+    readonly check: "A test suite exists, runs green now, and covers the critical paths with real code paths rather than mocks alone.";
+    readonly skill: "tdd";
+}, {
+    readonly id: "ci";
+    readonly group: "Code quality";
+    readonly title: "CI";
+    readonly description: "I use this to check that every pull request gets built and tested automatically.";
+    readonly check: "CI runs build, lint and tests on every pull request and push to main, and the workflows are hardened (pinned actions, least-privilege permissions, no untrusted input in run steps).";
+    readonly setupCommand: "setup-ci";
+}, {
+    readonly id: "commit-gate";
+    readonly group: "Code quality";
+    readonly title: "Commit checks";
+    readonly description: "I use this to check that /commit runs checks and a review before saving a commit.";
+    readonly check: "A project /commit command exists that runs the project's checks and a review before committing.";
+    readonly setupCommand: "setup-commit";
+}, {
+    readonly id: "code-health";
+    readonly group: "Code quality";
+    readonly title: "Code health";
+    readonly description: "I use this to spot dead code, repetition and files that are getting hard to work with.";
+    readonly check: "Look for duplicated logic, dead code, unused exports and very large files or functions that are hard to change safely.";
+    readonly skill: "refactoring";
+}, {
+    readonly id: "errors-logging";
+    readonly group: "Code quality";
+    readonly title: "Errors & logging";
+    readonly description: "I use this to catch swallowed errors, confusing messages and leftover debug logs.";
+    readonly check: "Errors are handled at I/O boundaries with clear user-facing messages, nothing swallows errors silently, and there are no stray debug prints in shipped code.";
+}, {
+    readonly id: "dependencies";
+    readonly group: "Code quality";
+    readonly title: "Dependencies";
+    readonly description: "I check this for risky, unused or abandoned packages.";
+    readonly check: "A lockfile is committed, the package manager's audit reports no known vulnerabilities, and there are no unused or abandoned packages.";
+    readonly skill: "bulletproof";
+}, {
+    readonly id: "design-system";
+    readonly group: "Design & UX";
+    readonly title: "Design system";
+    readonly description: "I use this to check that colours, spacing and components come from one shared place.";
+    readonly check: "Colour, type, spacing and radius tokens are defined in one place and shared components exist for repeated UI. Not applicable without a UI.";
+    readonly skill: "evidence-led-ui";
+}, {
+    readonly id: "styling-consistency";
+    readonly group: "Design & UX";
+    readonly title: "Consistent styling";
+    readonly description: "I use this to catch one-off styles that don't match the rest of the app.";
+    readonly check: "Find hard-coded colours and sizes and one-off styles where shared tokens or components already exist. Not applicable without a UI.";
+    readonly skill: "evidence-led-ui";
+}, {
+    readonly id: "motion-consistency";
+    readonly group: "Design & UX";
+    readonly title: "Consistent animation";
+    readonly description: "I use this to keep animations consistent and check they respect reduced motion.";
+    readonly check: "Animations use shared durations and easings, and reduced-motion preferences are respected. Not applicable without a UI.";
+    readonly skill: "evidence-led-ui";
+}, {
+    readonly id: "accessibility";
+    readonly group: "Design & UX";
+    readonly title: "Accessibility";
+    readonly description: "I use this to catch things that make the app hard to read or use without a mouse.";
+    readonly check: "Text contrast is sufficient, everything works by keyboard with visible focus, and controls and images have labels or alt text. Not applicable without a UI.";
+    readonly skill: "evidence-led-ui";
+}, {
+    readonly id: "ui-states";
+    readonly group: "Design & UX";
+    readonly title: "Loading, empty & error states";
+    readonly description: "I check what people see while loading, when there's nothing to show or when things break.";
+    readonly check: "Every screen handles loading, empty and error states, and layouts survive small screens and long text. Not applicable without a UI.";
+    readonly skill: "evidence-led-ui";
+}, {
+    readonly id: "security";
+    readonly group: "Safety";
+    readonly title: "Security audit";
+    readonly description: "I use this to look for security holes before shipping.";
+    readonly check: "Run a full security audit of the project following the skill.";
+    readonly skill: "bulletproof";
+}, {
+    readonly id: "data-safety";
+    readonly group: "Safety";
+    readonly title: "Data safety";
+    readonly description: "I use this to check backups and catch changes that could lose someone's data.";
+    readonly check: "Migrations are reversible or guarded, backups exist for real data, and destructive operations are confirmed and recoverable. Not applicable without stored data.";
+    readonly skill: "durable";
+}, {
+    readonly id: "compliance";
+    readonly group: "Safety";
+    readonly title: "Compliance";
+    readonly description: "I check this for gaps around privacy, cookies, payments and licences.";
+    readonly check: "Privacy policy and terms exist where users or personal data are involved, cookies and payments follow the rules, and dependency licences are compatible.";
+    readonly skill: "compliance-guard";
+}, {
+    readonly id: "performance";
+    readonly group: "Performance";
+    readonly title: "Performance audit";
+    readonly description: "I use this to catch slow spots and things wasting memory.";
+    readonly check: "Run a full performance audit of the project following the skill.";
+    readonly skill: "lean";
+}, {
+    readonly id: "build-release";
+    readonly group: "Shipping";
+    readonly title: "Build & release";
+    readonly description: "I use this to check that a fresh copy builds and the release steps are clear.";
+    readonly check: "The project builds from a clean clone with documented steps, versions are tracked, a changelog exists, and releases are documented or automated.";
+}, {
+    readonly id: "monitoring";
+    readonly group: "Shipping";
+    readonly title: "Error reporting";
+    readonly description: "I use this to check that I'll hear about crashes and know where to look.";
+    readonly check: "Crashes and errors are reported somewhere the team sees them, logs can be found, and services have health checks where relevant. Not applicable for code with no running deployment.";
+}, {
+    readonly id: "senior-review";
+    readonly group: "Handover";
+    readonly title: "Don't embarrass me";
+    readonly description: "I use this so an experienced developer taking over the project thinks a pro built it.";
+    readonly check: "Review the whole project the way an experienced developer taking it over would, find the tells of inexperienced or unreviewed AI-generated work, and rank them by how quickly that developer would notice and how much credibility each costs.";
+    readonly guide: readonly ["**First five minutes.** Read what a newcomer sees first: the root listing, README, package metadata and `git log --oneline -30`. Tells: committed junk (`.DS_Store`, build output, `node_modules`, logs, `.env`, archives, stray screenshots, `*.bak`, `old/`, `copy`/`final`/`v2` files); AI leftovers in the root (planning, summary or \"fixes\" notes, chat dumps); a README that is still the framework template, or padded with emoji, hype and features the code doesn't have; placeholder metadata (`my-app`, `vite-project`, empty description, version `0.0.0`); more than one lockfile or package manager; commit messages like \"fix\", \"update\", \"wip\" or \"asdf\".", "**AI and prototype leftovers in code.** Comments that narrate obvious code or talk to the user (\"Here we…\", \"Updated to fix…\", \"NEW:\", \"You can now…\"); emoji in logs or comments; TODO or \"implement later\" stubs on live paths; placeholder or mock data shipped as real (lorem ipsum, \"John Doe\", fake responses, fake loading delays); commented-out blocks; stray debug prints.", "**One way of doing each thing.** Two libraries for one job (two HTTP clients, date libraries, UI kits or state libraries); several styling approaches mixed; languages mixed without reason (for example JS beside TS); parallel versions of a file or helper (`utils2`, `ButtonNew`, the same formatter written twice); inconsistent naming of files, folders and functions.", "**Structure.** God files and components that do everything; a flat or arbitrary folder layout; business logic inside UI components or route handlers. Also the opposite tell: abstraction for its own sake (factories, managers or interfaces with one implementation, unused config layers).", "**Silenced tools.** `any`, `as any`, `@ts-ignore`, `@ts-nocheck`, blanket lint disables, strict mode turned off, non-null assertions used to quiet errors, or the language's equivalents.", "**Defensive noise.** try/catch around everything that logs and carries on, fallbacks like `|| []` and optional chaining everywhere hiding real bugs, `alert()` or raw error dumps shown to users, catch blocks that swallow errors.", "**Stack fluency.** Fighting the framework instead of following its conventions (for example React effects for derived state, fetching without cleanup, index keys; hand-rolled routing, auth or validation the stack already provides); deprecated APIs or majors far behind; reinventing the standard library; a dependency added for a one-liner.", "**Hard-coded values.** localhost URLs, ports, endpoints, magic numbers, IDs and settings baked into code instead of config or environment.", "**Credibility killers.** Note these, but leave the full audit to their own checklist item and name it: secret keys in client code or Git (Secrets kept out), authorisation only in the frontend (Security audit), no tests or tests that assert nothing (Tests), a build, lint or type check that fails (Lint, format & type checks).", "**Honesty.** The README, comments and docs describe what the code really does, the setup steps work, and nothing claims features, tests or coverage that don't exist.", "**Judging.** Flag only what an experienced developer would broadly agree is a rookie tell, not taste; a pattern used consistently by the project's own conventions is not a finding. Agent instruction files (AGENTS.md, CLAUDE.md, `.ezcoder/`, editor rules) are normal practice; flag them only when stale, contradictory or full of junk. In a large project, sample each area and name what you sampled under `Scope:`.", "**Reporting.** Order findings by how fast a reviewer would spot them and how much credibility they cost, first-five-minute tells first. For each, say what the reviewer would conclude and the fix. Briefly name what already looks professional so the user knows what to keep. Never suggest rewriting published Git history; for weak commit messages, suggest a convention going forward."];
+}];
+export type ChecklistId = (typeof CHECKLIST_ITEMS)[number]["id"];
+export declare const CHECKLIST_IDS: [ChecklistId, ...ChecklistId[]];
+export declare function getChecklistItem(id: string): ChecklistItem | undefined;

package/dist/core/checklist-items.js

@@ -0,0 +1,226 @@
+// The built-in project health checklist: one definition list shared by the
+// `checklist` tool, the run prompt (`checklist-prompt.ts`) and the app's
+// Checklist screen, so the three can never drift apart.
+/** Days after which a recorded check comes back as due. */
+export const CHECKLIST_STALE_DAYS = 30;
+/** The record lives at the project root (not under `.ezcoder/`, which many projects ignore). */
+export const CHECKLIST_FILE = ".ez-checklist.json";
+export const CHECKLIST_GROUPS = [
+    "Foundations",
+    "Source control",
+    "Code quality",
+    "Design & UX",
+    "Safety",
+    "Performance",
+    "Shipping",
+    "Handover",
+];
+/** In recommended run order. */
+export const CHECKLIST_ITEMS = [
+    {
+        id: "agent-setup",
+        group: "Foundations",
+        title: "Agent setup",
+        description: "I start here so the agent knows the project. /init can create or update project instructions.",
+        check: "A context file (AGENTS.md or CLAUDE.md) exists, its commands and architecture notes match the code today, and the project has the skills its recurring work needs.",
+        setupCommand: "init",
+    },
+    {
+        id: "docs",
+        group: "Foundations",
+        title: "README & setup docs",
+        description: "I check this so someone new can get the project running without asking me.",
+        check: "The README says what the project is and how to install, run and test it; an example env file lists required settings; a licence file exists.",
+    },
+    {
+        id: "naming",
+        group: "Foundations",
+        title: "Shared vocabulary",
+        description: "I use this to keep names consistent and big decisions written down.",
+        check: "Each domain concept has one name across code and docs, a glossary (CONTEXT.md or similar) exists for non-trivial domains, and hard-to-reverse decisions are recorded (ADRs).",
+        skill: "shared-language",
+    },
+    {
+        id: "git-github",
+        group: "Source control",
+        title: "Git & GitHub",
+        description: "I use this to check the repo setup, ignore rules and protection for main.",
+        check: "The project is a Git repo with a GitHub remote, .gitignore covers build output and local files, the main branch is protected (ruleset or branch protection, via `gh` when available), and no large binaries are committed.",
+        setupCommand: "setup-ci",
+    },
+    {
+        id: "secrets",
+        group: "Source control",
+        title: "Secrets kept out",
+        description: "I check this for keys and passwords that slipped into the code or Git history.",
+        check: "No API keys, tokens, passwords or private keys in tracked files or Git history; env files are ignored; secrets are read from the environment or a secret store.",
+        skill: "bulletproof",
+    },
+    {
+        id: "quality-tools",
+        group: "Code quality",
+        title: "Lint, format & type checks",
+        description: "I use this to catch formatting, lint and type errors before they pile up.",
+        check: "A linter, formatter and type checker (where the language has one) are configured, have scripts to run them, and pass when run now.",
+    },
+    {
+        id: "tests",
+        group: "Code quality",
+        title: "Tests",
+        description: "I use this to check that tests pass and cover the parts that really matter.",
+        check: "A test suite exists, runs green now, and covers the critical paths with real code paths rather than mocks alone.",
+        skill: "tdd",
+    },
+    {
+        id: "ci",
+        group: "Code quality",
+        title: "CI",
+        description: "I use this to check that every pull request gets built and tested automatically.",
+        check: "CI runs build, lint and tests on every pull request and push to main, and the workflows are hardened (pinned actions, least-privilege permissions, no untrusted input in run steps).",
+        setupCommand: "setup-ci",
+    },
+    {
+        id: "commit-gate",
+        group: "Code quality",
+        title: "Commit checks",
+        description: "I use this to check that /commit runs checks and a review before saving a commit.",
+        check: "A project /commit command exists that runs the project's checks and a review before committing.",
+        setupCommand: "setup-commit",
+    },
+    {
+        id: "code-health",
+        group: "Code quality",
+        title: "Code health",
+        description: "I use this to spot dead code, repetition and files that are getting hard to work with.",
+        check: "Look for duplicated logic, dead code, unused exports and very large files or functions that are hard to change safely.",
+        skill: "refactoring",
+    },
+    {
+        id: "errors-logging",
+        group: "Code quality",
+        title: "Errors & logging",
+        description: "I use this to catch swallowed errors, confusing messages and leftover debug logs.",
+        check: "Errors are handled at I/O boundaries with clear user-facing messages, nothing swallows errors silently, and there are no stray debug prints in shipped code.",
+    },
+    {
+        id: "dependencies",
+        group: "Code quality",
+        title: "Dependencies",
+        description: "I check this for risky, unused or abandoned packages.",
+        check: "A lockfile is committed, the package manager's audit reports no known vulnerabilities, and there are no unused or abandoned packages.",
+        skill: "bulletproof",
+    },
+    {
+        id: "design-system",
+        group: "Design & UX",
+        title: "Design system",
+        description: "I use this to check that colours, spacing and components come from one shared place.",
+        check: "Colour, type, spacing and radius tokens are defined in one place and shared components exist for repeated UI. Not applicable without a UI.",
+        skill: "evidence-led-ui",
+    },
+    {
+        id: "styling-consistency",
+        group: "Design & UX",
+        title: "Consistent styling",
+        description: "I use this to catch one-off styles that don't match the rest of the app.",
+        check: "Find hard-coded colours and sizes and one-off styles where shared tokens or components already exist. Not applicable without a UI.",
+        skill: "evidence-led-ui",
+    },
+    {
+        id: "motion-consistency",
+        group: "Design & UX",
+        title: "Consistent animation",
+        description: "I use this to keep animations consistent and check they respect reduced motion.",
+        check: "Animations use shared durations and easings, and reduced-motion preferences are respected. Not applicable without a UI.",
+        skill: "evidence-led-ui",
+    },
+    {
+        id: "accessibility",
+        group: "Design & UX",
+        title: "Accessibility",
+        description: "I use this to catch things that make the app hard to read or use without a mouse.",
+        check: "Text contrast is sufficient, everything works by keyboard with visible focus, and controls and images have labels or alt text. Not applicable without a UI.",
+        skill: "evidence-led-ui",
+    },
+    {
+        id: "ui-states",
+        group: "Design & UX",
+        title: "Loading, empty & error states",
+        description: "I check what people see while loading, when there's nothing to show or when things break.",
+        check: "Every screen handles loading, empty and error states, and layouts survive small screens and long text. Not applicable without a UI.",
+        skill: "evidence-led-ui",
+    },
+    {
+        id: "security",
+        group: "Safety",
+        title: "Security audit",
+        description: "I use this to look for security holes before shipping.",
+        check: "Run a full security audit of the project following the skill.",
+        skill: "bulletproof",
+    },
+    {
+        id: "data-safety",
+        group: "Safety",
+        title: "Data safety",
+        description: "I use this to check backups and catch changes that could lose someone's data.",
+        check: "Migrations are reversible or guarded, backups exist for real data, and destructive operations are confirmed and recoverable. Not applicable without stored data.",
+        skill: "durable",
+    },
+    {
+        id: "compliance",
+        group: "Safety",
+        title: "Compliance",
+        description: "I check this for gaps around privacy, cookies, payments and licences.",
+        check: "Privacy policy and terms exist where users or personal data are involved, cookies and payments follow the rules, and dependency licences are compatible.",
+        skill: "compliance-guard",
+    },
+    {
+        id: "performance",
+        group: "Performance",
+        title: "Performance audit",
+        description: "I use this to catch slow spots and things wasting memory.",
+        check: "Run a full performance audit of the project following the skill.",
+        skill: "lean",
+    },
+    {
+        id: "build-release",
+        group: "Shipping",
+        title: "Build & release",
+        description: "I use this to check that a fresh copy builds and the release steps are clear.",
+        check: "The project builds from a clean clone with documented steps, versions are tracked, a changelog exists, and releases are documented or automated.",
+    },
+    {
+        id: "monitoring",
+        group: "Shipping",
+        title: "Error reporting",
+        description: "I use this to check that I'll hear about crashes and know where to look.",
+        check: "Crashes and errors are reported somewhere the team sees them, logs can be found, and services have health checks where relevant. Not applicable for code with no running deployment.",
+    },
+    {
+        id: "senior-review",
+        group: "Handover",
+        title: "Don't embarrass me",
+        description: "I use this so an experienced developer taking over the project thinks a pro built it.",
+        check: "Review the whole project the way an experienced developer taking it over would, find the tells of inexperienced or unreviewed AI-generated work, and rank them by how quickly that developer would notice and how much credibility each costs.",
+        guide: [
+            '**First five minutes.** Read what a newcomer sees first: the root listing, README, package metadata and `git log --oneline -30`. Tells: committed junk (`.DS_Store`, build output, `node_modules`, logs, `.env`, archives, stray screenshots, `*.bak`, `old/`, `copy`/`final`/`v2` files); AI leftovers in the root (planning, summary or "fixes" notes, chat dumps); a README that is still the framework template, or padded with emoji, hype and features the code doesn\'t have; placeholder metadata (`my-app`, `vite-project`, empty description, version `0.0.0`); more than one lockfile or package manager; commit messages like "fix", "update", "wip" or "asdf".',
+            '**AI and prototype leftovers in code.** Comments that narrate obvious code or talk to the user ("Here we…", "Updated to fix…", "NEW:", "You can now…"); emoji in logs or comments; TODO or "implement later" stubs on live paths; placeholder or mock data shipped as real (lorem ipsum, "John Doe", fake responses, fake loading delays); commented-out blocks; stray debug prints.',
+            "**One way of doing each thing.** Two libraries for one job (two HTTP clients, date libraries, UI kits or state libraries); several styling approaches mixed; languages mixed without reason (for example JS beside TS); parallel versions of a file or helper (`utils2`, `ButtonNew`, the same formatter written twice); inconsistent naming of files, folders and functions.",
+            "**Structure.** God files and components that do everything; a flat or arbitrary folder layout; business logic inside UI components or route handlers. Also the opposite tell: abstraction for its own sake (factories, managers or interfaces with one implementation, unused config layers).",
+            "**Silenced tools.** `any`, `as any`, `@ts-ignore`, `@ts-nocheck`, blanket lint disables, strict mode turned off, non-null assertions used to quiet errors, or the language's equivalents.",
+            "**Defensive noise.** try/catch around everything that logs and carries on, fallbacks like `|| []` and optional chaining everywhere hiding real bugs, `alert()` or raw error dumps shown to users, catch blocks that swallow errors.",
+            "**Stack fluency.** Fighting the framework instead of following its conventions (for example React effects for derived state, fetching without cleanup, index keys; hand-rolled routing, auth or validation the stack already provides); deprecated APIs or majors far behind; reinventing the standard library; a dependency added for a one-liner.",
+            "**Hard-coded values.** localhost URLs, ports, endpoints, magic numbers, IDs and settings baked into code instead of config or environment.",
+            "**Credibility killers.** Note these, but leave the full audit to their own checklist item and name it: secret keys in client code or Git (Secrets kept out), authorisation only in the frontend (Security audit), no tests or tests that assert nothing (Tests), a build, lint or type check that fails (Lint, format & type checks).",
+            "**Honesty.** The README, comments and docs describe what the code really does, the setup steps work, and nothing claims features, tests or coverage that don't exist.",
+            "**Judging.** Flag only what an experienced developer would broadly agree is a rookie tell, not taste; a pattern used consistently by the project's own conventions is not a finding. Agent instruction files (AGENTS.md, CLAUDE.md, `.ezcoder/`, editor rules) are normal practice; flag them only when stale, contradictory or full of junk. In a large project, sample each area and name what you sampled under `Scope:`.",
+            "**Reporting.** Order findings by how fast a reviewer would spot them and how much credibility they cost, first-five-minute tells first. For each, say what the reviewer would conclude and the fix. Briefly name what already looks professional so the user knows what to keep. Never suggest rewriting published Git history; for weak commit messages, suggest a convention going forward.",
+        ],
+    },
+];
+export const CHECKLIST_IDS = CHECKLIST_ITEMS.map((item) => item.id);
+const ITEMS_BY_ID = new Map(CHECKLIST_ITEMS.map((item) => [item.id, item]));
+export function getChecklistItem(id) {
+    return ITEMS_BY_ID.get(id);
+}
+//# sourceMappingURL=checklist-items.js.map

package/dist/core/checklist-items.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checklist-items.js","sourceRoot":"","sources":["../../src/core/checklist-items.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,wDAAwD;AAExD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,QAAQ;IACR,aAAa;IACb,UAAU;IACV,UAAU;CACF,CAAC;AAoBX,gCAAgC;AAChC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,+FAA+F;QACjG,KAAK,EACH,oKAAoK;QACtK,YAAY,EAAE,MAAM;KACrB;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,4EAA4E;QACzF,KAAK,EACH,8IAA8I;KACjJ;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,qEAAqE;QAClF,KAAK,EACH,8KAA8K;QAChL,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,2EAA2E;QACxF,KAAK,EACH,4NAA4N;QAC9N,YAAY,EAAE,UAAU;KACzB;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,KAAK,EACH,iKAAiK;QACnK,KAAK,EAAE,aAAa;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,2EAA2E;QACxF,KAAK,EACH,oIAAoI;KACvI;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,6EAA6E;QAC1F,KAAK,EACH,kHAAkH;QACpH,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,kFAAkF;QAC/F,KAAK,EACH,sLAAsL;QACxL,YAAY,EAAE,UAAU;KACzB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EACH,iGAAiG;QACnG,YAAY,EAAE,cAAc;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,wFAAwF;QAC1F,KAAK,EACH,wHAAwH;QAC1H,KAAK,EAAE,aAAa;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,mFAAmF;QACrF,KAAK,EACH,8JAA8J;KACjK;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,uDAAuD;QACpE,KAAK,EACH,uIAAuI;QACzI,KAAK,EAAE,aAAa;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,sFAAsF;QACxF,KAAK,EACH,4IAA4I;QAC9I,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,0EAA0E;QACvF,KAAK,EACH,oIAAoI;QACtI,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,iFAAiF;QAC9F,KAAK,EACH,yHAAyH;QAC3H,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EACH,6JAA6J;QAC/J,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,2FAA2F;QAC7F,KAAK,EACH,qIAAqI;QACvI,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,wDAAwD;QACrE,KAAK,EAAE,+DAA+D;QACtE,KAAK,EAAE,aAAa;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,+EAA+E;QAC5F,KAAK,EACH,kKAAkK;QACpK,KAAK,EAAE,SAAS;KACjB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,uEAAuE;QACpF,KAAK,EACH,0JAA0J;QAC5J,KAAK,EAAE,kBAAkB;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,2DAA2D;QACxE,KAAK,EAAE,kEAAkE;QACzE,KAAK,EAAE,MAAM;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,+EAA+E;QAC5F,KAAK,EACH,kJAAkJ;KACrJ;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,0EAA0E;QACvF,KAAK,EACH,sLAAsL;KACzL;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,uFAAuF;QACzF,KAAK,EACH,gPAAgP;QAClP,KAAK,EAAE;YACL,6oBAA6oB;YAC7oB,sXAAsX;YACtX,+WAA+W;YAC/W,+RAA+R;YAC/R,2LAA2L;YAC3L,qOAAqO;YACrO,qVAAqV;YACrV,4IAA4I;YAC5I,uUAAuU;YACvU,uKAAuK;YACvK,8ZAA8Z;YAC9Z,+XAA+X;SAChY;KACF;CAC0C,CAAC;AAI9C,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAGjE,CAAC;AAEF,MAAM,WAAW,GAAuC,IAAI,GAAG,CAC7D,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAC/C,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/core/checklist-prompt.d.ts

@@ -0,0 +1,7 @@
+import { type ChecklistItem } from "./checklist-items.js";
+/**
+ * Instructions for checking one checklist item, recorded through the `checklist`
+ * tool. The check itself is report-only; fixes happen only after the user picks
+ * one, and end with the item re-recorded so fixed findings don't linger.
+ */
+export declare function checklistRunPrompt(item: ChecklistItem): string;

package/dist/core/checklist-prompt.js

@@ -0,0 +1,45 @@
+// The prompt the app's Checklist screen sends when the user checks one item.
+// Generated from the item definition so it can't drift from the list.
+import { CHECKLIST_FILE, CHECKLIST_STALE_DAYS } from "./checklist-items.js";
+/**
+ * Instructions for checking one checklist item, recorded through the `checklist`
+ * tool. The check itself is report-only; fixes happen only after the user picks
+ * one, and end with the item re-recorded so fixed findings don't linger.
+ */
+export function checklistRunPrompt(item) {
+    const skillStep = item.skill
+        ? `Load the \`${item.skill}\` skill with the \`skill\` tool and follow its method in report-only mode.`
+        : item.guide
+            ? "No skill applies; follow the review guide above."
+            : "No skill applies; use your own judgment.";
+    const guide = item.guide
+        ? `\n\n## Review guide\n\n${item.guide.map((line) => `- ${line}`).join("\n")}`
+        : "";
+    const setupNote = item.setupCommand
+        ? ` Say that \`/${item.setupCommand}\` would fix most gaps.`
+        : "";
+    return `# Checklist: ${item.title}
+
+Check this project for one item of its health checklist and report in plain words. Results are stored in \`${CHECKLIST_FILE}\` at the project root and become due again after ${CHECKLIST_STALE_DAYS} days.
+
+**Check and report only. Do not edit, create, delete, install or commit any project file. Only the \`checklist\` tool writes the record.** This holds until the user picks a fix in step 8.
+
+## The item
+
+- id: \`${item.id}\`
+- group: ${item.group}
+- what to check: ${item.check}${guide}
+
+## Steps
+
+1. The \`checklist\` tool is loaded on demand. Call \`tool_search\` with the query "checklist" first.
+2. Profile the project briefly: what it is, its stack, whether it has a UI, a deployment, user data.
+3. Decide whether the item applies. If it clearly doesn't (for example design items for a project with no UI), record \`not-applicable\` with a one-line reason and stop.
+4. ${skillStep}
+5. Inspect the code and config, and run the project's real checks where relevant (lint, typecheck, tests, audits). Don't guess what a command would print: run it. Configuration being present is not a passing check. Do not run fix/write flags or checks that would alter project files.
+6. Report in plain words: a bold verdict limited to the reviewed scope, then each finding with file:line, severity and a suggested fix.${setupNote} State what you checked and what you did not check. Never describe a project as safe or fully covered merely because this review found no issues.
+7. Call \`checklist\` with \`action: "record"\`, \`id: "${item.id}"\`, \`result\` (\`pass\`, \`issues\` or \`not-applicable\`), a one-line \`summary\`, the \`findings\` (required for \`issues\`, empty for \`pass\`) and \`evidence\`: the commands you ran with their outcome, the files you read, and the skill you loaded. Include one evidence line beginning \`Scope:\` and another beginning \`Not checked:\` describing exclusions or missing access. Loading a skill alone is not review evidence. Keep any limited scope explicit in the summary; a narrow check must not claim to resolve unrelated findings from an earlier review. The tool stamps the date and commit itself.
+8. If you recorded \`issues\` and the \`ask_user\` tool is available, end by asking what to fix with \`ask_user\`, never a question in prose. Write options for these findings and this item, each a complete action in plain words: for example "Fix all N findings" (mark it \`recommended\` when the fixes are safe), a narrower option such as fixing only the high-severity findings or one named area, and "Leave as is". Offer an option only if you could carry it out now. Skip the question for \`pass\` or \`not-applicable\`.
+9. If the user picks a fix, make it, then run the relevant checks. Re-check every finding recorded in step 7, and call \`checklist\` \`record\` for \`${item.id}\` again: \`pass\` only when every finding is fixed and verified, otherwise \`issues\` listing what remains. Use evidence from the re-check, not the original review. If they leave it as is, keep the record unchanged.`;
+}
+//# sourceMappingURL=checklist-prompt.js.map

package/dist/core/checklist-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checklist-prompt.js","sourceRoot":"","sources":["../../src/core/checklist-prompt.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,sEAAsE;AAEtE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,sBAAsB,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK;QAC1B,CAAC,CAAC,cAAc,IAAI,CAAC,KAAK,6EAA6E;QACvG,CAAC,CAAC,IAAI,CAAC,KAAK;YACV,CAAC,CAAC,kDAAkD;YACpD,CAAC,CAAC,0CAA0C,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QACtB,CAAC,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC9E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY;QACjC,CAAC,CAAC,gBAAgB,IAAI,CAAC,YAAY,yBAAyB;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,gBAAgB,IAAI,CAAC,KAAK;;6GAE0E,cAAc,qDAAqD,oBAAoB;;;;;;UAM1L,IAAI,CAAC,EAAE;WACN,IAAI,CAAC,KAAK;mBACF,IAAI,CAAC,KAAK,GAAG,KAAK;;;;;;;KAOhC,SAAS;;yIAE2H,SAAS;0DACxF,IAAI,CAAC,EAAE;;wJAEuF,IAAI,CAAC,EAAE,0NAA0N,CAAC;AAC1X,CAAC"}

package/dist/core/checklist-snapshot.d.ts

@@ -0,0 +1,17 @@
+import { type ChecklistDetection } from "./checklist-detection.js";
+import { type GitState } from "./checklist-git.js";
+import { type ChecklistRow, type Result } from "./checklist-store.js";
+export interface ChecklistSnapshotRow extends ChecklistRow {
+    readonly detection: ChecklistDetection | null;
+    readonly runPrompt: string | null;
+    /** The project's commit or working tree changed after this result was recorded. */
+    readonly changedSinceCheck: boolean;
+}
+export interface ChecklistSnapshot {
+    readonly staleAfterDays: number;
+    readonly detectionWarnings: readonly string[];
+    readonly items: readonly ChecklistSnapshotRow[];
+}
+export type ReadGitState = (cwd: string, signal?: AbortSignal) => Promise<GitState>;
+/** Read-only snapshot shared by the app and the agent tool. */
+export declare function readChecklistSnapshot(cwd: string, now: Date, signal?: AbortSignal, gitState?: ReadGitState): Promise<Result<ChecklistSnapshot>>;

package/dist/core/checklist-snapshot.js

@@ -0,0 +1,46 @@
+import { CHECKLIST_ITEMS, CHECKLIST_STALE_DAYS, getChecklistItem } from "./checklist-items.js";
+import { detectChecklist } from "./checklist-detection.js";
+import { changedSinceCheck, readGitState } from "./checklist-git.js";
+import { checklistRunPrompt } from "./checklist-prompt.js";
+import { checklistView, readChecklist } from "./checklist-store.js";
+import { log } from "./logger.js";
+async function currentGitState(cwd, gitState, signal) {
+    try {
+        return await gitState(cwd, signal);
+    }
+    catch (error) {
+        if (!signal?.aborted) {
+            log("WARN", "checklist", "Could not read Git state for the snapshot", {
+                error: String(error),
+            });
+        }
+        return null;
+    }
+}
+/** Read-only snapshot shared by the app and the agent tool. */
+export async function readChecklistSnapshot(cwd, now, signal, gitState = readGitState) {
+    const [record, detection, git] = await Promise.all([
+        readChecklist(cwd, now, signal),
+        detectChecklist(cwd, signal),
+        currentGitState(cwd, gitState, signal),
+    ]);
+    if (!record.ok)
+        return record;
+    return {
+        ok: true,
+        value: {
+            staleAfterDays: CHECKLIST_STALE_DAYS,
+            detectionWarnings: detection.warnings,
+            items: checklistView(CHECKLIST_ITEMS, record.value, now).map((row) => {
+                const item = getChecklistItem(row.id);
+                return {
+                    ...row,
+                    detection: detection.items[row.id] ?? null,
+                    runPrompt: item ? checklistRunPrompt(item) : null,
+                    changedSinceCheck: changedSinceCheck(row, git),
+                };
+            }),
+        },
+    };
+}
+//# sourceMappingURL=checklist-snapshot.js.map

package/dist/core/checklist-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checklist-snapshot.js","sourceRoot":"","sources":["../../src/core/checklist-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,eAAe,EAA2B,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAkC,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAgBlC,KAAK,UAAU,eAAe,CAC5B,GAAW,EACX,QAAsB,EACtB,MAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,2CAA2C,EAAE;gBACpE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,GAAS,EACT,MAAoB,EACpB,WAAyB,YAAY;IAErC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;QAC/B,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC;QAC5B,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,cAAc,EAAE,oBAAoB;YACpC,iBAAiB,EAAE,SAAS,CAAC,QAAQ;YACrC,KAAK,EAAE,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,OAAO;oBACL,GAAG,GAAG;oBACN,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI;oBAC1C,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;oBACjD,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC;iBAC/C,CAAC;YACJ,CAAC,CAAC;SACH;KACF,CAAC;AACJ,CAAC"}

package/dist/core/checklist-store.d.ts

@@ -0,0 +1,59 @@
+import { type ChecklistItem } from "./checklist-items.js";
+export declare const CHECKLIST_RESULTS: readonly ["pass", "issues", "not-applicable"];
+export type ChecklistResult = (typeof CHECKLIST_RESULTS)[number];
+export type ChecklistStatus = "not-run" | "not-applicable" | "due" | "passed" | "needs-work";
+export declare const SUMMARY_MAX = 300;
+export declare const FINDING_MAX = 300;
+export declare const EVIDENCE_MAX = 200;
+export declare const LIST_MAX = 10;
+export interface ChecklistEntry {
+    readonly checkedAt: string;
+    readonly commit: string | null;
+    readonly uncommittedChanges: boolean;
+    readonly result: ChecklistResult;
+    readonly summary: string;
+    readonly findings: readonly string[];
+    readonly evidence: readonly string[];
+}
+export interface ChecklistRecord {
+    readonly version: 1;
+    readonly items: Readonly<Record<string, ChecklistEntry>>;
+}
+export type Result<T, E = string> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: E;
+};
+export declare function checklistPath(cwd: string): string;
+/**
+ * Read and validate the record. A missing file is an empty record; a file that
+ * is not valid JSON (or not a version-1 record) is an error, so a write never
+ * silently replaces a teammate's data. Invalid entries are dropped, not fatal.
+ */
+export declare function readChecklist(cwd: string, now: Date, signal?: AbortSignal): Promise<Result<ChecklistRecord>>;
+/** Canonical JSON: ids sorted, fixed key order, 2-space indent, trailing newline. */
+export declare function serializeChecklist(record: ChecklistRecord): string;
+/** Lock the whole read/merge/write transaction, then replace the record atomically. */
+export declare function writeChecklistEntry(cwd: string, id: string, entry: ChecklistEntry, now: Date, signal?: AbortSignal): Promise<Result<ChecklistRecord>>;
+export declare function checklistStatus(entry: ChecklistEntry | undefined, now: Date): ChecklistStatus;
+export interface ChecklistRow {
+    readonly id: string;
+    readonly group: ChecklistItem["group"];
+    readonly title: string;
+    readonly description: string;
+    readonly check: string;
+    readonly skill: string | null;
+    readonly setupCommand: string | null;
+    readonly status: ChecklistStatus;
+    readonly checkedAt: string | null;
+    readonly commit: string | null;
+    readonly uncommittedChanges: boolean;
+    readonly result: ChecklistResult | null;
+    readonly summary: string | null;
+    readonly findings: readonly string[];
+    readonly evidence: readonly string[];
+}
+/** Every item in list order, joined with its recorded entry and current status. */
+export declare function checklistView(items: readonly ChecklistItem[], record: ChecklistRecord, now: Date): ChecklistRow[];