agent-sdd 1.0.3

package/dist/features/report/application/RunReport.js

@@ -0,0 +1,161 @@
+/*
+ * ENF-007A..ENF-007E: `sdd report --pr-summary` emits a 5-section markdown
+ * block (test obligations, internal decisions, ASSUMPTIONs, Open-Q residuals,
+ * debt-budget delta), read-only on the working tree. See spec record.
+ */
+import { lintRecordsFromMarkdown, } from "../../../shared/domain/SpecRecord.js";
+export async function runReport(cwd, input, ports) {
+    const config = await ports.config.config(cwd);
+    const entries = await ports.files.resolveSpecFiles(cwd, config.lint.specFiles);
+    const records = [];
+    for (const e of entries) {
+        records.push(...lintRecordsFromMarkdown(e.path, e.content));
+    }
+    const lines = [];
+    lines.push("## SDD PR Report");
+    lines.push("");
+    lines.push(...closedObligationsSection(records));
+    lines.push(...internalDecisionsSection());
+    lines.push(...assumptionsSection(records));
+    lines.push(...openQResidualsSection(records));
+    lines.push("### Debt budget delta");
+    lines.push("");
+    const debt = await debtBudgetDelta(cwd, input, records, entries, ports);
+    for (const l of debt) {
+        lines.push(l);
+    }
+    lines.push("");
+    return { markdown: lines.join("\n") };
+}
+function closedObligationsSection(records) {
+    const lines = [];
+    lines.push("### Closed Test obligations");
+    lines.push("");
+    const withObligations = records.filter((r) => r.testObligations.length > 0 || r.hasAliasedObligations);
+    if (withObligations.length === 0) {
+        lines.push("- _No records with `test_obligation` in scope._");
+    }
+    else {
+        lines.push("<!-- TODO(agent): cross-reference against `@covers <id>` markers under tests/** to confirm closure. -->");
+        for (const r of withObligations) {
+            lines.push(`- [${r.id}] (${r.template}) — declares test_obligation`);
+        }
+    }
+    lines.push("");
+    return lines;
+}
+function internalDecisionsSection() {
+    return [
+        "### Internal decisions (candidates for new Constraint/Policy/ASSUMPTION)",
+        "",
+        "<!-- TODO(agent): list internal decisions taken in this PR — names, structures, libraries — that are not yet codified. Examples:",
+        "       - chose <X> over <Y>, rationale: ...",
+        "       - introduced module <foo>, no Constraint binding yet",
+        "     Each becomes a candidate for a new Constraint / Policy / ASSUMPTION in a follow-up PR. -->",
+        "",
+    ];
+}
+function assumptionsSection(records) {
+    const lines = [];
+    lines.push("### ASSUMPTIONs");
+    lines.push("");
+    const assumptions = records.filter((r) => r.template === "ASSUMPTION");
+    if (assumptions.length === 0) {
+        lines.push("- _No ASSUMPTION records in scope._");
+    }
+    else {
+        for (const r of assumptions) {
+            const reviewBy = typeof r.parsed.review_by === "string"
+                ? r.parsed.review_by
+                : "(no review_by)";
+            const blocking = typeof r.parsed.blocking === "string" ? r.parsed.blocking : "?";
+            lines.push(`- [${r.id}] blocking=${blocking}, review_by=${reviewBy}`);
+        }
+    }
+    lines.push("");
+    return lines;
+}
+function openQResidualsSection(records) {
+    const lines = [];
+    lines.push("### Open-Q residuals");
+    lines.push("");
+    const openQs = records.filter((r) => r.template === "Open-Q" &&
+        (r.lifecycleStatus === "proposed" || r.lifecycleStatus === "draft"));
+    if (openQs.length === 0) {
+        lines.push("- _No open Open-Q records in scope._");
+    }
+    else {
+        for (const r of openQs) {
+            const blocking = typeof r.parsed.blocking === "string" ? r.parsed.blocking : "?";
+            lines.push(`- [${r.id}] blocking=${blocking}`);
+        }
+    }
+    lines.push("");
+    return lines;
+}
+async function debtBudgetDelta(cwd, input, records, entries, ports) {
+    const partitions = records.filter((r) => r.template === "Partition");
+    if (partitions.length === 0) {
+        return ["- _No Partition records in scope (debt budget not tracked)._"];
+    }
+    const out = [];
+    const prevByPath = new Map();
+    if (input.against !== undefined &&
+        ports.readAtRef !== undefined &&
+        ports.repoRoot !== undefined) {
+        let root;
+        try {
+            root = await ports.repoRoot(cwd);
+        }
+        catch {
+            out.push(`- _Unable to resolve repo root for --against=${input.against}._`);
+            return out;
+        }
+        for (const e of entries) {
+            const prev = await ports.readAtRef(root, input.against, e.path);
+            if (prev !== null) {
+                prevByPath.set(e.path, lintRecordsFromMarkdown(e.path, prev));
+            }
+        }
+    }
+    for (const p of partitions) {
+        const budget = p.parsed.unmodeled_budget;
+        if (!isRecord(budget)) {
+            out.push(`- [${p.id}] _no \`unmodeled_budget\` declared (P3.1)._`);
+            continue;
+        }
+        const current = budget.current;
+        const trend = budget.trend;
+        const baselineAt = budget.baseline_at;
+        if (typeof current !== "number") {
+            out.push(`- [${p.id}] _\`unmodeled_budget.current\` is not a number._`);
+            continue;
+        }
+        let delta = "";
+        if (input.against !== undefined) {
+            const prevRecs = prevByPath.get(p.file);
+            const prevPart = prevRecs?.find((r) => r.id === p.id);
+            const prevBudget = prevPart !== undefined && isRecord(prevPart.parsed.unmodeled_budget)
+                ? prevPart.parsed.unmodeled_budget
+                : null;
+            const prevCurrent = prevBudget !== null && typeof prevBudget.current === "number"
+                ? prevBudget.current
+                : null;
+            if (prevCurrent !== null) {
+                const diff = current - prevCurrent;
+                const sign = diff > 0 ? "+" : "";
+                delta = ` (was ${prevCurrent} at ${input.against}, ${sign}${diff})`;
+            }
+            else {
+                delta = ` (no comparable budget at ${input.against})`;
+            }
+        }
+        const baselineLabel = typeof baselineAt === "string" ? `, baseline_at ${baselineAt}` : "";
+        const trendLabel = typeof trend === "string" ? `, trend=${trend}` : "";
+        out.push(`- [${p.id}] current=${current}${delta}${baselineLabel}${trendLabel}`);
+    }
+    return out;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/features/report/ports/inbound/ReportCommand.d.ts

@@ -0,0 +1,8 @@
+import type { CommandResult, OutputFormat } from "../../../../shared/domain/CliOutput.js";
+export interface ReportRequest {
+    prSummary: boolean;
+    against?: string;
+}
+export interface ReportCommand {
+    execute(cwd: string, req: ReportRequest, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}

package/dist/features/report/ports/inbound/ReportCommand.js

@@ -0,0 +1 @@
+export {};

package/dist/features/report/ports/outbound/ReportConfigPort.d.ts

@@ -0,0 +1,4 @@
+import type { SddConfig } from "../../../../shared/domain/Config.js";
+export interface ReportConfigPort {
+    config(repoRoot: string): Promise<SddConfig>;
+}

package/dist/features/report/ports/outbound/ReportConfigPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/report/ports/outbound/ReportFileReader.d.ts

@@ -0,0 +1,7 @@
+export interface SpecFileEntry {
+    path: string;
+    content: string;
+}
+export interface ReportFileReader {
+    resolveSpecFiles(repoRoot: string, patterns: readonly string[]): Promise<SpecFileEntry[]>;
+}

package/dist/features/report/ports/outbound/ReportFileReader.js

@@ -0,0 +1 @@
+export {};

package/dist/features/token/adapters/inbound/CliTokenHandler.d.ts

@@ -0,0 +1,8 @@
+import { type CommandResult, type OutputFormat } from "../../../../shared/domain/CliOutput.js";
+import { type ComputeTokenPorts } from "../../application/ComputeToken.js";
+import type { TokenCommand } from "../../ports/inbound/TokenCommand.js";
+export declare class CliTokenHandler implements TokenCommand {
+    private readonly ports;
+    constructor(ports: ComputeTokenPorts);
+    execute(cwd: string, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}

package/dist/features/token/adapters/inbound/CliTokenHandler.js

@@ -0,0 +1,53 @@
+import { failed, ok, } from "../../../../shared/domain/CliOutput.js";
+import { CliFailure } from "../../../../shared/domain/Errors.js";
+import { computeToken, } from "../../application/ComputeToken.js";
+export class CliTokenHandler {
+    ports;
+    constructor(ports) {
+        this.ports = ports;
+    }
+    async execute(cwd, format) {
+        try {
+            const outcome = await computeToken(cwd, this.ports);
+            if (outcome.kind === "dirty") {
+                return dirtyResult(outcome.dirtyPaths, format);
+            }
+            if (format === "json") {
+                return ok(JSON.stringify({
+                    format_version: 1,
+                    ok: true,
+                    token: outcome.token,
+                    commit_sha: outcome.commitSha,
+                    mechanism: outcome.mechanism,
+                    scope: outcome.scope,
+                }));
+            }
+            return ok(`token ${outcome.token}\n  commit_sha: ${outcome.commitSha}\n  mechanism: ${outcome.mechanism}\n  scope: ${outcome.scope.join(", ")}`);
+        }
+        catch (error) {
+            if (error instanceof CliFailure) {
+                return failed(error, format);
+            }
+            throw error;
+        }
+    }
+}
+function dirtyResult(dirtyPaths, format) {
+    if (format === "json") {
+        return {
+            exitCode: 1,
+            stdout: `${JSON.stringify({
+                format_version: 1,
+                ok: false,
+                reason: "baseline-dirty",
+                dirty_paths: dirtyPaths,
+            })}\n`,
+            stderr: "",
+        };
+    }
+    return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `baseline-dirty: scope has uncommitted changes\n  ${dirtyPaths.join("\n  ")}\n`,
+    };
+}

package/dist/features/token/adapters/outbound/ChildProcessTokenGit.d.ts

@@ -0,0 +1,8 @@
+import type { TokenGitPort } from "../../ports/outbound/TokenGitPort.js";
+export declare class ChildProcessTokenGit implements TokenGitPort {
+    repoRoot(cwd: string): Promise<string>;
+    headSha(repoRoot: string): Promise<string>;
+    treeBytes(repoRoot: string, scope: readonly string[]): Promise<Uint8Array>;
+    treePaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+    dirtyPaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+}

package/dist/features/token/adapters/outbound/ChildProcessTokenGit.js

@@ -0,0 +1,112 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { environmentFailure } from "../../../../shared/domain/Errors.js";
+export class ChildProcessTokenGit {
+    async repoRoot(cwd) {
+        const result = await runGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        if (result.code !== 0 || result.stdout.toString("utf8").trim() !== "true") {
+            throw environmentFailure("not-a-git-repo", "cwd is not inside a git working tree", cwd);
+        }
+        return findRepoRoot(cwd);
+    }
+    async headSha(repoRoot) {
+        const result = await runGit(repoRoot, ["rev-parse", "HEAD"]);
+        if (result.code === 0) {
+            return result.stdout.toString("utf8").trim();
+        }
+        throw environmentFailure("head-unborn", "HEAD does not resolve to a commit", result.stderr.toString("utf8").trim());
+    }
+    async treeBytes(repoRoot, scope) {
+        const result = await runGit(repoRoot, ["ls-tree", "HEAD", "--", ...scope]);
+        if (result.code !== 0) {
+            throw environmentFailure("head-unborn", "git ls-tree failed", result.stderr.toString("utf8").trim());
+        }
+        return result.stdout;
+    }
+    async treePaths(repoRoot, scope) {
+        const result = await runGit(repoRoot, [
+            "ls-tree",
+            "-r",
+            "--name-only",
+            "HEAD",
+            "--",
+            ...scope,
+        ]);
+        if (result.code !== 0) {
+            throw environmentFailure("head-unborn", "git ls-tree failed", result.stderr.toString("utf8").trim());
+        }
+        return nonEmptyLines(result.stdout.toString("utf8"));
+    }
+    async dirtyPaths(repoRoot, scope) {
+        const diffResult = await runGit(repoRoot, [
+            "diff",
+            "--quiet",
+            "HEAD",
+            "--",
+            ...scope,
+        ]);
+        if (diffResult.code !== 0 && diffResult.code !== 1) {
+            throw environmentFailure("head-unborn", "git diff --quiet failed", diffResult.stderr.toString("utf8").trim());
+        }
+        const result = await runGit(repoRoot, [
+            "status",
+            "--porcelain",
+            "--",
+            ...scope,
+        ]);
+        if (result.code !== 0) {
+            throw environmentFailure("not-a-git-repo", "git status failed", result.stderr.toString("utf8").trim());
+        }
+        return nonEmptyLines(result.stdout.toString("utf8"))
+            .map((line) => porcelainPath(line))
+            .sort();
+    }
+}
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", [...args], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            if (error.code === "ENOENT") {
+                reject(environmentFailure("git-not-on-path", "git binary is not on PATH"));
+                return;
+            }
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({
+                code: code ?? 1,
+                stdout: Buffer.concat(stdout),
+                stderr: Buffer.concat(stderr),
+            });
+        });
+    });
+}
+function nonEmptyLines(value) {
+    return value.split(/\r?\n/).filter((line) => line.length > 0);
+}
+function porcelainPath(line) {
+    const raw = line.slice(3);
+    const parts = raw.split(" -> ");
+    return parts[parts.length - 1];
+}
+function findRepoRoot(cwd) {
+    let current = resolve(cwd);
+    while (true) {
+        if (existsSync(join(current, ".git"))) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            throw environmentFailure("not-a-git-repo", "cwd is not inside a git working tree", cwd);
+        }
+        current = parent;
+    }
+}

package/dist/features/token/adapters/outbound/NodeTokenConfigReader.d.ts

@@ -0,0 +1,5 @@
+import { type SddConfig } from "../../../../shared/domain/Config.js";
+import type { TokenConfigPort } from "../../ports/outbound/TokenConfigPort.js";
+export declare class NodeTokenConfigReader implements TokenConfigPort {
+    config(repoRoot: string): Promise<SddConfig>;
+}

package/dist/features/token/adapters/outbound/NodeTokenConfigReader.js

@@ -0,0 +1,41 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { configFromJson, } from "../../../../shared/domain/Config.js";
+import { configFailure } from "../../../../shared/domain/Errors.js";
+export class NodeTokenConfigReader {
+    async config(repoRoot) {
+        const configPath = join(repoRoot, ".sdd", "config.json");
+        const text = await readConfig(configPath);
+        const config = configFromJson(parseConfigJson(text, configPath), configPath);
+        await assertSpecReadable(repoRoot, config);
+        return config;
+    }
+}
+async function readConfig(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        throw configFailure("config-missing", ".sdd/config.json is missing or unreadable", errorMessage(error), path);
+    }
+}
+function parseConfigJson(text, path) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw configFailure("config-invalid", ".sdd/config.json is not valid JSON", errorMessage(error), path);
+    }
+}
+async function assertSpecReadable(repoRoot, config) {
+    const specPath = join(repoRoot, config.specFile);
+    try {
+        await readFile(specPath, "utf8");
+    }
+    catch (error) {
+        throw configFailure("config-invalid", `spec_file is not readable: ${config.specFile}`, errorMessage(error), specPath);
+    }
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/features/token/application/ComputeToken.d.ts

@@ -0,0 +1,18 @@
+import { TOKEN_MECHANISM } from "../../../shared/domain/Token.js";
+import type { TokenConfigPort } from "../ports/outbound/TokenConfigPort.js";
+import type { TokenGitPort } from "../ports/outbound/TokenGitPort.js";
+export type TokenOutcome = {
+    kind: "success";
+    token: string;
+    commitSha: string;
+    mechanism: typeof TOKEN_MECHANISM;
+    scope: string[];
+} | {
+    kind: "dirty";
+    dirtyPaths: string[];
+};
+export interface ComputeTokenPorts {
+    config: TokenConfigPort;
+    git: TokenGitPort;
+}
+export declare function computeToken(cwd: string, ports: ComputeTokenPorts): Promise<TokenOutcome>;

package/dist/features/token/application/ComputeToken.js

@@ -0,0 +1,27 @@
+import { configFailure } from "../../../shared/domain/Errors.js";
+import { TOKEN_MECHANISM, token } from "../../../shared/domain/Token.js";
+export async function computeToken(cwd, ports) {
+    const repoRoot = await ports.git.repoRoot(cwd);
+    const commitSha = await ports.git.headSha(repoRoot);
+    const config = await ports.config.config(repoRoot);
+    await assertGlobMatches(ports.git, repoRoot, config.discoveryScope);
+    const dirtyPaths = await ports.git.dirtyPaths(repoRoot, config.discoveryScope);
+    if (dirtyPaths.length > 0) {
+        return { kind: "dirty", dirtyPaths };
+    }
+    return {
+        kind: "success",
+        token: token(await ports.git.treeBytes(repoRoot, config.discoveryScope)),
+        commitSha,
+        mechanism: TOKEN_MECHANISM,
+        scope: config.discoveryScope,
+    };
+}
+async function assertGlobMatches(git, repoRoot, scope) {
+    for (const entry of scope.filter((value) => /[*?[]/.test(value))) {
+        const paths = await git.treePaths(repoRoot, [entry]);
+        if (paths.length === 0) {
+            throw configFailure("config-invalid", `discovery_scope glob matched zero files: ${entry}`);
+        }
+    }
+}

package/dist/features/token/ports/inbound/TokenCommand.d.ts

@@ -0,0 +1,4 @@
+import type { CommandResult, OutputFormat } from "../../../../shared/domain/CliOutput.js";
+export interface TokenCommand {
+    execute(cwd: string, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}

package/dist/features/token/ports/inbound/TokenCommand.js

@@ -0,0 +1 @@
+export {};

package/dist/features/token/ports/outbound/TokenConfigPort.d.ts

@@ -0,0 +1,4 @@
+import type { SddConfig } from "../../../../shared/domain/Config.js";
+export interface TokenConfigPort {
+    config(repoRoot: string): Promise<SddConfig>;
+}

package/dist/features/token/ports/outbound/TokenConfigPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/token/ports/outbound/TokenGitPort.d.ts

@@ -0,0 +1,7 @@
+export interface TokenGitPort {
+    repoRoot(cwd: string): Promise<string>;
+    headSha(repoRoot: string): Promise<string>;
+    treeBytes(repoRoot: string, scope: readonly string[]): Promise<Uint8Array>;
+    treePaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+    dirtyPaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+}

package/dist/features/token/ports/outbound/TokenGitPort.js

@@ -0,0 +1 @@
+export {};

package/dist/shared/domain/AgentBlocklist.d.ts

@@ -0,0 +1,5 @@
+export declare const BUILTIN_AGENT_BLOCKLIST: ReadonlySet<string>;
+/** True when `approver` is forbidden as an approver — either listed in the
+ *  built-in blocklist (case-insensitive), or starts with the `bot:` prefix,
+ *  or is in the consumer-supplied `extraBlocklist`. */
+export declare function isBlockedApprover(approver: string, extraBlocklist?: readonly string[]): boolean;

package/dist/shared/domain/AgentBlocklist.js

@@ -0,0 +1,28 @@
+/*
+ * Identities that may never act as approvers (SDD §7.5 / ENF-010);
+ * shared by the approve and lint slices.
+ */
+export const BUILTIN_AGENT_BLOCKLIST = new Set([
+    "agent",
+    "claude",
+    "claude-code",
+    "code-gen-agent",
+    "codex",
+    "pipeline-driver",
+    "spec-author-bot",
+    "spec-lint",
+    "sdd-cli",
+]);
+/** True when `approver` is forbidden as an approver — either listed in the
+ *  built-in blocklist (case-insensitive), or starts with the `bot:` prefix,
+ *  or is in the consumer-supplied `extraBlocklist`. */
+export function isBlockedApprover(approver, extraBlocklist = []) {
+    const lower = approver.toLowerCase();
+    if (BUILTIN_AGENT_BLOCKLIST.has(lower)) {
+        return true;
+    }
+    if (approver.startsWith("bot:")) {
+        return true;
+    }
+    return extraBlocklist.map((s) => s.toLowerCase()).includes(lower);
+}

package/dist/shared/domain/BoundaryReachability.d.ts

@@ -0,0 +1,5 @@
+import type { LintRecord } from "./SpecRecord.js";
+export declare const EXTERNAL_BOUNDARY_TYPES: ReadonlySet<string>;
+/** Returns the set of normative IDs that are boundary elements per the
+ *  reachability edges above. Computed once per partition view. */
+export declare function reachableBoundaryIds(records: ReadonlyArray<LintRecord>): Set<string>;

package/dist/shared/domain/BoundaryReachability.js

@@ -0,0 +1,71 @@
+/*
+ * Boundary reachability for P2.1 lint rules (ENF-013/014/015/016):
+ * a Behavior/Contract reachable from a Surface with an external
+ * boundary_type, via single-hop surface_ref / members[] edges.
+ */
+export const EXTERNAL_BOUNDARY_TYPES = new Set([
+    "api",
+    "sdk",
+    "event_bus",
+    "cli",
+    "public_db",
+    "public_storage",
+]);
+/** Returns the set of normative IDs that are boundary elements per the
+ *  reachability edges above. Computed once per partition view. */
+export function reachableBoundaryIds(records) {
+    const out = new Set();
+    /*
+     * Map every Surface ID -> boundary_type so we can decide which Surfaces
+     * count as external.
+     */
+    const surfaceBoundaryType = new Map();
+    for (const r of records) {
+        if (r.template !== "Surface") {
+            continue;
+        }
+        const bt = r.parsed.boundary_type;
+        if (typeof bt === "string") {
+            surfaceBoundaryType.set(r.id, bt);
+        }
+    }
+    const isExternalSurface = (id) => {
+        const bt = surfaceBoundaryType.get(id);
+        return bt !== undefined && EXTERNAL_BOUNDARY_TYPES.has(bt);
+    };
+    /*
+     * Pass A: every Contract or Behavior whose surface_ref points to an
+     * external Surface is itself a boundary element.
+     */
+    for (const r of records) {
+        if (r.template !== "Contract" && r.template !== "Behavior") {
+            continue;
+        }
+        const ref = r.parsed.surface_ref;
+        if (typeof ref === "string" && isExternalSurface(ref)) {
+            out.add(r.id);
+        }
+    }
+    /*
+     * Pass B: every member listed under an external Surface's members[] is a
+     * boundary element (reverse edge for completeness).
+     */
+    for (const r of records) {
+        if (r.template !== "Surface") {
+            continue;
+        }
+        if (!isExternalSurface(r.id)) {
+            continue;
+        }
+        const members = r.parsed.members;
+        if (!Array.isArray(members)) {
+            continue;
+        }
+        for (const m of members) {
+            if (typeof m === "string") {
+                out.add(m);
+            }
+        }
+    }
+    return out;
+}

package/dist/shared/domain/CheckOutcome.d.ts

@@ -0,0 +1,10 @@
+export type BaselineComparison = {
+    kind: "match";
+    recordedToken: string;
+    recomputedToken: string;
+} | {
+    kind: "stale";
+    recordedToken: string;
+    recomputedToken: string;
+};
+export declare function baselineComparison(recordedToken: string, recomputedToken: string): BaselineComparison;

package/dist/shared/domain/CheckOutcome.js

@@ -0,0 +1,7 @@
+/* Pure baseline-comparison decision shared between check and ready slices. */
+export function baselineComparison(recordedToken, recomputedToken) {
+    if (recordedToken === recomputedToken) {
+        return { kind: "match", recordedToken, recomputedToken };
+    }
+    return { kind: "stale", recordedToken, recomputedToken };
+}

package/dist/shared/domain/CliOutput.d.ts

@@ -0,0 +1,10 @@
+import type { CliFailure, ExitCode } from "./Errors.js";
+export type OutputFormat = "human" | "json" | "yaml";
+export interface CommandResult {
+    exitCode: ExitCode;
+    stdout: string;
+    stderr: string;
+}
+export declare function ok(stdout: string): CommandResult;
+export declare function failed(failure: CliFailure, format: OutputFormat): CommandResult;
+export declare function withLf(value: string): string;