agent-sdd 1.0.3

package/dist/features/check/adapters/inbound/CliCheckHandler.js

@@ -0,0 +1,62 @@
+import { failed, ok, } from "../../../../shared/domain/CliOutput.js";
+import { CliFailure } from "../../../../shared/domain/Errors.js";
+import { checkBaseline, } from "../../application/CheckBaseline.js";
+export class CliCheckHandler {
+    ports;
+    constructor(ports) {
+        this.ports = ports;
+    }
+    async execute(cwd, format) {
+        try {
+            const outcome = await checkBaseline(cwd, this.ports);
+            if (outcome.kind === "dirty") {
+                return driftResult(format, "baseline-dirty", "", null, "", outcome.currentCommitSha, outcome.dirtyPaths);
+            }
+            if (outcome.kind === "stale") {
+                return driftResult(format, "baseline-stale", outcome.recordedToken, outcome.recomputedToken, outcome.baselineCommitSha, outcome.currentCommitSha, []);
+            }
+            if (format === "json") {
+                return ok(JSON.stringify({
+                    format_version: 1,
+                    ok: true,
+                    recorded_token: outcome.recordedToken,
+                    recomputed_token: outcome.recomputedToken,
+                    baseline_commit_sha: outcome.baselineCommitSha,
+                    current_commit_sha: outcome.currentCommitSha,
+                    mechanism: outcome.mechanism,
+                }));
+            }
+            return ok(`ok true\n  recorded_token: ${outcome.recordedToken}\n  recomputed_token: ${outcome.recomputedToken}\n  baseline_commit_sha: ${outcome.baselineCommitSha}\n  current_commit_sha: ${outcome.currentCommitSha}`);
+        }
+        catch (error) {
+            if (error instanceof CliFailure) {
+                return failed(error, format);
+            }
+            throw error;
+        }
+    }
+}
+function driftResult(format, reason, recordedToken, recomputedToken, baselineCommitSha, currentCommitSha, dirtyPaths) {
+    if (format === "json") {
+        return {
+            exitCode: 1,
+            stdout: `${JSON.stringify({
+                format_version: 1,
+                ok: false,
+                reason,
+                recorded_token: recordedToken,
+                recomputed_token: recomputedToken,
+                baseline_commit_sha: baselineCommitSha,
+                current_commit_sha: currentCommitSha,
+                dirty_paths: dirtyPaths,
+            })}\n`,
+            stderr: "",
+        };
+    }
+    const dirtyText = dirtyPaths.length > 0 ? `\n  dirty_paths: ${dirtyPaths.join(", ")}` : "";
+    return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `${reason}: token baseline is not current${dirtyText}\n`,
+    };
+}

package/dist/features/check/adapters/outbound/ChildProcessCheckGit.d.ts

@@ -0,0 +1,8 @@
+import type { CheckGitPort } from "../../ports/outbound/CheckGitPort.js";
+export declare class ChildProcessCheckGit implements CheckGitPort {
+    repoRoot(cwd: string): Promise<string>;
+    headSha(repoRoot: string): Promise<string>;
+    treeBytes(repoRoot: string, scope: readonly string[]): Promise<Uint8Array>;
+    treePaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+    dirtyPaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+}

package/dist/features/check/adapters/outbound/ChildProcessCheckGit.js

@@ -0,0 +1,112 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { environmentFailure } from "../../../../shared/domain/Errors.js";
+export class ChildProcessCheckGit {
+    async repoRoot(cwd) {
+        const result = await runGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        if (result.code !== 0 || result.stdout.toString("utf8").trim() !== "true") {
+            throw environmentFailure("not-a-git-repo", "cwd is not inside a git working tree", cwd);
+        }
+        return findRepoRoot(cwd);
+    }
+    async headSha(repoRoot) {
+        const result = await runGit(repoRoot, ["rev-parse", "HEAD"]);
+        if (result.code === 0) {
+            return result.stdout.toString("utf8").trim();
+        }
+        throw environmentFailure("head-unborn", "HEAD does not resolve to a commit", result.stderr.toString("utf8").trim());
+    }
+    async treeBytes(repoRoot, scope) {
+        const result = await runGit(repoRoot, ["ls-tree", "HEAD", "--", ...scope]);
+        if (result.code !== 0) {
+            throw environmentFailure("head-unborn", "git ls-tree failed", result.stderr.toString("utf8").trim());
+        }
+        return result.stdout;
+    }
+    async treePaths(repoRoot, scope) {
+        const result = await runGit(repoRoot, [
+            "ls-tree",
+            "-r",
+            "--name-only",
+            "HEAD",
+            "--",
+            ...scope,
+        ]);
+        if (result.code !== 0) {
+            throw environmentFailure("head-unborn", "git ls-tree failed", result.stderr.toString("utf8").trim());
+        }
+        return nonEmptyLines(result.stdout.toString("utf8"));
+    }
+    async dirtyPaths(repoRoot, scope) {
+        const diffResult = await runGit(repoRoot, [
+            "diff",
+            "--quiet",
+            "HEAD",
+            "--",
+            ...scope,
+        ]);
+        if (diffResult.code !== 0 && diffResult.code !== 1) {
+            throw environmentFailure("head-unborn", "git diff --quiet failed", diffResult.stderr.toString("utf8").trim());
+        }
+        const result = await runGit(repoRoot, [
+            "status",
+            "--porcelain",
+            "--",
+            ...scope,
+        ]);
+        if (result.code !== 0) {
+            throw environmentFailure("not-a-git-repo", "git status failed", result.stderr.toString("utf8").trim());
+        }
+        return nonEmptyLines(result.stdout.toString("utf8"))
+            .map((line) => porcelainPath(line))
+            .sort();
+    }
+}
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", [...args], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            if (error.code === "ENOENT") {
+                reject(environmentFailure("git-not-on-path", "git binary is not on PATH"));
+                return;
+            }
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({
+                code: code ?? 1,
+                stdout: Buffer.concat(stdout),
+                stderr: Buffer.concat(stderr),
+            });
+        });
+    });
+}
+function nonEmptyLines(value) {
+    return value.split(/\r?\n/).filter((line) => line.length > 0);
+}
+function porcelainPath(line) {
+    const raw = line.slice(3);
+    const parts = raw.split(" -> ");
+    return parts[parts.length - 1];
+}
+function findRepoRoot(cwd) {
+    let current = resolve(cwd);
+    while (true) {
+        if (existsSync(join(current, ".git"))) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            throw environmentFailure("not-a-git-repo", "cwd is not inside a git working tree", cwd);
+        }
+        current = parent;
+    }
+}

package/dist/features/check/adapters/outbound/NodeCheckFileReader.d.ts

@@ -0,0 +1,7 @@
+import { type SddConfig } from "../../../../shared/domain/Config.js";
+import type { CheckConfigPort } from "../../ports/outbound/CheckConfigPort.js";
+import type { CheckSpec, CheckSpecPort } from "../../ports/outbound/CheckSpecPort.js";
+export declare class NodeCheckFileReader implements CheckConfigPort, CheckSpecPort {
+    config(repoRoot: string): Promise<SddConfig>;
+    spec(repoRoot: string, config: SddConfig): Promise<CheckSpec>;
+}

package/dist/features/check/adapters/outbound/NodeCheckFileReader.js

@@ -0,0 +1,44 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { configFromJson, } from "../../../../shared/domain/Config.js";
+import { configFailure } from "../../../../shared/domain/Errors.js";
+import { specBlocks } from "../../../../shared/domain/SpecBlocks.js";
+export class NodeCheckFileReader {
+    async config(repoRoot) {
+        const configPath = join(repoRoot, ".sdd", "config.json");
+        const text = await readConfig(configPath);
+        const config = configFromJson(parseConfigJson(text, configPath), configPath);
+        await this.spec(repoRoot, config);
+        return config;
+    }
+    async spec(repoRoot, config) {
+        const path = join(repoRoot, config.specFile);
+        let text;
+        try {
+            text = await readFile(path, "utf8");
+        }
+        catch (error) {
+            throw configFailure("config-invalid", `spec_file is not readable: ${config.specFile}`, errorMessage(error), path);
+        }
+        return { path, blocks: specBlocks(text) };
+    }
+}
+async function readConfig(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        throw configFailure("config-missing", ".sdd/config.json is missing or unreadable", errorMessage(error), path);
+    }
+}
+function parseConfigJson(text, path) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw configFailure("config-invalid", ".sdd/config.json is not valid JSON", errorMessage(error), path);
+    }
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/features/check/application/CheckBaseline.d.ts

@@ -0,0 +1,28 @@
+import { TOKEN_MECHANISM } from "../../../shared/domain/Token.js";
+import type { CheckConfigPort } from "../ports/outbound/CheckConfigPort.js";
+import type { CheckGitPort } from "../ports/outbound/CheckGitPort.js";
+import type { CheckSpecPort } from "../ports/outbound/CheckSpecPort.js";
+export type CheckOutcome = {
+    kind: "match";
+    recordedToken: string;
+    recomputedToken: string;
+    baselineCommitSha: string;
+    currentCommitSha: string;
+    mechanism: typeof TOKEN_MECHANISM;
+} | {
+    kind: "dirty";
+    currentCommitSha: string;
+    dirtyPaths: string[];
+} | {
+    kind: "stale";
+    recordedToken: string;
+    recomputedToken: string;
+    baselineCommitSha: string;
+    currentCommitSha: string;
+};
+export interface CheckBaselinePorts {
+    config: CheckConfigPort;
+    git: CheckGitPort;
+    spec: CheckSpecPort;
+}
+export declare function checkBaseline(cwd: string, ports: CheckBaselinePorts): Promise<CheckOutcome>;

package/dist/features/check/application/CheckBaseline.js

@@ -0,0 +1,54 @@
+import { configFailure } from "../../../shared/domain/Errors.js";
+import { stringValue, typedBlock, } from "../../../shared/domain/SpecBlocks.js";
+import { TOKEN_MECHANISM, token } from "../../../shared/domain/Token.js";
+import { baselineComparison } from "../domain/BaselineComparison.js";
+export async function checkBaseline(cwd, ports) {
+    const repoRoot = await ports.git.repoRoot(cwd);
+    const currentCommitSha = await ports.git.headSha(repoRoot);
+    const config = await ports.config.config(repoRoot);
+    await assertGlobMatches(ports.git, repoRoot, config.discoveryScope);
+    const dirtyPaths = await ports.git.dirtyPaths(repoRoot, config.discoveryScope);
+    if (dirtyPaths.length > 0) {
+        return {
+            kind: "dirty",
+            currentCommitSha,
+            dirtyPaths,
+        };
+    }
+    const loadedSpec = await ports.spec.spec(repoRoot, config);
+    const recorded = baseline(loadedSpec.path, loadedSpec.blocks, config.baselineId);
+    const recomputedToken = token(await ports.git.treeBytes(repoRoot, config.discoveryScope));
+    const comparison = baselineComparison(recorded.freshnessToken, recomputedToken);
+    if (comparison.kind === "stale") {
+        return {
+            kind: "stale",
+            recordedToken: comparison.recordedToken,
+            recomputedToken: comparison.recomputedToken,
+            baselineCommitSha: recorded.baselineCommitSha,
+            currentCommitSha,
+        };
+    }
+    return {
+        kind: "match",
+        recordedToken: comparison.recordedToken,
+        recomputedToken: comparison.recomputedToken,
+        baselineCommitSha: recorded.baselineCommitSha,
+        currentCommitSha,
+        mechanism: TOKEN_MECHANISM,
+    };
+}
+function baseline(specPath, blocks, baselineId) {
+    const block = typedBlock(blocks, baselineId, "BrownfieldBaseline", specPath);
+    return {
+        freshnessToken: stringValue(block, "freshness_token", specPath),
+        baselineCommitSha: stringValue(block, "baseline_commit_sha", specPath),
+    };
+}
+async function assertGlobMatches(git, repoRoot, scope) {
+    for (const entry of scope.filter((value) => /[*?[]/.test(value))) {
+        const paths = await git.treePaths(repoRoot, [entry]);
+        if (paths.length === 0) {
+            throw configFailure("config-invalid", `discovery_scope glob matched zero files: ${entry}`);
+        }
+    }
+}

package/dist/features/check/domain/BaselineComparison.d.ts

@@ -0,0 +1 @@
+export { baselineComparison, type BaselineComparison, } from "../../../shared/domain/CheckOutcome.js";

package/dist/features/check/domain/BaselineComparison.js

@@ -0,0 +1,2 @@
+/* Re-export shim — content lives in src/shared/domain/CheckOutcome.ts. */
+export { baselineComparison, } from "../../../shared/domain/CheckOutcome.js";

package/dist/features/check/ports/inbound/CheckCommand.d.ts

@@ -0,0 +1,4 @@
+import type { CommandResult, OutputFormat } from "../../../../shared/domain/CliOutput.js";
+export interface CheckCommand {
+    execute(cwd: string, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}

package/dist/features/check/ports/inbound/CheckCommand.js

@@ -0,0 +1 @@
+export {};

package/dist/features/check/ports/outbound/CheckConfigPort.d.ts

@@ -0,0 +1,4 @@
+import type { SddConfig } from "../../../../shared/domain/Config.js";
+export interface CheckConfigPort {
+    config(repoRoot: string): Promise<SddConfig>;
+}

package/dist/features/check/ports/outbound/CheckConfigPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/check/ports/outbound/CheckGitPort.d.ts

@@ -0,0 +1,7 @@
+export interface CheckGitPort {
+    repoRoot(cwd: string): Promise<string>;
+    headSha(repoRoot: string): Promise<string>;
+    treeBytes(repoRoot: string, scope: readonly string[]): Promise<Uint8Array>;
+    treePaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+    dirtyPaths(repoRoot: string, scope: readonly string[]): Promise<string[]>;
+}

package/dist/features/check/ports/outbound/CheckGitPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/check/ports/outbound/CheckSpecPort.d.ts

@@ -0,0 +1,9 @@
+import type { SddConfig } from "../../../../shared/domain/Config.js";
+import type { SpecBlock } from "../../../../shared/domain/SpecBlocks.js";
+export interface CheckSpec {
+    path: string;
+    blocks: SpecBlock[];
+}
+export interface CheckSpecPort {
+    spec(repoRoot: string, config: SddConfig): Promise<CheckSpec>;
+}

package/dist/features/check/ports/outbound/CheckSpecPort.js

@@ -0,0 +1 @@
+export {};

package/dist/features/doctor/adapters/inbound/CliDoctorHandler.d.ts

@@ -0,0 +1,8 @@
+import { type CommandResult, type OutputFormat } from "../../../../shared/domain/CliOutput.js";
+import { type RunDoctorPorts } from "../../application/RunDoctor.js";
+import type { DoctorCommand, DoctorRequest } from "../../ports/inbound/DoctorCommand.js";
+export declare class CliDoctorHandler implements DoctorCommand {
+    private readonly ports;
+    constructor(ports: RunDoctorPorts);
+    execute(_cwd: string, req: DoctorRequest, format: Exclude<OutputFormat, "yaml">): Promise<CommandResult>;
+}

package/dist/features/doctor/adapters/inbound/CliDoctorHandler.js

@@ -0,0 +1,77 @@
+import { ok, } from "../../../../shared/domain/CliOutput.js";
+import { runDoctor, } from "../../application/RunDoctor.js";
+export class CliDoctorHandler {
+    ports;
+    constructor(ports) {
+        this.ports = ports;
+    }
+    async execute(_cwd, req, format) {
+        if (!req.ruleVersion) {
+            const env = { format_version: 1, ok: false, kind: "no-mode-selected" };
+            return refusal(env, "doctor requires --rule-version (no other modes implemented in v0.4)", 2, format);
+        }
+        const outcome = await runDoctor(req.rulesPath, this.ports);
+        return render(outcome, format);
+    }
+}
+function render(outcome, format) {
+    if (outcome.kind === "ok") {
+        if (format === "json") {
+            return ok(JSON.stringify({
+                format_version: 1,
+                ok: true,
+                rule_version: outcome.ruleVersion,
+                cli_version: outcome.cliVersion,
+                compatible_range: outcome.compatibleRange,
+                drift: [],
+            }));
+        }
+        return ok([
+            `doctor: ok (rule_version=${outcome.ruleVersion}, cli_version=${outcome.cliVersion}, compatible_range=${outcome.compatibleRange})`,
+            `doctor: 0 drift entries.`,
+        ].join("\n"));
+    }
+    if (outcome.kind === "drift") {
+        if (format === "json") {
+            return {
+                exitCode: 1,
+                stdout: `${JSON.stringify({
+                    format_version: 1,
+                    ok: false,
+                    rule_version: outcome.ruleVersion,
+                    cli_version: outcome.cliVersion,
+                    compatible_range: outcome.compatibleRange,
+                    drift: outcome.drift,
+                })}\n`,
+                stderr: "",
+            };
+        }
+        const lines = [];
+        lines.push(`doctor: drift detected (rule_version=${outcome.ruleVersion}, cli_version=${outcome.cliVersion}, compatible_range=${outcome.compatibleRange})`);
+        for (const d of outcome.drift) {
+            lines.push(`  - [${d.kind}] ${d.id}: ${d.remediation}`);
+        }
+        return { exitCode: 1, stdout: "", stderr: `${lines.join("\n")}\n` };
+    }
+    if (outcome.kind === "registry-not-found") {
+        return refusal({
+            format_version: 1,
+            ok: false,
+            kind: "registry-not-found",
+            path: outcome.path,
+        }, `enforcement registry not found at ${outcome.path}`, 2, format);
+    }
+    return refusal({
+        format_version: 1,
+        ok: false,
+        kind: "invalid-registry",
+        path: outcome.path,
+        reason: outcome.reason,
+    }, `enforcement registry at ${outcome.path} could not be parsed: ${outcome.reason}`, 2, format);
+}
+function refusal(envelope, human, exitCode, format) {
+    if (format === "json") {
+        return { exitCode, stdout: `${JSON.stringify(envelope)}\n`, stderr: "" };
+    }
+    return { exitCode, stdout: "", stderr: `doctor: ${human}\n` };
+}

package/dist/features/doctor/adapters/outbound/NodeRegistryReader.d.ts

@@ -0,0 +1,5 @@
+import type { RegistryFile, RegistryReader } from "../../ports/outbound/RegistryReader.js";
+export declare class NodeRegistryReader implements RegistryReader {
+    readRegistry(rulesPath: string): Promise<RegistryFile>;
+    cliVersion(): Promise<string>;
+}

package/dist/features/doctor/adapters/outbound/NodeRegistryReader.js

@@ -0,0 +1,40 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+export class NodeRegistryReader {
+    async readRegistry(rulesPath) {
+        const resolved = resolveRulesPath(rulesPath);
+        try {
+            const content = await readFile(resolved, "utf8");
+            return { kind: "found", path: resolved, content };
+        }
+        catch {
+            return { kind: "not-found", path: resolved };
+        }
+    }
+    async cliVersion() {
+        const packagePath = resolve(fileURLToPath(import.meta.url), "..", "..", "..", "..", "..", "..", "package.json");
+        const text = await readFile(packagePath, "utf8");
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed) || typeof parsed.version !== "string") {
+            throw new Error("package.json#version missing");
+        }
+        return parsed.version;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolveRulesPath(p) {
+    if (p.startsWith("~/")) {
+        return resolve(homedir(), p.slice(2));
+    }
+    if (p === "~") {
+        return homedir();
+    }
+    if (isAbsolute(p)) {
+        return p;
+    }
+    return resolve(process.cwd(), p);
+}

package/dist/features/doctor/application/RunDoctor.d.ts

@@ -0,0 +1,30 @@
+import type { RegistryReader } from "../ports/outbound/RegistryReader.js";
+export interface RunDoctorPorts {
+    registry: RegistryReader;
+}
+export type DriftKind = "version_mismatch" | "missing_diagnostic" | "stale_diagnostic";
+export interface DriftEntry {
+    kind: DriftKind;
+    id: string;
+    remediation: string;
+}
+export type DoctorOutcome = {
+    kind: "ok";
+    ruleVersion: string;
+    cliVersion: string;
+    compatibleRange: string;
+} | {
+    kind: "drift";
+    ruleVersion: string;
+    cliVersion: string;
+    compatibleRange: string;
+    drift: DriftEntry[];
+} | {
+    kind: "registry-not-found";
+    path: string;
+} | {
+    kind: "invalid-registry";
+    path: string;
+    reason: string;
+};
+export declare function runDoctor(rulesPath: string, ports: RunDoctorPorts): Promise<DoctorOutcome>;

package/dist/features/doctor/application/RunDoctor.js

@@ -0,0 +1,78 @@
+import { DOCTOR_DRIFT_KINDS, LINT_DIAGNOSTIC_IDS, READY_VIOLATION_KINDS, } from "../../../shared/domain/DiagnosticRegistry.js";
+import { parseRegistry } from "../domain/RegistryRow.js";
+import { rangeIncludes } from "../domain/SemverRange.js";
+export async function runDoctor(rulesPath, ports) {
+    const file = await ports.registry.readRegistry(rulesPath);
+    if (file.kind === "not-found") {
+        return { kind: "registry-not-found", path: file.path };
+    }
+    const parsed = parseRegistry(file.content);
+    if (!parsed.ok) {
+        return {
+            kind: "invalid-registry",
+            path: file.path,
+            reason: parsed.error.reason,
+        };
+    }
+    const cliVersion = await ports.registry.cliVersion();
+    const drift = computeDrift(parsed.doc, cliVersion);
+    const ruleVersion = parsed.doc.compatibleSddCli;
+    if (drift.length === 0) {
+        return {
+            kind: "ok",
+            ruleVersion,
+            cliVersion,
+            compatibleRange: parsed.doc.compatibleSddCli,
+        };
+    }
+    return {
+        kind: "drift",
+        ruleVersion,
+        cliVersion,
+        compatibleRange: parsed.doc.compatibleSddCli,
+        drift,
+    };
+}
+function computeDrift(doc, cliVersion) {
+    const out = [];
+    if (!rangeIncludes(doc.compatibleSddCli, cliVersion)) {
+        out.push({
+            kind: "version_mismatch",
+            id: cliVersion,
+            remediation: `cli version ${cliVersion} is outside the registry range "${doc.compatibleSddCli}" — bump the registry's compatible_sdd_cli or downgrade the CLI`,
+        });
+    }
+    const declared = new Set();
+    for (const row of doc.rows) {
+        if (row.maturity !== "implemented") {
+            continue;
+        }
+        for (const id of row.diagnosticIds) {
+            declared.add(id);
+        }
+    }
+    const known = new Set([
+        ...LINT_DIAGNOSTIC_IDS,
+        ...READY_VIOLATION_KINDS,
+        ...DOCTOR_DRIFT_KINDS,
+    ]);
+    for (const id of declared) {
+        if (!known.has(id)) {
+            out.push({
+                kind: "missing_diagnostic",
+                id,
+                remediation: `registry declares "${id}" as implemented but the running CLI's DiagnosticRegistry does not contain it — add it to LINT_DIAGNOSTIC_IDS or READY_VIOLATION_KINDS, or change registry maturity to planned`,
+            });
+        }
+    }
+    for (const id of known) {
+        if (!declared.has(id)) {
+            out.push({
+                kind: "stale_diagnostic",
+                id,
+                remediation: `DiagnosticRegistry contains "${id}" but no registry row claims it as implemented — add a registry row or remove the constant`,
+            });
+        }
+    }
+    return out;
+}

package/dist/features/doctor/domain/RegistryRow.d.ts

@@ -0,0 +1,23 @@
+export type RegistryMaturity = "planned" | "implemented" | "deprecated" | "out_of_scope";
+export interface RegistryRow {
+    enfId: string;
+    ruleName: string;
+    maturity: RegistryMaturity;
+    diagnosticIds: string[];
+}
+export interface RegistryDocument {
+    compatibleSddCli: string;
+    rows: RegistryRow[];
+}
+export interface RegistryParseError {
+    reason: string;
+}
+/** Parse a methodology enforcement-registry markdown blob into a typed
+ *  RegistryDocument. Returns a discriminated outcome — never throws. */
+export declare function parseRegistry(markdown: string): {
+    ok: true;
+    doc: RegistryDocument;
+} | {
+    ok: false;
+    error: RegistryParseError;
+};