agent-sdd 1.0.3

package/dist/shared/domain/CliOutput.js

@@ -0,0 +1,29 @@
+export function ok(stdout) {
+    return { exitCode: 0, stdout: withLf(stdout), stderr: "" };
+}
+export function failed(failure, format) {
+    if (format === "json") {
+        return {
+            exitCode: failure.exitCode,
+            stdout: `${JSON.stringify({
+                format_version: 1,
+                ok: false,
+                reason: failure.reason,
+                path: failure.path,
+                detail: failure.detail ?? failure.message,
+            })}\n`,
+            stderr: "",
+        };
+    }
+    return {
+        exitCode: failure.exitCode,
+        stdout: "",
+        stderr: `${failure.reason}: ${failure.message}${failure.detail ? ` (${failure.detail})` : ""}\n`,
+    };
+}
+export function withLf(value) {
+    if (value.length === 0 || value.endsWith("\n")) {
+        return value;
+    }
+    return `${value}\n`;
+}

package/dist/shared/domain/Config.d.ts

@@ -0,0 +1,29 @@
+export type Mechanism = "git_tree_hash_v1";
+export interface FootprintConfig {
+    bindingIdPrefix: string;
+    bindingField: string;
+}
+export interface Partition {
+    name: string;
+    specPaths: string[];
+    testPaths: string[];
+    sandboxPaths: string[];
+}
+export interface SddConfig {
+    specFile: string;
+    baselineId: string;
+    discoveryScope: string[];
+    footprint: FootprintConfig;
+    mechanism: Mechanism;
+    lint: LintConfig;
+    partitions: Partition[];
+    /** Directory under <repo_root> where attestation plan files live (P0.6).
+     *  Default: ".sdd/plans". */
+    plansDir: string;
+}
+export interface LintConfig {
+    specFiles: string[];
+    approverBlocklist: string[];
+    partitionGlob: string[];
+}
+export declare function configFromJson(value: unknown, path: string): SddConfig;

package/dist/shared/domain/Config.js

@@ -0,0 +1,201 @@
+import { configFailure } from "./Errors.js";
+import { NORMATIVE_ID_RE, PARTITION_NAME_RE } from "./PartitionGrammar.js";
+const TOP_LEVEL_FIELDS = new Set([
+    "$schema",
+    "spec_file",
+    "baseline_id",
+    "discovery_scope",
+    "footprint",
+    "mechanism",
+    "lint",
+    "partitions",
+    "plans_dir",
+    "test_paths",
+    "sandbox_paths",
+]);
+const DEFAULT_PLANS_DIR = ".sdd/plans";
+const FOOTPRINT_FIELDS = new Set(["binding_id_prefix", "binding_field"]);
+const LINT_FIELDS = new Set([
+    "spec_files",
+    "approver_blocklist",
+    "partition_glob",
+]);
+const PARTITION_FIELDS = new Set(["spec_paths", "test_paths", "sandbox_paths"]);
+const DEFAULT_PARTITION_NAME = "default";
+export function configFromJson(value, path) {
+    if (!isObject(value)) {
+        throw configFailure("config-invalid", ".sdd/config.json must be a JSON object", undefined, path);
+    }
+    for (const key of Object.keys(value)) {
+        if (!TOP_LEVEL_FIELDS.has(key)) {
+            throw configFailure("config-invalid", `unknown config field: ${key}`, undefined, path);
+        }
+    }
+    const specFile = stringField(value, "spec_file", path);
+    const baselineId = stringField(value, "baseline_id", path);
+    const discoveryScope = stringArrayField(value, "discovery_scope", path);
+    const mechanism = stringField(value, "mechanism", path);
+    if (mechanism !== "git_tree_hash_v1") {
+        throw configFailure("config-invalid", `unsupported mechanism: ${mechanism}`, undefined, path);
+    }
+    if (!NORMATIVE_ID_RE.test(baselineId)) {
+        throw configFailure("config-invalid", `invalid baseline_id: ${baselineId}`, undefined, path);
+    }
+    const lint = lintConfig(value.lint, path, specFile);
+    const topLevelTestPaths = optionalGlobArrayField(value, "test_paths", path);
+    const topLevelSandboxPaths = optionalGlobArrayField(value, "sandbox_paths", path);
+    const partitions = partitionsField(value.partitions, path, lint.specFiles, topLevelTestPaths, topLevelSandboxPaths);
+    const plansDir = optionalStringField(value, "plans_dir", path) ?? DEFAULT_PLANS_DIR;
+    return {
+        specFile,
+        baselineId,
+        discoveryScope,
+        footprint: footprintConfig(value.footprint, path),
+        mechanism,
+        lint,
+        partitions,
+        plansDir,
+    };
+}
+function partitionsField(raw, path, lintSpecFiles, topLevelTestPaths, topLevelSandboxPaths) {
+    if (raw === undefined) {
+        return [
+            {
+                name: DEFAULT_PARTITION_NAME,
+                specPaths: [...lintSpecFiles],
+                testPaths: topLevelTestPaths,
+                sandboxPaths: topLevelSandboxPaths,
+            },
+        ];
+    }
+    if (!isObject(raw)) {
+        throw configFailure("config-invalid", "partitions must be an object", undefined, path);
+    }
+    const out = [];
+    for (const name of Object.keys(raw)) {
+        if (!PARTITION_NAME_RE.test(name)) {
+            throw configFailure("config-invalid", `invalid partition name "${name}" — must match /^[a-z][a-z0-9-]*(:[a-z][a-z0-9-]*)*$/`, undefined, path);
+        }
+        const entry = raw[name];
+        if (!isObject(entry)) {
+            throw configFailure("config-invalid", `partitions.${name} must be an object`, undefined, path);
+        }
+        for (const key of Object.keys(entry)) {
+            if (!PARTITION_FIELDS.has(key)) {
+                throw configFailure("config-invalid", `unknown partition field: partitions.${name}.${key}`, undefined, path);
+            }
+        }
+        const specPaths = stringArrayField(entry, "spec_paths", path);
+        const testPaths = optionalGlobArrayField(entry, "test_paths", path);
+        const sandboxPaths = optionalGlobArrayField(entry, "sandbox_paths", path);
+        out.push({ name, specPaths, testPaths, sandboxPaths });
+    }
+    if (out.length === 0) {
+        throw configFailure("config-invalid", "partitions must declare at least one entry when present", undefined, path);
+    }
+    return out;
+}
+function optionalGlobArrayField(value, key, path) {
+    const field = value[key];
+    if (field === undefined) {
+        return [];
+    }
+    if (!Array.isArray(field)) {
+        throw configFailure("config-invalid", `${key} must be an array`, undefined, path);
+    }
+    if (!field.every((entry) => typeof entry === "string" && entry.length > 0)) {
+        throw configFailure("config-invalid", `${key} entries must be non-empty strings`, undefined, path);
+    }
+    return [...field];
+}
+function lintConfig(value, path, specFileFallback) {
+    if (value === undefined) {
+        return {
+            specFiles: [specFileFallback],
+            approverBlocklist: [],
+            partitionGlob: [],
+        };
+    }
+    if (!isObject(value)) {
+        throw configFailure("config-invalid", "lint must be an object", undefined, path);
+    }
+    for (const key of Object.keys(value)) {
+        if (!LINT_FIELDS.has(key)) {
+            throw configFailure("config-invalid", `unknown lint field: ${key}`, undefined, path);
+        }
+    }
+    const specFilesRaw = value.spec_files;
+    const specFiles = specFilesRaw === undefined
+        ? [specFileFallback]
+        : nonEmptyStringArray(specFilesRaw, "lint.spec_files", path);
+    const approverBlocklist = optionalStringArray(value.approver_blocklist, "lint.approver_blocklist", path);
+    const partitionGlob = optionalStringArray(value.partition_glob, "lint.partition_glob", path);
+    return { specFiles, approverBlocklist, partitionGlob };
+}
+function nonEmptyStringArray(raw, field, path) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        throw configFailure("config-invalid", `${field} must be a non-empty array`, undefined, path);
+    }
+    return assertStringEntries(raw, field, path);
+}
+function optionalStringArray(raw, field, path) {
+    if (raw === undefined) {
+        return [];
+    }
+    if (!Array.isArray(raw)) {
+        throw configFailure("config-invalid", `${field} must be an array`, undefined, path);
+    }
+    return assertStringEntries(raw, field, path);
+}
+function assertStringEntries(raw, field, path) {
+    if (!raw.every((entry) => typeof entry === "string" && entry.length > 0)) {
+        throw configFailure("config-invalid", `${field} entries must be non-empty strings`, undefined, path);
+    }
+    return [...raw];
+}
+function footprintConfig(value, path) {
+    if (value === undefined) {
+        return { bindingIdPrefix: "IMP-", bindingField: "binding" };
+    }
+    if (!isObject(value)) {
+        throw configFailure("config-invalid", "footprint must be an object", undefined, path);
+    }
+    for (const key of Object.keys(value)) {
+        if (!FOOTPRINT_FIELDS.has(key)) {
+            throw configFailure("config-invalid", `unknown footprint field: ${key}`, undefined, path);
+        }
+    }
+    const bindingIdPrefix = optionalStringField(value, "binding_id_prefix", path) ?? "IMP-";
+    const bindingField = optionalStringField(value, "binding_field", path) ?? "binding";
+    return { bindingIdPrefix, bindingField };
+}
+function stringField(value, key, path) {
+    const field = value[key];
+    if (typeof field !== "string" || field.length === 0) {
+        throw configFailure("config-invalid", `${key} must be a non-empty string`, undefined, path);
+    }
+    return field;
+}
+function optionalStringField(value, key, path) {
+    const field = value[key];
+    if (field === undefined) {
+        return undefined;
+    }
+    if (typeof field !== "string" || field.length === 0) {
+        throw configFailure("config-invalid", `${key} must be a non-empty string`, undefined, path);
+    }
+    return field;
+}
+function stringArrayField(value, key, path) {
+    const field = value[key];
+    if (!Array.isArray(field) || field.length === 0) {
+        throw configFailure("config-invalid", `${key} must be a non-empty array`, undefined, path);
+    }
+    if (!field.every((entry) => typeof entry === "string" && entry.length > 0)) {
+        throw configFailure("config-invalid", `${key} entries must be non-empty strings`, undefined, path);
+    }
+    return field;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/shared/domain/DiagnosticRegistry.d.ts

@@ -0,0 +1,8 @@
+export declare const LINT_DIAGNOSTIC_IDS: readonly ["sdd:section-presence", "sdd:section-order", "sdd:weasel-word", "sdd:lifecycle-status-present", "sdd:lifecycle-status-valid", "sdd:approval-record-required", "sdd:approval-record-forbidden", "sdd:test-obligation-required", "sdd:type-version-int", "sdd:type-invariant-evidence", "sdd:type-invariant-stability", "sdd:type-data-scope", "sdd:type-nfr-stage", "sdd:type-migration-direction", "sdd:type-migration-mode", "sdd:type-migration-runtime-state", "sdd:type-surface-boundary-type", "sdd:baseline-version-required", "sdd:deprecated-fields-required", "sdd:assumption-downgrade-approval", "sdd:partition-default-policy-set", "sdd:generated-artifact-surface-ref", "sdd:boundary-policy-ref", "sdd:boundary-concurrency-model", "sdd:applicability-required", "sdd:data-scope-required", "sdd:migration-enforcement-stage", "sdd:migration-cross-partition", "sdd:debt-budget-form", "sdd:open-q-blocking"];
+export type LintDiagnosticId = (typeof LINT_DIAGNOSTIC_IDS)[number];
+export declare const READY_VIOLATION_KINDS: readonly ["unapproved", "uncovered", "removed_no_compat_test", "removed_compat_action_mismatch", "surface_unapproved_ref", "orphan_covers", "unknown_partition_covers", "aggregated_lint", "aggregated_check", "surface_semver_cascade", "generated_artifact_structural_diff_unbumped", "debt_budget_increased"];
+export type ReadyViolationKindId = (typeof READY_VIOLATION_KINDS)[number];
+export declare const DOCTOR_DRIFT_KINDS: readonly ["version_mismatch", "missing_diagnostic", "stale_diagnostic"];
+export type DoctorDriftKindId = (typeof DOCTOR_DRIFT_KINDS)[number];
+export declare const LINT_DIAGNOSTIC_ID_GRAMMAR: RegExp;
+export declare const READY_VIOLATION_KIND_GRAMMAR: RegExp;

package/dist/shared/domain/DiagnosticRegistry.js

@@ -0,0 +1,71 @@
+/*
+ * Source of truth for Surface `sdd-cli/diagnostics` (SUR-009): the
+ * published rule / violation-kind identifiers. Coverage with src/ is
+ * enforced by diagnostic-registry-coverage.test.ts (INV-010).
+ */
+export const LINT_DIAGNOSTIC_IDS = [
+    "sdd:section-presence",
+    "sdd:section-order",
+    "sdd:weasel-word",
+    "sdd:lifecycle-status-present",
+    "sdd:lifecycle-status-valid",
+    "sdd:approval-record-required",
+    "sdd:approval-record-forbidden",
+    "sdd:test-obligation-required",
+    "sdd:type-version-int",
+    "sdd:type-invariant-evidence",
+    "sdd:type-invariant-stability",
+    "sdd:type-data-scope",
+    "sdd:type-nfr-stage",
+    "sdd:type-migration-direction",
+    "sdd:type-migration-mode",
+    "sdd:type-migration-runtime-state",
+    "sdd:type-surface-boundary-type",
+    /* P1 — cheap requiredness gaps (ENF-003/009/010/011/012) */
+    "sdd:baseline-version-required",
+    "sdd:deprecated-fields-required",
+    "sdd:assumption-downgrade-approval",
+    "sdd:partition-default-policy-set",
+    "sdd:generated-artifact-surface-ref",
+    /* P2.1 — boundary requiredness (ENF-013/014/015/016) */
+    "sdd:boundary-policy-ref",
+    "sdd:boundary-concurrency-model",
+    "sdd:applicability-required",
+    "sdd:data-scope-required",
+    /* P2.2 — migration consistency (ENF-017/018) */
+    "sdd:migration-enforcement-stage",
+    "sdd:migration-cross-partition",
+    /* P3.1 — debt budget form (ENF-020) */
+    "sdd:debt-budget-form",
+    /* unresolved blocking Open-Q (ENF-059) */
+    "sdd:open-q-blocking",
+];
+export const READY_VIOLATION_KINDS = [
+    "unapproved",
+    "uncovered",
+    "removed_no_compat_test",
+    "removed_compat_action_mismatch",
+    "surface_unapproved_ref",
+    "orphan_covers",
+    "unknown_partition_covers",
+    "aggregated_lint",
+    "aggregated_check",
+    /* P2.3 — semver cascade (ENF-004A) shipped as severity:warn initially */
+    "surface_semver_cascade",
+    /* P2.3-stretch — structural diff in a published GeneratedArtifact (ENF-019) */
+    "generated_artifact_structural_diff_unbumped",
+    /* P3.2 — debt-budget monotonicity check (ENF-020 runtime side) */
+    "debt_budget_increased",
+];
+/*
+ * Drift kinds published by `sdd doctor` (CTR-022 / ENF-008). Not lint or ready
+ * diagnostics — they are doctor's own surface — but `sdd doctor` must treat
+ * them as known so a registry row declaring them does not self-report missing.
+ */
+export const DOCTOR_DRIFT_KINDS = [
+    "version_mismatch",
+    "missing_diagnostic",
+    "stale_diagnostic",
+];
+export const LINT_DIAGNOSTIC_ID_GRAMMAR = /^sdd:[a-z][a-z0-9-]*$/;
+export const READY_VIOLATION_KIND_GRAMMAR = /^[a-z][a-z0-9_]*$/;

package/dist/shared/domain/Errors.d.ts

@@ -0,0 +1,12 @@
+export type ExitCode = 0 | 1 | 2 | 3;
+export type FailureReason = "baseline-dirty" | "baseline-stale" | "config-missing" | "config-invalid" | "baseline-block-missing" | "baseline-block-duplicate" | "git-not-on-path" | "not-a-git-repo" | "head-unborn";
+export declare class CliFailure extends Error {
+    readonly exitCode: ExitCode;
+    readonly reason: FailureReason;
+    readonly path?: string;
+    readonly detail?: string;
+    constructor(exitCode: ExitCode, reason: FailureReason, message: string, detail?: string, path?: string);
+}
+export declare function configFailure(reason: FailureReason, message: string, detail?: string, path?: string): CliFailure;
+export declare function environmentFailure(reason: FailureReason, message: string, detail?: string): CliFailure;
+export declare function errorMessage(e: unknown): string;

package/dist/shared/domain/Errors.js

@@ -0,0 +1,23 @@
+export class CliFailure extends Error {
+    exitCode;
+    reason;
+    path;
+    detail;
+    constructor(exitCode, reason, message, detail, path) {
+        super(message);
+        this.name = "CliFailure";
+        this.exitCode = exitCode;
+        this.reason = reason;
+        this.detail = detail;
+        this.path = path;
+    }
+}
+export function configFailure(reason, message, detail, path) {
+    return new CliFailure(2, reason, message, detail, path);
+}
+export function environmentFailure(reason, message, detail) {
+    return new CliFailure(3, reason, message, detail);
+}
+export function errorMessage(e) {
+    return e instanceof Error ? e.message : String(e);
+}

package/dist/shared/domain/GlobMatch.d.ts

@@ -0,0 +1,2 @@
+export declare function matchesGlob(pattern: string, path: string): boolean;
+export declare function fileInGlobs(file: string, patterns: readonly string[]): boolean;

package/dist/shared/domain/GlobMatch.js

@@ -0,0 +1,58 @@
+/*
+ * Pattern-match a posix-style file path against a glob pattern (the CST-006
+ * dialect: `*` = any chars within a segment, `?` = single char, `**` =
+ * zero-or-more directory levels, literal segments). Pure; no I/O.
+ */
+export function matchesGlob(pattern, path) {
+    const patternSegments = pattern.split("/").filter((s) => s.length > 0);
+    const pathSegments = path.split("/").filter((s) => s.length > 0);
+    return matchSegments(patternSegments, 0, pathSegments, 0);
+}
+function matchSegments(p, pi, x, xi) {
+    if (pi === p.length) {
+        return xi === x.length;
+    }
+    const head = p[pi];
+    if (head === "**") {
+        if (pi === p.length - 1) {
+            return true;
+        }
+        for (let k = xi; k <= x.length; k++) {
+            if (matchSegments(p, pi + 1, x, k)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    if (xi === x.length) {
+        return false;
+    }
+    if (!segmentMatches(head, x[xi])) {
+        return false;
+    }
+    return matchSegments(p, pi + 1, x, xi + 1);
+}
+function segmentMatches(pattern, name) {
+    if (!hasGlob(pattern)) {
+        return pattern === name;
+    }
+    const re = new RegExp(`^${pattern
+        .split("")
+        .map((c) => {
+        if (c === "*") {
+            return "[^/]*";
+        }
+        if (c === "?") {
+            return "[^/]";
+        }
+        return c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    })
+        .join("")}$`);
+    return re.test(name);
+}
+function hasGlob(value) {
+    return /[*?[\]]/.test(value);
+}
+export function fileInGlobs(file, patterns) {
+    return patterns.some((p) => matchesGlob(p, file));
+}

package/dist/shared/domain/LintReport.d.ts

@@ -0,0 +1,16 @@
+import type { LintDiagnosticId } from "./DiagnosticRegistry.js";
+export type DiagnosticSeverity = "error" | "warn";
+export interface Diagnostic {
+    severity: DiagnosticSeverity;
+    rule: LintDiagnosticId;
+    file: string;
+    line?: number;
+    message: string;
+}
+export interface LintReport {
+    diagnostics: Diagnostic[];
+    errorCount: number;
+    warnCount: number;
+}
+export declare function emptyReport(): LintReport;
+export declare function appendDiagnostic(report: LintReport, d: Diagnostic): LintReport;

package/dist/shared/domain/LintReport.js

@@ -0,0 +1,11 @@
+/* Lint diagnostics shared between lint and ready slices. */
+export function emptyReport() {
+    return { diagnostics: [], errorCount: 0, warnCount: 0 };
+}
+export function appendDiagnostic(report, d) {
+    return {
+        diagnostics: [...report.diagnostics, d],
+        errorCount: report.errorCount + (d.severity === "error" ? 1 : 0),
+        warnCount: report.warnCount + (d.severity === "warn" ? 1 : 0),
+    };
+}

package/dist/shared/domain/LintRules.d.ts

@@ -0,0 +1,67 @@
+import type { Diagnostic } from "./LintReport.js";
+import { type LintRecord } from "./SpecRecord.js";
+import { WEASEL_ABSOLUTE, WEASEL_MODAL_IN_NORMATIVE } from "./WeaselWords.js";
+export declare const REQUIRED_PARTITION_SECTIONS: ReadonlyArray<string>;
+export declare const NORMATIVE_SECTIONS: ReadonlyArray<string>;
+export declare const WEASEL_WORDS: ReadonlyArray<string>;
+export { WEASEL_ABSOLUTE, WEASEL_MODAL_IN_NORMATIVE };
+export declare function lifecycleStatusRules(rec: LintRecord): Diagnostic[];
+export declare function approvalRecordRules(rec: LintRecord): Diagnostic[];
+export declare function testObligationRules(rec: LintRecord): Diagnostic[];
+export declare function fieldTypeRules(rec: LintRecord): Diagnostic[];
+/** ENF-003: Delta and Migration records MUST pin a baseline_version. */
+export declare function baselineVersionRequiredRule(rec: LintRecord): Diagnostic[];
+/** ENF-009: records with lifecycle.status=deprecated MUST carry both
+ *  sunset_version and replacement_id (SDD §1.6). */
+export declare function deprecatedFieldsRequiredRule(rec: LintRecord): Diagnostic[];
+/** ENF-059: an Open-Q with blocking=yes fails spec-valid (SDD §0);
+ *  a `removed` Open-Q is already resolved and does not fire. */
+export declare function openQBlockingRule(rec: LintRecord): Diagnostic[];
+/** ENF-010: ASSUMPTIONs downgraded to blocking=advisory MUST carry an
+ *  approval_record with a non-agent approver (SDD §7.5); OQ-018 tracks
+ *  whether blocking=no should also fire. */
+export declare function assumptionDowngradeApprovalRule(rec: LintRecord, approverBlocklist?: readonly string[]): Diagnostic[];
+/** ENF-011: Partition records MUST carry a default_policy_set field (an array;
+ *  empty allowed — explicit "no policies" is still a typed value). */
+export declare function partitionDefaultPolicySetRule(rec: LintRecord): Diagnostic[];
+/** ENF-012: GeneratedArtifact records that publish a Surface (published_surface
+ *  == "yes") MUST carry a surface_ref. */
+export declare function generatedArtifactSurfaceRefRule(rec: LintRecord): Diagnostic[];
+/** ENF-013: boundary CTR/BEH must declare policy_refs (or an explicit
+ *  policy_override block with a rationale). */
+export declare function boundaryPolicyRefRule(rec: LintRecord, boundaryIds: ReadonlySet<string>): Diagnostic[];
+/** ENF-014: boundary CTR/BEH must declare concurrency_model with the four
+ *  required sub-fields. */
+export declare function boundaryConcurrencyModelRule(rec: LintRecord, boundaryIds: ReadonlySet<string>): Diagnostic[];
+/** ENF-015: boundary CTR/BEH must declare an applicability field (a typed
+ *  axis-classification block; `invariant_to_all_axes: true` is acceptable). */
+export declare function applicabilityRequiredRule(rec: LintRecord, boundaryIds: ReadonlySet<string>): Diagnostic[];
+/** ENF-016: boundary CTR/BEH touching persistent state must declare
+ *  data_scope (allowing `not_applicable` with a reason); persistence is
+ *  detected heuristically — see the spec record for the predicate. */
+export declare function dataScopeRequiredRule(rec: LintRecord, boundaryIds: ReadonlySet<string>): Diagnostic[];
+/** ENF-017: an Invariant/Contract/Behavior with data_scope
+ *  `post_migration:<MIG-ID>` requires the referenced Migration to exist and
+ *  to declare a non-empty `enforcement_stage` (presence is what we check). */
+export declare function migrationEnforcementStageRule(rec: LintRecord, records: ReadonlyArray<LintRecord>): Diagnostic[];
+/** ENF-020 (P3.1): every Partition record must carry an `unmodeled_budget`
+ *  block with the required sub-fields (current, baseline_at, baseline_value,
+ *  trend) — see the spec record for the per-field constraints. */
+export declare function debtBudgetFormRule(rec: LintRecord): Diagnostic[];
+/** ENF-018: a Migration whose target_ids reference IDs from more than one
+ *  partition MUST declare partition_slice[] entries with coordinator_id set. */
+export declare function migrationCrossPartitionRule(rec: LintRecord): Diagnostic[];
+export interface SectionViolation {
+    rule: "sdd:section-presence" | "sdd:section-order";
+    message: string;
+}
+export declare function sectionViolations(markdown: string): SectionViolation[];
+export interface WeaselFinding {
+    line: number;
+    word: string;
+    section: string;
+    /** Present only for modal-pass findings. Names the normative field where
+     *  the word was found, e.g. "Behavior.then". */
+    field?: string;
+}
+export declare function weaselFindings(markdown: string, records?: ReadonlyArray<LintRecord>): WeaselFinding[];