agent-sdd 1.0.3

package/dist/features/approve/adapters/inbound/CliApproveHandler.d.ts

@@ -0,0 +1,17 @@
+import { type CommandResult, type OutputFormat } from "../../../../shared/domain/CliOutput.js";
+import { type ApplyApprovalPorts } from "../../application/ApplyApproval.js";
+import { type WriteAttestationPorts } from "../../application/WriteAttestation.js";
+import type { ApproveCommand, ApproveRequest } from "../../ports/inbound/ApproveCommand.js";
+export interface ApproveCliPorts extends ApplyApprovalPorts, WriteAttestationPorts {
+}
+export interface ApproveExecutionMode {
+    inline: boolean;
+    planId?: string;
+}
+export declare class CliApproveHandler implements ApproveCommand {
+    private readonly ports;
+    constructor(ports: ApproveCliPorts);
+    execute(cwd: string, req: ApproveRequest, format: Exclude<OutputFormat, "yaml">, mode?: ApproveExecutionMode): Promise<CommandResult>;
+    private executeInline;
+    private executePlan;
+}

package/dist/features/approve/adapters/inbound/CliApproveHandler.js

@@ -0,0 +1,108 @@
+import { failed, ok, } from "../../../../shared/domain/CliOutput.js";
+import { CliFailure } from "../../../../shared/domain/Errors.js";
+import { applyApproval, } from "../../application/ApplyApproval.js";
+import { writeAttestation, } from "../../application/WriteAttestation.js";
+export class CliApproveHandler {
+    ports;
+    constructor(ports) {
+        this.ports = ports;
+    }
+    async execute(cwd, req, format, mode) {
+        const inline = mode?.inline === true;
+        try {
+            if (inline) {
+                return await this.executeInline(cwd, req, format);
+            }
+            return await this.executePlan(cwd, req, mode?.planId, format);
+        }
+        catch (error) {
+            if (error instanceof CliFailure) {
+                return failed(error, format);
+            }
+            throw error;
+        }
+    }
+    async executeInline(cwd, req, format) {
+        const outcome = await applyApproval(cwd, req, this.ports);
+        if (outcome.kind === "refused") {
+            return refusalResult(outcome.refusal, format);
+        }
+        const stderr = `DEPRECATED: --inline will be removed in v1.1.0; use \`sdd approve\` + \`sdd finalize\` instead.\n`;
+        if (format === "json") {
+            return {
+                exitCode: 0,
+                stdout: `${JSON.stringify({
+                    format_version: 1,
+                    ok: true,
+                    mode: "inline",
+                    matched_ids: outcome.matchedIds,
+                    files_changed: outcome.filesChanged,
+                })}\n`,
+                stderr,
+            };
+        }
+        const lines = [];
+        for (const id of outcome.matchedIds) {
+            lines.push(`approve: ${id} → ${req.targetStatus} (approver=${req.approver})`);
+        }
+        lines.push("");
+        lines.push(`approve --inline: rewrote ${outcome.matchedIds.length} record(s) in ${outcome.filesChanged.length} file(s).`);
+        lines.push(`approve: re-run \`sdd lint\` to verify spec-valid.`);
+        return { exitCode: 0, stdout: `${lines.join("\n")}\n`, stderr };
+    }
+    async executePlan(cwd, req, planId, format) {
+        const outcome = await writeAttestation(cwd, req, planId, this.ports);
+        if (outcome.kind === "refused") {
+            return refusalResult(outcome.refusal, format);
+        }
+        if (format === "json") {
+            return ok(JSON.stringify({
+                format_version: 1,
+                ok: true,
+                mode: "plan",
+                plan_id: outcome.result.planId,
+                plan_path: outcome.result.planPath,
+                is_new_plan: outcome.result.isNewPlan,
+                attestation: {
+                    id: outcome.attestation.id,
+                    owner_role: outcome.attestation.ownerRole,
+                    approver_identity: outcome.attestation.approverIdentity,
+                    timestamp: outcome.attestation.timestamp,
+                    target_status: outcome.attestation.targetStatus,
+                },
+            }));
+        }
+        const lines = [];
+        lines.push(`approve: ${req.id} → ${req.targetStatus} (approver=${req.approver})`);
+        lines.push("");
+        lines.push(`approve: queued attestation in ${outcome.result.planPath}`);
+        lines.push(`         plan_id=${outcome.result.planId} (${outcome.result.isNewPlan ? "new plan" : "existing plan"})`);
+        lines.push(`approve: run \`sdd plan show\` to review, \`sdd finalize\` to apply.`);
+        return ok(lines.join("\n"));
+    }
+}
+function refusalResult(refusal, format) {
+    const message = refusalMessage(refusal);
+    if (format === "json") {
+        return {
+            exitCode: 1,
+            stdout: `${JSON.stringify({
+                format_version: 1,
+                ok: false,
+                reason: refusal.kind,
+                detail: message,
+            })}\n`,
+            stderr: "",
+        };
+    }
+    return { exitCode: 1, stdout: "", stderr: `approve: REFUSED — ${message}\n` };
+}
+function refusalMessage(refusal) {
+    if (refusal.kind === "agent-approver") {
+        return `approver "${refusal.approver}" is in the agent blocklist (SDD §7.5: self-approval forbidden). See spec/APPROVAL.md for the human-owned workflow.`;
+    }
+    if (refusal.kind === "invalid-owner-role") {
+        return `owner-role "${refusal.ownerRole}" not in valid set: tech-lead, architect, security-owner, platform-runtime-lead, product-owner, compliance.`;
+    }
+    return `no normative ID records matched "${refusal.id}".`;
+}

package/dist/features/approve/adapters/outbound/NodeApproveFileSystem.d.ts

@@ -0,0 +1,8 @@
+import { type SddConfig } from "../../../../shared/domain/Config.js";
+import type { ApproveConfigPort } from "../../ports/outbound/ApproveConfigPort.js";
+import type { ApproveFileSystem, SpecFileEntry } from "../../ports/outbound/ApproveFileSystem.js";
+export declare class NodeApproveFileSystem implements ApproveConfigPort, ApproveFileSystem {
+    config(repoRoot: string): Promise<SddConfig>;
+    resolveSpecFiles(repoRoot: string, patterns: readonly string[]): Promise<SpecFileEntry[]>;
+    writeSpecFile(repoRoot: string, relativePath: string, content: string): Promise<void>;
+}

package/dist/features/approve/adapters/outbound/NodeApproveFileSystem.js

@@ -0,0 +1,147 @@
+import { readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { configFromJson, } from "../../../../shared/domain/Config.js";
+import { configFailure } from "../../../../shared/domain/Errors.js";
+export class NodeApproveFileSystem {
+    async config(repoRoot) {
+        const configPath = join(repoRoot, ".sdd", "config.json");
+        const text = await readConfig(configPath);
+        return configFromJson(parseConfigJson(text, configPath), configPath);
+    }
+    async resolveSpecFiles(repoRoot, patterns) {
+        const matched = new Set();
+        for (const pattern of patterns) {
+            for (const abs of await expandGlob(repoRoot, pattern)) {
+                matched.add(abs);
+            }
+        }
+        const list = [...matched].sort();
+        const out = [];
+        for (const abs of list) {
+            const text = await readFile(abs, "utf8");
+            const rel = relative(repoRoot, abs).split("\\").join("/");
+            out.push({ path: rel, content: text });
+        }
+        return out;
+    }
+    async writeSpecFile(repoRoot, relativePath, content) {
+        const abs = resolve(repoRoot, relativePath);
+        await writeFile(abs, content, "utf8");
+    }
+}
+async function expandGlob(repoRoot, pattern) {
+    const normalised = pattern.split("\\").join("/");
+    if (!hasGlob(normalised)) {
+        const abs = resolve(repoRoot, normalised);
+        return (await isFile(abs)) ? [abs] : [];
+    }
+    const segments = normalised.split("/");
+    const literal = [];
+    let firstGlobIndex = -1;
+    for (let i = 0; i < segments.length; i++) {
+        if (hasGlob(segments[i])) {
+            firstGlobIndex = i;
+            break;
+        }
+        literal.push(segments[i]);
+    }
+    const baseDir = resolve(repoRoot, ...literal);
+    const remaining = segments.slice(firstGlobIndex);
+    const out = [];
+    await walk(baseDir, remaining, out);
+    return out;
+}
+async function walk(dir, remaining, acc) {
+    if (remaining.length === 0) {
+        return;
+    }
+    const head = remaining[0];
+    const rest = remaining.slice(1);
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    if (head === "**") {
+        if (rest.length === 0) {
+            for (const e of entries) {
+                const abs = join(dir, e.name);
+                if (e.isDirectory()) {
+                    await walk(abs, ["**"], acc);
+                }
+                else if (e.isFile()) {
+                    acc.push(abs);
+                }
+            }
+            return;
+        }
+        for (const e of entries) {
+            if (e.isDirectory()) {
+                await walk(join(dir, e.name), remaining, acc);
+            }
+        }
+        await walk(dir, rest, acc);
+        return;
+    }
+    for (const e of entries) {
+        if (!matchSegment(head, e.name)) {
+            continue;
+        }
+        const abs = join(dir, e.name);
+        if (rest.length === 0) {
+            if (e.isFile()) {
+                acc.push(abs);
+            }
+            continue;
+        }
+        if (e.isDirectory()) {
+            await walk(abs, rest, acc);
+        }
+    }
+}
+function matchSegment(pattern, name) {
+    if (!hasGlob(pattern)) {
+        return pattern === name;
+    }
+    const re = new RegExp(`^${pattern
+        .split("")
+        .map((c) => c === "*"
+        ? "[^/]*"
+        : c === "?"
+            ? "[^/]"
+            : c.replace(/[.+^${}()|[\]\\]/g, "\\$&"))
+        .join("")}$`);
+    return re.test(name);
+}
+function hasGlob(value) {
+    return /[*?[\]]/.test(value);
+}
+async function isFile(abs) {
+    try {
+        return (await stat(abs)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function readConfig(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        throw configFailure("config-missing", ".sdd/config.json is missing or unreadable", errorMessage(error), path);
+    }
+}
+function parseConfigJson(text, path) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw configFailure("config-invalid", ".sdd/config.json is not valid JSON", errorMessage(error), path);
+    }
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/features/approve/adapters/outbound/NodePlanFileWriter.d.ts

@@ -0,0 +1,6 @@
+import { type PendingAttestation, type PlanFileShape } from "../../../../shared/domain/PlanFile.js";
+import type { AppendAttestationResult, PlanFileWriter } from "../../ports/outbound/PlanFileWriter.js";
+export declare class NodePlanFileWriter implements PlanFileWriter {
+    appendAttestation(repoRoot: string, plansDir: string, planId: string | undefined, attestation: PendingAttestation): Promise<AppendAttestationResult>;
+    readPlan(repoRoot: string, plansDir: string, planId: string): Promise<PlanFileShape | null>;
+}

package/dist/features/approve/adapters/outbound/NodePlanFileWriter.js

@@ -0,0 +1,92 @@
+import { promises as fs } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { parse as yamlParse } from "yaml";
+import { generatePlanId, isoBasicUtc, parsePlanFile, serialisePlanFile, } from "../../../../shared/domain/PlanFile.js";
+export class NodePlanFileWriter {
+    async appendAttestation(repoRoot, plansDir, planId, attestation) {
+        const dirAbs = resolve(repoRoot, plansDir);
+        await fs.mkdir(dirAbs, { recursive: true });
+        const resolvedPlanId = await resolveOrMintPlanId(dirAbs, planId);
+        const planPathAbs = join(dirAbs, `${resolvedPlanId.id}.yaml`);
+        const planPathRel = relative(repoRoot, planPathAbs).split("\\").join("/");
+        let plan;
+        let isNewPlan = false;
+        if (await pathExists(planPathAbs)) {
+            const raw = await fs.readFile(planPathAbs, "utf8");
+            plan = parsePlanFile(yamlParse(raw));
+        }
+        else {
+            plan = {
+                planId: resolvedPlanId.id,
+                createdAt: new Date().toISOString(),
+                pendingAttestations: [],
+            };
+            isNewPlan = true;
+        }
+        plan.pendingAttestations.push(attestation);
+        await writeAtomic(planPathAbs, serialisePlanFile(plan));
+        if (isNewPlan && resolvedPlanId.shouldUpdateActive) {
+            await fs.writeFile(join(dirAbs, ".active"), `${plan.planId}\n`, "utf8");
+        }
+        return {
+            planId: plan.planId,
+            planPath: planPathRel,
+            isNewPlan,
+            pendingAfter: plan.pendingAttestations.length,
+        };
+    }
+    async readPlan(repoRoot, plansDir, planId) {
+        const planPathAbs = resolve(repoRoot, plansDir, `${planId}.yaml`);
+        if (!(await pathExists(planPathAbs))) {
+            return null;
+        }
+        const raw = await fs.readFile(planPathAbs, "utf8");
+        return parsePlanFile(yamlParse(raw));
+    }
+}
+async function resolveOrMintPlanId(dirAbs, explicit) {
+    if (explicit !== undefined) {
+        return { id: explicit, shouldUpdateActive: false };
+    }
+    const active = await readActive(dirAbs);
+    if (active !== null) {
+        return { id: active, shouldUpdateActive: false };
+    }
+    /* Mint: ensure no collision against existing plan files. */
+    for (let attempt = 0; attempt < 20; attempt++) {
+        const id = generatePlanId(new Date());
+        const planPath = join(dirAbs, `${id}.yaml`);
+        if (!(await pathExists(planPath))) {
+            return { id, shouldUpdateActive: true };
+        }
+    }
+    /* Fallback — extremely unlikely; suffix with a counter to break the tie. */
+    const id = `${generatePlanId(new Date())}-fallback`;
+    void isoBasicUtc; /* keep import */
+    return { id, shouldUpdateActive: true };
+}
+async function readActive(dirAbs) {
+    try {
+        const raw = await fs.readFile(join(dirAbs, ".active"), "utf8");
+        const id = raw.trim();
+        return id.length > 0 ? id : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeAtomic(path, content) {
+    const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+    await fs.mkdir(dirname(path), { recursive: true });
+    await fs.writeFile(tmp, content, "utf8");
+    await fs.rename(tmp, path);
+}
+async function pathExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/features/approve/adapters/outbound/SystemApproveClock.d.ts

@@ -0,0 +1,4 @@
+import type { ApproveClock } from "../../ports/outbound/ApproveClock.js";
+export declare class SystemApproveClock implements ApproveClock {
+    now(): Date;
+}

package/dist/features/approve/adapters/outbound/SystemApproveClock.js

@@ -0,0 +1,5 @@
+export class SystemApproveClock {
+    now() {
+        return new Date();
+    }
+}

package/dist/features/approve/application/ApplyApproval.d.ts

@@ -0,0 +1,19 @@
+import { type ApproveRefusal, type ApproveRequest } from "../domain/ApproveRequest.js";
+export type { ApproveRefusal };
+import type { ApproveClock } from "../ports/outbound/ApproveClock.js";
+import type { ApproveConfigPort } from "../ports/outbound/ApproveConfigPort.js";
+import type { ApproveFileSystem } from "../ports/outbound/ApproveFileSystem.js";
+export interface ApplyApprovalPorts {
+    clock: ApproveClock;
+    config: ApproveConfigPort;
+    files: ApproveFileSystem;
+}
+export type ApplyApprovalOutcome = {
+    kind: "refused";
+    refusal: ApproveRefusal;
+} | {
+    kind: "applied";
+    matchedIds: string[];
+    filesChanged: string[];
+};
+export declare function applyApproval(cwd: string, req: ApproveRequest, ports: ApplyApprovalPorts): Promise<ApplyApprovalOutcome>;

package/dist/features/approve/application/ApplyApproval.js

@@ -0,0 +1,30 @@
+import { classifyRefusal, } from "../domain/ApproveRequest.js";
+import { rewriteApproval } from "../domain/Rewrite.js";
+export async function applyApproval(cwd, req, ports) {
+    const config = await ports.config.config(cwd);
+    const refusal = classifyRefusal(req, config.lint.approverBlocklist);
+    if (refusal !== null) {
+        return { kind: "refused", refusal };
+    }
+    const entries = await ports.files.resolveSpecFiles(cwd, config.lint.specFiles);
+    const matchedIds = [];
+    const filesChanged = [];
+    const when = ports.clock.now();
+    for (const entry of entries) {
+        const result = rewriteApproval(entry.content, req, when);
+        if (result.matched.length === 0) {
+            continue;
+        }
+        if (result.newContent !== entry.content) {
+            await ports.files.writeSpecFile(cwd, entry.path, result.newContent);
+            filesChanged.push(entry.path);
+        }
+        for (const m of result.matched) {
+            matchedIds.push(m.id);
+        }
+    }
+    if (matchedIds.length === 0) {
+        return { kind: "refused", refusal: { kind: "no-id-match", id: req.id } };
+    }
+    return { kind: "applied", matchedIds, filesChanged };
+}

package/dist/features/approve/application/WriteAttestation.d.ts

@@ -0,0 +1,19 @@
+import type { PendingAttestation } from "../../../shared/domain/PlanFile.js";
+import { type ApproveRefusal, type ApproveRequest } from "../domain/ApproveRequest.js";
+import type { ApproveClock } from "../ports/outbound/ApproveClock.js";
+import type { ApproveConfigPort } from "../ports/outbound/ApproveConfigPort.js";
+import type { AppendAttestationResult, PlanFileWriter } from "../ports/outbound/PlanFileWriter.js";
+export interface WriteAttestationPorts {
+    clock: ApproveClock;
+    config: ApproveConfigPort;
+    plans: PlanFileWriter;
+}
+export type WriteAttestationOutcome = {
+    kind: "refused";
+    refusal: ApproveRefusal;
+} | {
+    kind: "appended";
+    result: AppendAttestationResult;
+    attestation: PendingAttestation;
+};
+export declare function writeAttestation(cwd: string, req: ApproveRequest, planId: string | undefined, ports: WriteAttestationPorts): Promise<WriteAttestationOutcome>;

package/dist/features/approve/application/WriteAttestation.js

@@ -0,0 +1,23 @@
+import { classifyRefusal, } from "../domain/ApproveRequest.js";
+export async function writeAttestation(cwd, req, planId, ports) {
+    const config = await ports.config.config(cwd);
+    const refusal = classifyRefusal(req, config.lint.approverBlocklist);
+    if (refusal !== null) {
+        return { kind: "refused", refusal };
+    }
+    const when = ports.clock.now();
+    const attestation = {
+        id: req.id,
+        ownerRole: req.ownerRole,
+        approverIdentity: req.approver,
+        timestamp: when.toISOString(),
+        changeRequest: req.changeRequest,
+        scope: req.scope,
+        targetStatus: req.targetStatus,
+        ...(req.reviewedTestOracle !== null
+            ? { reviewedTestOracle: req.reviewedTestOracle }
+            : {}),
+    };
+    const result = await ports.plans.appendAttestation(cwd, config.plansDir, planId, attestation);
+    return { kind: "appended", result, attestation };
+}

package/dist/features/approve/domain/ApproveRequest.d.ts

@@ -0,0 +1,24 @@
+export type TargetStatus = "approved" | "deprecated" | "removed";
+export declare const VALID_TARGET_STATUS: ReadonlySet<TargetStatus>;
+export declare const VALID_OWNER_ROLES: ReadonlySet<string>;
+export { BUILTIN_AGENT_BLOCKLIST } from "../../../shared/domain/AgentBlocklist.js";
+export interface ApproveRequest {
+    id: string;
+    approver: string;
+    ownerRole: string;
+    changeRequest: string;
+    scope: string;
+    targetStatus: TargetStatus;
+    reviewedTestOracle: string | null;
+}
+export type ApproveRefusal = {
+    kind: "agent-approver";
+    approver: string;
+} | {
+    kind: "invalid-owner-role";
+    ownerRole: string;
+} | {
+    kind: "no-id-match";
+    id: string;
+};
+export declare function classifyRefusal(req: ApproveRequest, extraBlocklist: readonly string[]): ApproveRefusal | null;

package/dist/features/approve/domain/ApproveRequest.js

@@ -0,0 +1,24 @@
+import { isBlockedApprover } from "../../../shared/domain/AgentBlocklist.js";
+export const VALID_TARGET_STATUS = new Set(["approved", "deprecated", "removed"]);
+export const VALID_OWNER_ROLES = new Set([
+    "tech-lead",
+    "architect",
+    "security-owner",
+    "platform-runtime-lead",
+    "product-owner",
+    "compliance",
+]);
+/*
+ * ENF-010: re-export of the built-in agent-approver blocklist (SDD §7.5)
+ * so approve and lint share one list; config extends it. See spec record.
+ */
+export { BUILTIN_AGENT_BLOCKLIST } from "../../../shared/domain/AgentBlocklist.js";
+export function classifyRefusal(req, extraBlocklist) {
+    if (isBlockedApprover(req.approver, extraBlocklist)) {
+        return { kind: "agent-approver", approver: req.approver };
+    }
+    if (!VALID_OWNER_ROLES.has(req.ownerRole)) {
+        return { kind: "invalid-owner-role", ownerRole: req.ownerRole };
+    }
+    return null;
+}

package/dist/features/approve/domain/Rewrite.d.ts

@@ -0,0 +1 @@
+export { matchId, rewriteApproval, type IdMatch, type RewriteResult, type ApprovalAttestation, type ApprovalTargetStatus, } from "../../../shared/domain/SpecApprovalRewrite.js";

package/dist/features/approve/domain/Rewrite.js

@@ -0,0 +1,6 @@
+/*
+ * Re-export shim — content lives in src/shared/domain/SpecApprovalRewrite.ts
+ * so both approve (inline) and finalize (plan materialisation) can use it
+ * without crossing feature boundaries.
+ */
+export { matchId, rewriteApproval, } from "../../../shared/domain/SpecApprovalRewrite.js";

package/dist/features/approve/ports/inbound/ApproveCommand.d.ts

@@ -0,0 +1,10 @@
+import type { CommandResult, OutputFormat } from "../../../../shared/domain/CliOutput.js";
+import type { ApproveRequest } from "../../domain/ApproveRequest.js";
+export type { ApproveRequest, TargetStatus, } from "../../domain/ApproveRequest.js";
+export interface ApproveExecutionMode {
+    inline: boolean;
+    planId?: string;
+}
+export interface ApproveCommand {
+    execute(cwd: string, req: ApproveRequest, format: Exclude<OutputFormat, "yaml">, mode?: ApproveExecutionMode): Promise<CommandResult>;
+}

package/dist/features/approve/ports/inbound/ApproveCommand.js

@@ -0,0 +1 @@
+export {};

package/dist/features/approve/ports/outbound/ApproveClock.d.ts

@@ -0,0 +1,3 @@
+export interface ApproveClock {
+    now(): Date;
+}

package/dist/features/approve/ports/outbound/ApproveClock.js

@@ -0,0 +1 @@
+export {};

package/dist/features/approve/ports/outbound/ApproveConfigPort.d.ts

@@ -0,0 +1,4 @@
+import type { SddConfig } from "../../../../shared/domain/Config.js";
+export interface ApproveConfigPort {
+    config(repoRoot: string): Promise<SddConfig>;
+}

package/dist/features/approve/ports/outbound/ApproveConfigPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/approve/ports/outbound/ApproveFileSystem.d.ts

@@ -0,0 +1,8 @@
+export interface SpecFileEntry {
+    path: string;
+    content: string;
+}
+export interface ApproveFileSystem {
+    resolveSpecFiles(repoRoot: string, patterns: readonly string[]): Promise<SpecFileEntry[]>;
+    writeSpecFile(repoRoot: string, relativePath: string, content: string): Promise<void>;
+}

package/dist/features/approve/ports/outbound/ApproveFileSystem.js

@@ -0,0 +1 @@
+export {};

package/dist/features/approve/ports/outbound/PlanFileWriter.d.ts

@@ -0,0 +1,13 @@
+import type { PendingAttestation, PlanFileShape } from "../../../../shared/domain/PlanFile.js";
+export interface AppendAttestationResult {
+    planId: string;
+    planPath: string;
+    isNewPlan: boolean;
+    pendingAfter: number;
+}
+export interface PlanFileWriter {
+    appendAttestation(repoRoot: string, plansDir: string, planId: string | undefined, attestation: PendingAttestation): Promise<AppendAttestationResult>;
+    /** Read-only helper used by `sdd plan show`-style consumers and by tests.
+     *  Returns null when the plan does not exist. */
+    readPlan(repoRoot: string, plansDir: string, planId: string): Promise<PlanFileShape | null>;
+}

package/dist/features/approve/ports/outbound/PlanFileWriter.js

@@ -0,0 +1 @@
+export {};

package/dist/features/check/adapters/inbound/CliCheckHandler.d.ts

@@ -0,0 +1,8 @@
+import { type CommandResult, type OutputFormat } from "../../../../shared/domain/CliOutput.js";
+import { type CheckBaselinePorts } from "../../application/CheckBaseline.js";
+import type { CheckCommand } from "../../ports/inbound/CheckCommand.js";
+export declare class CliCheckHandler implements CheckCommand {
+    private readonly ports;
+    constructor(ports: CheckBaselinePorts);
+    execute(cwd: string, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}