@zxyycom/vibe-check 0.0.2 → 0.0.3

package/src/package-checks/project-files/collection.ts

@@ -3,11 +3,11 @@
 import { lstatSync } from "node:fs";
 import { resolve } from "node:path";
 
-import { matchesAnyConfigGlob } from "./config-glob.ts";
+import { matchesAnyConfigGlob } from "../../data-boundary/config-glob.ts";
 import { collectSubmoduleWorktreeFiles } from "./revision-worktree-files.ts";
 import { errorMessage } from "../host-environment/error-message.ts";
 import { processFailed } from "../host-environment/process.ts";
-import { runGit, splitNulDelimitedGitFileList } from "../host-environment/git.ts";
+import { gitFailureDetail, runGit, splitNulDelimitedGitFileList } from "../host-environment/git.ts";
 import { toSlashPath } from "../host-environment/path.ts";
 import { walkFiles } from "../host-environment/filesystem.ts";
 import type { ProjectFileSelection, ProjectFileSource } from "./configuration.ts";
@@ -17,6 +17,16 @@ type NamedProjectFileSelection = Readonly<{
   readonly selection: ProjectFileSelection;
 }>;
 
+type SourceCandidateCollector = (
+  rootDir: string,
+  selections: readonly NamedProjectFileSelection[]
+) => readonly string[];
+
+const sourceCandidateCollectors = Object.freeze({
+  filesystem: collectFilesystemCandidates,
+  "git-worktree": collectGitWorktreeCandidates
+}) satisfies Readonly<Partial<Record<ProjectFileSource, SourceCandidateCollector>>>;
+
 const CONFIG_GLOB_MAGIC = /[\\*?[\]{}()!+@]/u;
 
 /**
@@ -77,21 +87,29 @@ function collectSourceCandidates(
   source: ProjectFileSource,
   selections: readonly NamedProjectFileSelection[]
 ): readonly string[] {
-  switch (source) {
-    case "filesystem":
-      return uniqueSorted(
-        walkFiles({
-          ignoredDirs: commonExcludedDirectoryNames(selections),
-          rootDir
-        }).map(toSlashPath)
-      );
-    case "git-worktree":
-      return collectGitWorktreeCandidates(rootDir, selections);
-    default: {
-      const unsupportedSource: never = source;
-      throw new TypeError(`unsupported project file source: ${String(unsupportedSource)}`);
-    }
-  }
+  return sourceCandidateCollectorFor(source)(rootDir, selections);
+}
+
+function sourceCandidateCollectorFor(source: ProjectFileSource): SourceCandidateCollector {
+  const collector = sourceCandidateCollectors[source];
+  if (collector === undefined) return unsupportedProjectFileSource(source);
+  return collector;
+}
+
+function unsupportedProjectFileSource(source: ProjectFileSource): never {
+  throw new TypeError(`unsupported project file source: ${source}`);
+}
+
+function collectFilesystemCandidates(
+  rootDir: string,
+  selections: readonly NamedProjectFileSelection[]
+): readonly string[] {
+  return uniqueSorted(
+    walkFiles({
+      ignoredDirs: commonExcludedDirectoryNames(selections),
+      rootDir
+    }).map(toSlashPath)
+  );
 }
 
 function collectGitWorktreeCandidates(
@@ -103,11 +121,9 @@ function collectGitWorktreeCandidates(
     cwd: rootDir
   });
   if (processFailed(result)) {
-    const detail =
-      result.stderr.trim() ||
-      result.error?.message ||
-      (result.signal === null ? `exit status ${result.status}` : `signal ${result.signal}`);
-    throw new Error(`could not enumerate git-worktree files in ${rootDir}: ${detail}`);
+    throw new Error(
+      `could not enumerate git-worktree files in ${rootDir}: ${gitFailureDetail(result)}`
+    );
   }
 
   const include = uniqueSorted(selections.flatMap(({ selection }) => [...selection.include]));

package/src/package-checks/project-files/config-glob.ts

@@ -1,17 +1 @@
-import { minimatch } from "minimatch";
-
-import { toSlashPath } from "../host-environment/path.ts";
-
-/**
- * Product config glob 的唯一 matcher boundary。
- * Candidate 使用 slash form；dot path 只由显式 glob 决定，不附加隐式忽略规则。
- */
-export function matchesAnyConfigGlob(
-  candidatePath: string,
-  configGlobs: readonly string[]
-): boolean {
-  const normalizedCandidatePath = toSlashPath(candidatePath);
-  return configGlobs.some((configGlob) =>
-    minimatch(normalizedCandidatePath, configGlob, { dot: true })
-  );
-}
+export { matchesAnyConfigGlob } from "../../data-boundary/config-glob.ts";

package/src/package-checks/project-files/configuration.ts

@@ -127,7 +127,7 @@ function resolveStringArray(
 
 function validStringArray(value: unknown): boolean {
   const items = snapshotClosedArray(value);
-  return items !== undefined && items.every(isString);
+  return items?.every(isString) === true;
 }
 
 function isString(value: unknown): value is string {

package/src/package-checks/project-files/gitlink-revision.ts

@@ -1,7 +1,7 @@
 /** Reads canonical gitlink entries from a named Git tree revision. */
 
 import { processFailed } from "../host-environment/process.ts";
-import { runGit } from "../host-environment/git.ts";
+import { gitFailureDetail, runGit } from "../host-environment/git.ts";
 import { toSlashPath } from "../host-environment/path.ts";
 
 export type Gitlink = Readonly<{
@@ -21,11 +21,9 @@ export function gitlinksAtRevision({
     cwd: repository
   });
   if (processFailed(result)) {
-    const detail =
-      result.stderr.trim() ||
-      result.error?.message ||
-      (result.signal === null ? `exit status ${result.status}` : `signal ${result.signal}`);
-    throw new Error(`could not inspect gitlinks at ${revision} in ${repository}: ${detail}`);
+    throw new Error(
+      `could not inspect gitlinks at ${revision} in ${repository}: ${gitFailureDetail(result)}`
+    );
   }
 
   const gitlinks: Gitlink[] = [];

package/src/package-checks/project-files/gitlink-worktree.ts

@@ -24,26 +24,54 @@ export function inspectGitlinkWorktree({
   readonly gitlinkPath: string;
   readonly repository: string;
 }>): GitlinkWorktreeInspection {
+  const localWorktree = inspectLocalGitlinkWorktree({ gitlinkPath, repository });
+  if (localWorktree.kind !== "found") return localWorktree;
+  return inspectGitRepositoryRoot({
+    gitlinkPath,
+    canonicalSubmoduleRepository: localWorktree.repository
+  });
+}
+
+type LocalGitlinkWorktree = Readonly<{ readonly kind: "found"; readonly repository: string }>;
+
+function inspectLocalGitlinkWorktree({
+  gitlinkPath,
+  repository
+}: Readonly<{
+  readonly gitlinkPath: string;
+  readonly repository: string;
+}>): GitlinkWorktreeInspection | LocalGitlinkWorktree {
   const submoduleRepository = resolve(repository, gitlinkPath);
-  let canonicalSubmoduleRepository: string;
   try {
     if (!statSync(submoduleRepository).isDirectory()) return { kind: "missing" };
-    canonicalSubmoduleRepository = canonicalRepositoryPath(submoduleRepository);
+    return { kind: "found", repository: canonicalRepositoryPath(submoduleRepository) };
   } catch (error: unknown) {
     return missingPath(error)
       ? { kind: "missing" }
       : inspectionFailure(`could not inspect submodule worktree ${gitlinkPath}`, error);
   }
+}
 
+function inspectGitRepositoryRoot({
+  gitlinkPath,
+  canonicalSubmoduleRepository
+}: Readonly<{
+  readonly gitlinkPath: string;
+  readonly canonicalSubmoduleRepository: string;
+}>): GitlinkWorktreeInspection {
   const topLevelResult = runGit({
     args: ["rev-parse", "--show-toplevel"],
     cwd: canonicalSubmoduleRepository
   });
   if (processFailed(topLevelResult)) {
-    const topLevelFailureDetail =
-      topLevelResult.error?.message ||
-      topLevelResult.stderr.trim() ||
-      `exit ${topLevelResult.status}`;
+    const processErrorMessage = topLevelResult.error?.message;
+    const stderr = topLevelResult.stderr.trim();
+    let topLevelFailureDetail = `exit ${topLevelResult.status}`;
+    if (processErrorMessage !== undefined && processErrorMessage.length > 0) {
+      topLevelFailureDetail = processErrorMessage;
+    } else if (stderr.length > 0) {
+      topLevelFailureDetail = stderr;
+    }
     return {
       kind: "inspection-failed",
       error: `git rev-parse --show-toplevel failed while inspecting submodule ${gitlinkPath}: ${topLevelFailureDetail}`
@@ -51,7 +79,7 @@ export function inspectGitlinkWorktree({
   }
 
   const topLevel = topLevelResult.stdout.trim();
-  if (!topLevel) {
+  if (topLevel.length === 0) {
     return {
       kind: "inspection-failed",
       error: `git rev-parse --show-toplevel returned no repository path for submodule ${gitlinkPath}`

package/src/package-checks/project-files/public-collection.ts

@@ -82,7 +82,7 @@ function parseSelection(value: unknown): ProjectFileSelection | undefined {
 
 function snapshotStringArray(value: unknown): readonly string[] | undefined {
   const items = snapshotClosedArray(value);
-  return items !== undefined && items.every((item): item is string => typeof item === "string")
+  return items?.every((item): item is string => typeof item === "string") === true
     ? Object.freeze([...items])
     : undefined;
 }

package/src/package-checks/project-files/revision-paths.ts

@@ -1,7 +1,7 @@
 /** Path and Git-output projections shared by revision traversal helpers. */
 
 import { toSlashPath } from "../host-environment/path.ts";
-import { matchesAnyConfigGlob } from "./config-glob.ts";
+import { matchesAnyConfigGlob } from "../../data-boundary/config-glob.ts";
 
 export function uniqueSortedPaths(files: readonly string[]): string[] {
   return [...new Set(files.map(toSlashPath))].sort();
@@ -29,6 +29,6 @@ export function joinSlash({
 }
 
 export function nonEmptyGitOutput(stdout: string | null | undefined): string | null {
-  const value = (stdout || "").trim();
-  return value || null;
+  const value = (stdout ?? "").trim();
+  return value.length > 0 ? value : null;
 }

package/src/package-checks/project-files/revision-worktree-files.ts

@@ -1,7 +1,7 @@
 /** Enumerates files from initialized, non-cyclic submodule working trees. */
 
 import { processFailed } from "../host-environment/process.ts";
-import { runGit, splitNulDelimitedGitFileList } from "../host-environment/git.ts";
+import { gitFailureDetail, runGit, splitNulDelimitedGitFileList } from "../host-environment/git.ts";
 import {
   canonicalRepositoryPath,
   resolveDescendableGitlinkRepository,
@@ -33,7 +33,7 @@ export function collectSubmoduleWorktreeFiles({
       repository,
       visitedRepositories
     });
-    if (!submoduleRepository) continue;
+    if (submoduleRepository === null) continue;
     files.push(
       ...collectWorktreeFiles({
         prefix: gitlink.path,
@@ -65,11 +65,9 @@ function collectWorktreeFiles({
     cwd: repository
   });
   if (processFailed(result)) {
-    const detail =
-      result.stderr.trim() ||
-      result.error?.message ||
-      (result.signal === null ? `exit status ${result.status}` : `signal ${result.signal}`);
-    throw new Error(`could not enumerate git-worktree files in ${repository}: ${detail}`);
+    throw new Error(
+      `could not enumerate git-worktree files in ${repository}: ${gitFailureDetail(result)}`
+    );
   }
 
   const files = prefixAndFilter({
@@ -111,7 +109,7 @@ function collectNestedWorktreeFiles({
       repository,
       visitedRepositories
     });
-    if (!submoduleRepository) continue;
+    if (submoduleRepository === null) continue;
     files.push(
       ...collectWorktreeFiles({
         prefix: joinSlash({ path: gitlink.path, prefix }),
@@ -134,15 +132,17 @@ function worktreeRevision(repository: string): string | null {
     if (revision !== null) return revision;
     throw new Error(`git-worktree revision inspection returned no revision in ${repository}`);
   }
-  const headDoesNotExist =
+  if (headDoesNotExist(result)) return null;
+  throw new Error(
+    `could not inspect git-worktree revision in ${repository}: ${gitFailureDetail(result)}`
+  );
+}
+
+function headDoesNotExist(result: ReturnType<typeof runGit>): boolean {
+  return (
     result.error === undefined &&
     result.signal === null &&
     result.status === 1 &&
-    result.stderr.trim() === "";
-  if (headDoesNotExist) return null;
-  const detail =
-    result.stderr.trim() ||
-    result.error?.message ||
-    (result.signal === null ? `exit status ${result.status}` : `signal ${result.signal}`);
-  throw new Error(`could not inspect git-worktree revision in ${repository}: ${detail}`);
+    result.stderr.trim() === ""
+  );
 }

package/src/package-checks/secret-detection/default-check.ts

@@ -1,4 +1,8 @@
 import { defineCheck, type TypedCheckWithOptions } from "../../check/check.ts";
+import {
+  resolvePackageCheckAuthoringInput,
+  type PackageCheckIdentityInput
+} from "../check-authoring.ts";
 import { executeSecretDetection, SECRET_DETECTION_CHECK_DEFINITION } from "./execution.ts";
 import { parseSecretDetectionData } from "./final-data.ts";
 import type { ResolvedSecretDetectionOptions, SecretDetectionOptions } from "./options.ts";
@@ -13,23 +17,42 @@ import { validSecretDetectionOptions } from "./options-validation.ts";
  * @throws {TypeError} files 缺失、策略不完整或输入含未知字段时抛出。
  */
 export function secretDetection(
-  options: SecretDetectionOptions
+  options: SecretDetectionOptions<"secret-detection">
 ): TypedCheckWithOptions<
   "secret-detection",
   ResolvedSecretDetectionOptions,
   typeof parseSecretDetectionData
-> {
-  const resolvedOptions = resolveSecretDetectionOptions(options);
+>;
+export function secretDetection<const Id extends string>(
+  options: SecretDetectionOptions<Id> & PackageCheckIdentityInput<Id>
+): TypedCheckWithOptions<Id, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData>;
+export function secretDetection(
+  options: SecretDetectionOptions
+): TypedCheckWithOptions<string, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData>;
+export function secretDetection(
+  options: SecretDetectionOptions
+): TypedCheckWithOptions<string, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData> {
+  const input = resolvePackageCheckAuthoringInput(
+    options,
+    ["files", "maximumFileBytes", "maximumTotalBytes", "maximumFileCount", "findingWaivers"],
+    SECRET_DETECTION_CHECK_DEFINITION
+  );
+  if (input === undefined) {
+    throw new TypeError(
+      "secretDetection options must declare the documented closed explicit file policy"
+    );
+  }
+  const resolvedOptions = resolveSecretDetectionOptions(input.domainOptions);
   if (resolvedOptions === undefined) {
     throw new TypeError(
       "secretDetection options must declare the documented closed explicit file policy"
     );
   }
   return defineCheck({
-    ...SECRET_DETECTION_CHECK_DEFINITION,
-    execution: executeSecretDetection,
+    ...input.definition,
+    execute: executeSecretDetection,
     parseData: parseSecretDetectionData,
-    preflight: (preparedOptions) =>
+    prepare: (preparedOptions) =>
       validSecretDetectionOptions(preparedOptions)
         ? { status: "success", preparedOptions }
         : {

package/src/package-checks/secret-detection/execution.ts

@@ -1,6 +1,6 @@
 import type { CheckExecutionContext, CheckMessage, CheckResult } from "../../check/check.ts";
-import { appendCheckMessages } from "../../check/finding-presentation.ts";
-import { reconcileFindingWaivers } from "../../finding-waivers/reconciliation.ts";
+import { appendCheckMessages } from "../../package-tools/finding-presentation/finding-presentation.ts";
+import { reconcileFindingWaivers } from "../../package-tools/finding-waivers/reconciliation.ts";
 import { reportFindingWaiverAudits } from "../code-quality-findings/finding-waiver-evidence.ts";
 import { collectProjectFiles } from "../project-files/collection.ts";
 import type { SecretDetectionFinalData } from "./final-data.ts";

package/src/package-checks/secret-detection/input-preparation.ts

@@ -1,4 +1,12 @@
-import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+  type BigIntStats
+} from "node:fs";
 import { resolve } from "node:path";
 
 import type { CheckExecutionContext } from "../../check/check.ts";
@@ -147,7 +155,7 @@ function readBoundedRegularFile(input: {
   readonly filePath: string;
   readonly options: ResolvedSecretDetectionOptions;
 }): BoundedRegularFileRead {
-  const descriptor = openRegularFileWithoutFollowingSymlink(input.filePath);
+  const descriptor = openIdentityCheckedRegularFile(input.filePath);
   if (descriptor === undefined) return Object.freeze({ kind: "unavailable" });
   try {
     const byteLength = regularFileByteLength(descriptor);
@@ -175,17 +183,66 @@ function closeDescriptor(descriptor: number): void {
   }
 }
 
-function openRegularFileWithoutFollowingSymlink(filePath: string): number | undefined {
-  if (!supportsNoFollowDescriptorOpen()) return undefined;
+interface RegularFileIdentity {
+  readonly device: bigint;
+  readonly inode: bigint;
+}
+
+function openIdentityCheckedRegularFile(filePath: string): number | undefined {
+  const expectedIdentity = regularFileIdentityAtPath(filePath);
+  if (expectedIdentity === undefined) return undefined;
+  const openFlags = finalLeafOpenFlags();
+  if (openFlags === undefined) return undefined;
+
+  let descriptor: number;
+  try {
+    descriptor = openSync(filePath, openFlags);
+  } catch {
+    return undefined;
+  }
+
+  const openedIdentity = regularFileIdentityOnDescriptor(descriptor);
+  if (openedIdentity !== undefined && sameRegularFileIdentity(expectedIdentity, openedIdentity)) {
+    return descriptor;
+  }
+  closeDescriptor(descriptor);
+  return undefined;
+}
+
+function finalLeafOpenFlags(): number | undefined {
+  if (process.platform === "win32") return constants.O_RDONLY;
+  return typeof constants.O_NOFOLLOW === "number" && constants.O_NOFOLLOW !== 0
+    ? constants.O_RDONLY | constants.O_NOFOLLOW
+    : undefined;
+}
+
+function regularFileIdentityAtPath(filePath: string): RegularFileIdentity | undefined {
   try {
-    return openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    return regularFileIdentity(lstatSync(filePath, { bigint: true }));
   } catch {
     return undefined;
   }
 }
 
-function supportsNoFollowDescriptorOpen(): boolean {
-  return process.platform !== "win32" && constants.O_NOFOLLOW !== 0;
+function regularFileIdentityOnDescriptor(descriptor: number): RegularFileIdentity | undefined {
+  try {
+    return regularFileIdentity(fstatSync(descriptor, { bigint: true }));
+  } catch {
+    return undefined;
+  }
+}
+
+function regularFileIdentity(details: BigIntStats): RegularFileIdentity | undefined {
+  return details.isFile() && details.dev > 0n && details.ino > 0n
+    ? Object.freeze({ device: details.dev, inode: details.ino })
+    : undefined;
+}
+
+function sameRegularFileIdentity(
+  expected: RegularFileIdentity,
+  opened: RegularFileIdentity
+): boolean {
+  return expected.device === opened.device && expected.inode === opened.inode;
 }
 
 function regularFileByteLength(descriptor: number): number | undefined {

package/src/package-checks/secret-detection/options.ts

@@ -1,8 +1,11 @@
-import type { FindingWaiver } from "../../finding-waivers/reconciliation.ts";
+import type { PackageCheckAuthoringOptions } from "../check-authoring.ts";
+import type { FindingWaiver } from "../../package-tools/finding-waivers/reconciliation.ts";
 import type { ProjectFileSelection } from "../project-files/configuration.ts";
 
 /** `secretDetection(options)` 的明确 authoring policy。 */
-export interface SecretDetectionOptions {
+export interface SecretDetectionOptions<
+  Id extends string = string
+> extends PackageCheckAuthoringOptions<Id> {
   /** 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 */
   readonly files: ProjectFileSelection;
   /** 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 */

package/src/package-checks/secret-detection/records.ts

@@ -1,4 +1,4 @@
-import type { MaterializedFindingWaiver } from "../../finding-waivers/reconciliation.ts";
+import type { MaterializedFindingWaiver } from "../../package-tools/finding-waivers/reconciliation.ts";
 import type {
   FindingWaiverRecordAudit,
   FindingWaiverAuditRecordData

package/src/package-checks/secret-detection/secretlint/adapter.ts

@@ -81,10 +81,9 @@ export function adaptSecretlintMessages(
 function isPrivateKeyMessage(value: unknown): boolean {
   const message = snapshotClosedRecord(value);
   return (
-    message !== undefined &&
-    message.type === "message" &&
-    message.ruleId === secretDetectionPrivateKeyRuleId &&
-    message.severity === "error"
+    message?.type === "message" &&
+    message?.ruleId === secretDetectionPrivateKeyRuleId &&
+    message?.severity === "error"
   );
 }
 

package/src/package-tools/admission-policy/define-admission-policy.ts

@@ -0,0 +1,54 @@
+import type {
+  AdmissionPolicy,
+  CustomAdmissionPreparationContext,
+  CustomAdmissionStrategy,
+  PreparedCustomAdmissionStrategy
+} from "../../project-definition/scheduler-policy.ts";
+
+type ExactAdmissionPolicy<T extends AdmissionPolicy> =
+  T extends Readonly<{ readonly kind: "static" }>
+    ? T & Record<Exclude<keyof T, "kind">, never>
+    : T extends Readonly<{ readonly kind: "custom" }>
+      ? T &
+          Record<Exclude<keyof T, "kind" | "strategy">, never> &
+          Readonly<{
+            readonly strategy: ExactCustomAdmissionStrategy<T["strategy"]>;
+          }>
+      : never;
+
+type ExactCustomAdmissionStrategy<T extends CustomAdmissionStrategy> =
+  T extends Readonly<{ readonly kind: "simple" }>
+    ? T & Record<Exclude<keyof T, "kind" | "decide">, never>
+    : T extends Readonly<{ readonly kind: "prepared" }>
+      ? T &
+          Record<Exclude<keyof T, "kind" | "prepare">, never> &
+          Readonly<{ readonly prepare: ExactCustomPreparation<T["prepare"]> }>
+      : never;
+
+type ExactCustomPreparation<T> = T extends (
+  this: void,
+  context: CustomAdmissionPreparationContext
+) => infer Result
+  ? (this: void, context: CustomAdmissionPreparationContext) => ExactCustomPreparationResult<Result>
+  : never;
+
+type ExactCustomPreparationResult<T> =
+  T extends Promise<unknown>
+    ? Promise<ExactPreparedCustomAdmissionStrategy<Awaited<T>>>
+    : ExactPreparedCustomAdmissionStrategy<T>;
+
+type ExactPreparedCustomAdmissionStrategy<T> = T extends PreparedCustomAdmissionStrategy
+  ? T & Record<Exclude<keyof T, "decide" | "terminalEffect">, never>
+  : never;
+
+/**
+ * 保留 closed admission policy literal 的 TypeScript inference，不创建额外运行语义。
+ *
+ * @remarks inline policy 与此 helper 的结果完全等价。custom simple `decide` 同步运行；prepared
+ * strategy 为每个 graph-ready Run 解析独立 closure，调用方负责其 trusted host callback 的可重入性。
+ */
+export function defineAdmissionPolicy<const T extends AdmissionPolicy>(
+  policy: ExactAdmissionPolicy<T>
+): T {
+  return policy;
+}

package/src/{cache → package-tools/cache}/cache-json-by-key.ts

@@ -7,8 +7,8 @@ import {
   canonicalizeJsonObject,
   canonicalJsonBytes,
   type CanonicalJsonObject
-} from "../data-boundary/canonical-data.ts";
-import { hasExactPlainRecordKeys, snapshotClosedRecord } from "../data-boundary/closed-values.ts";
+} from "../../data-boundary/canonical-data.ts";
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.ts";
 
 const CACHE_API_VERSION = "caller-keyed-json-v1";
 const CACHE_ENVELOPE_KEYS = ["cacheFormatVersion", "identityDigest", "payload"] as const;
@@ -113,18 +113,15 @@ type ParsedOptions<T extends object> = Readonly<{
 }>;
 
 function parseOptions<T extends object>(value: CacheJsonByKeyOptions<T>): ParsedOptions<T> {
-  const record = snapshotClosedRecord(value);
-  if (
-    record === undefined ||
-    !hasExactPlainRecordKeys(record, [
-      "compute",
-      "directory",
-      "key",
-      "namespace",
-      "parse",
-      "version"
-    ])
-  ) {
+  const record = snapshotExactClosedRecord(value, [
+    "compute",
+    "directory",
+    "key",
+    "namespace",
+    "parse",
+    "version"
+  ]);
+  if (record === undefined) {
     throw new TypeError("cacheJsonByKey options must be a closed object");
   }
   const { compute, directory, key, namespace, parse, version } = record;
@@ -219,9 +216,8 @@ function parseEnvelope(
   value: unknown,
   identityDigest: string
 ): Readonly<{ readonly payload: CanonicalJsonObject }> | undefined {
-  const record = snapshotClosedRecord(value);
-  if (record === undefined || !hasExactPlainRecordKeys(record, CACHE_ENVELOPE_KEYS))
-    return undefined;
+  const record = snapshotExactClosedRecord(value, CACHE_ENVELOPE_KEYS);
+  if (record === undefined) return undefined;
   if (record.cacheFormatVersion !== CACHE_API_VERSION || record.identityDigest !== identityDigest) {
     return undefined;
   }

package/src/{check → package-tools/finding-presentation}/finding-presentation.ts

@@ -1,4 +1,6 @@
-import type { CheckMessage, CheckResult } from "./check.ts";
+import type { CheckResult } from "../../check/check.ts";
+
+type CheckMessage = NonNullable<CheckResult["messages"]>[number];
 
 /**
  * 将 Check-owned Finding 投影为有界 terminal messages 所需的超限上下文。