rahman-resources 0.9.2 → 0.12.0

package/README.md

@@ -70,6 +70,111 @@ Run `npx rahman-resources list` to see the live catalog. Highlights:
 | `cms-public-storefront` | cms | E-commerce / blog storefront |
 | `landing-*` | marketing | Hero/bento/masonry/kinetic landings |
 
+## DNA Graph
+
+The kitab tracks slice **lineage** (where a slice came from and how it was transformed) and **adoption** (which downstream consumers picked it up and how much they drifted) in `.kitab/lineage/<slug>.dna.json` files. Together they form a directed graph traversable by humans and Claude (via MCP).
+
+Each DNA file has three sections:
+
+- `id`, `created_at` — slice identity
+- `lineage[]` — `{ from, to?, at, transforms[], actor? }` rows recording every harvest hop. `from`/`to` use `<sourceRepo>:<path>` syntax (e.g. `superspace:frontend/slices/auth` → `kitab:0.1.0`). Transforms are tags like `alias-rewrite`, `clerk-strip`, `namespace-rename`.
+- `consumers{}` — keyed by consumer name (notion, superspace, careerpack, content, rahmanef, cescadesigns). Each entry records `adopted_at`, `version`, `drift_score` (0-100), and optionally `last_synced_at`.
+
+### `rr graph` command
+
+```bash
+npx rahman-resources graph                  # ASCII summary + adoption matrix across all slices
+npx rahman-resources graph --all            # same as above (explicit)
+npx rahman-resources graph convex-auth      # full lineage tree + consumer rows for one slice
+npx rahman-resources graph --json           # machine-readable graph JSON
+npx rahman-resources graph convex-auth --json
+```
+
+The summary highlights drift: green <15%, yellow 15-39%, red ≥40%. A red cell signals the consumer copy diverged enough that a re-sync from the kitab will conflict — time to lift improvements back UP via `/rr-prep` + `/rr-send`.
+
+### MCP surface
+
+The companion `rahman-resources-mcp` server exposes the same data:
+
+- `rr://graph/lineage` — full graph payload (`{ slices, graph: { nodes, edges } }`)
+- `rr://graph/lineage/<slug>` — single slice DNA
+- `rr://graph/consumers/<consumer-name>` — every slice that consumer adopted, with version + drift
+
+### Local-only shards
+
+Files matching `.kitab/lineage/*.local.json` are gitignored, so contributors can stage experimental DNA without committing it. Promote to `<slug>.dna.json` to ship it.
+
+## Compose Solver
+
+Phase B of the Slice Composition Compiler. The `compose` subcommand takes the project state from your `rr.json` plus a list of desired slice slugs, then computes a compatible subset (or rejects with a human-readable proof of every conflict).
+
+```bash
+npx rahman-resources compose doku-payment mdx-blog
+npx rahman-resources compose doku-payment midtrans-payment   # arbitrates the conflict
+npx rahman-resources compose doku-payment --json             # machine-readable
+npx rahman-resources compose doku-payment --rr-path ./apps/x/rr.json
+npx rahman-resources compose doku-payment --no-deps          # disable transitive dep resolution
+npx rahman-resources compose doku-payment --strict           # CI gate: uncontracted + warnings → blockers
+```
+
+The solver enforces:
+
+- **auth-mismatch** (blocker) — slice requires auth X, rr.json has Y.
+- **table-collision** (blocker) — two slices declare the same Convex table, or a slice's table is already in the target's schema. Pair collisions are **arbitrated**: the slice with fewer dependers (or, on ties, the lex-later slug) is dropped — both are no longer rejected.
+- **explicit-conflict** (blocker) — `contract.conflicts: ["<other>:tables.<value>"]` matches `<other>.provides.tables`. Also arbitrated.
+- **missing-dep** (blocker) — slice's `requires.deps[]` missing from both the candidate set and `slicesInstalled`. Also fires for desired slugs without a contract **only in `--strict` mode**.
+- **uncontracted** (warning) — desired slug with no `slice.contract.ts` registered. Accepted by default; flip to blocker with `--strict`.
+- **both-installed-conflict** (warning) — both colliding slices are already in `state.slicesInstalled`; neither is dropped.
+- **rbac-collision** (warning) — two slices declare the same permission. Surfaced; never blocks.
+- **env-missing** (warning) — `requires.env[]` not in the target's `envExisting`. Surfaced; never blocks (elevated to blocker in `--strict`).
+
+Transitive deps are pulled in automatically (BFS with proper visited-set; throws with the full path on cycle, e.g. `dependency cycle detected: a → b → c → a`).
+
+### Strict mode (`--strict`)
+
+Pass `--strict` to either `compose` or `add` to flip into CI-gate behavior: every warning is elevated to a blocker, and uncontracted slugs are rejected with `missing-dep`. Use this in CI; use the default for day-to-day operator runs where most slices still ship without contracts.
+
+### Pre-flight gate on `rr add`
+
+`rr add <slug>` runs the same solver against `[slug]` before any file copy. If any blocker conflicts surface, `add` aborts and prints the proof. Pass `--force` to skip the gate (a warning is logged), or `--strict` to enforce strict-mode checking.
+
+A full algorithm walkthrough with worked examples lives in [`docs/compose-solver.md`](../../docs/compose-solver.md).
+
+## Bidirectional Sync
+
+Most slice registries push updates one-way (registry → consumer). The kitab is bidirectional: when an upstream slice improves, consumers can pull the update via 3-way semantic merge — file-level + contract-surface — without losing local customizations.
+
+```bash
+npx rahman-resources update <slug>                # dry-run preview (default)
+npx rahman-resources update <slug> --apply        # write merged files
+npx rahman-resources update <slug> --apply --force  # apply even with conflicts (kitab wins)
+npx rahman-resources update <slug> --json         # machine-readable report
+npx rahman-resources update <slug> --rr-path P    # point at an rr.json outside cwd
+```
+
+The engine emits a `MergeReport` with per-element outcomes (`auto-merged`, `consumer-wins-clean`, `kitab-wins-clean`, `conflict`, `identical`), a summary, and `driftAfterMerge` (0-100). When the merge is clean it also produces a ready-to-write `mergedSnapshot`.
+
+Conflicts surface a `conflictHint` describing why (e.g. _"kitab dropped `paymentOrders`; consumer still relies on it"_). Re-sync activity is appended as a `3-way-merge` lineage entry, and the consumer's `drift_score` is updated so `rr graph` reflects reality.
+
+See [docs/bidir-sync.md](../../docs/bidir-sync.md) for the full algorithm + drift-score formula.
+
+## Migration Planner
+
+When a slice contract changes shape between versions, `rr migrate` generates a concrete, risk-scored migration plan — Convex schema deltas, env adds, RBAC patches — including ready-to-paste artifacts and ready-to-write `convex/migrations/*.ts` files.
+
+```bash
+npx rahman-resources migrate <slug> --from <v1> [--to <v2>]              # ASCII plan
+npx rahman-resources migrate <slug> --from <v1> --json                   # machine-readable
+npx rahman-resources migrate <slug> --from <v1> --write-files            # materialize convex/migrations/
+npx rahman-resources migrate <slug> --from <v1> --write-files --force-overwrite
+```
+
+Step kinds: `convex-schema-{add,drop,rename}-table`, `env-{add,remove}`, `rbac-{add,remove}-permission`, `route-{add,remove}` (info-only). Each step carries `risk` (low/medium/high), `reversible` (bool), and pre-rendered artifacts (Convex schema snippet, full migration body, env line, RBAC patch).
+
+Rename detection: when the new contract declares `migrationFrom: { "<old-version>": "<marker>" }`, the planner pairs single-sided table additions/removals positionally and emits a single reversible `convex-schema-rename-table` step instead of a destructive drop+add. The marker string is opaque — only its presence matters. See [docs/migration-planner.md](../../docs/migration-planner.md) for the full algorithm and the DOKU rename proof.
+
+On `--write-files` the CLI appends a DNA lineage entry (`transforms: ["migration-applied", "<step-ids>"]`) so `rr graph` reflects the migration.
+
 ## Updating the manifest
 
 The manifest is generated from `site/lib/content/layouts.ts`. To regenerate:

package/bin/cli.js

@@ -29,6 +29,10 @@ import {
   addSkill as rrAddSkill,
 } from "../lib/rr.mjs";
 import { runPostInit } from "../lib/post-init.mjs";
+import { runGraph } from "./graph.mjs";
+import { runCompose, preflight as composePreflight } from "./compose.mjs";
+import { runUpdate as runUpdate3Way } from "./update.mjs";
+import { runMigrate } from "./migrate.mjs";
 
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -58,6 +62,9 @@ async function main() {
       return runInit(rest);
     case "add":
       return runAdd(rest);
+    case "update":
+    case "update-slice":
+      return runUpdate(rest);
     case "add-skill":
       return runAddSkill(rest);
     case "scaffold-slice":
@@ -73,6 +80,12 @@ async function main() {
       return runInfo(rest);
     case "doctor":
       return runDoctor(rest);
+    case "graph":
+      return runGraph(rest);
+    case "compose":
+      return runCompose(rest);
+    case "migrate":
+      return runMigrate(rest);
     case "mcp":
       return runMcpHint();
     case undefined:
@@ -111,6 +124,10 @@ ${kleur.bold("Usage:")}
   npx rahman-resources list [layouts|recipes|features|skills|slices]
   npx rahman-resources info <slug>
   npx rahman-resources doctor
+  npx rahman-resources graph [slug] [--all] [--json]
+  npx rahman-resources compose <slug>... [--json] [--rr-path <path>] [--no-deps] [--strict]
+  npx rahman-resources update <slug> [--apply] [--force] [--rr-path P] [--json]
+  npx rahman-resources migrate <slug> --from <v1> [--to <v2>] [--json] [--write-files] [--force-overwrite]
   npx rahman-resources mcp
 
 ${kleur.bold("Init flags:")}
@@ -124,6 +141,8 @@ ${kleur.bold("Add flags:")}
                           /preview/<slug> path constants in nav-config/robots/sitemap)
   --at preview            install template AT app/preview/<slug>/ (default — sandbox style)
   --with-shadcn-all       same as init flag
+  --strict                enforce strict compose pre-flight (uncontracted/env-missing → blocker)
+  --force                 skip compose pre-flight entirely
 
 ${kleur.bold("Examples:")}
   npx rahman-resources init my-app
@@ -160,6 +179,25 @@ function csv(s) {
   return String(s).split(",").map((x) => x.trim()).filter(Boolean);
 }
 
+// Walk up looking for the kitab repo root (`packages/` + `package.json`).
+// Used by the compose pre-flight to anchor slice.contract.ts discovery
+// regardless of where the CLI is invoked from.
+function findRepoRoot(start) {
+  let dir = start;
+  for (let i = 0; i < 8; i++) {
+    if (
+      existsSync(path.join(dir, "packages")) &&
+      existsSync(path.join(dir, "package.json"))
+    ) {
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.cwd();
+}
+
 // ─── catalog lookups ──────────────────────────────────────────────────────
 
 function findEntry(slug) {
@@ -429,12 +467,88 @@ async function runAdd(rest) {
   const { kind, entry } = found;
   const target = path.resolve(process.cwd(), targetArg);
 
+  // ── Pre-flight compose check (Phase B). Skipped with --force. ───────────
+  // Only run when the target has an rr.json — fresh dirs / non-rr consumers
+  // have no state to check against.
+  if (!flags.force && existsSync(path.join(target, "rr.json"))) {
+    try {
+      const repoRoot = findRepoRoot(__dirname);
+      const { result } = await composePreflight(slug, repoRoot, target, { strict: !!flags.strict });
+      const blockers = result.conflicts.filter((c) => c.severity === "blocker");
+      if (blockers.length > 0) {
+        console.error(kleur.red(`\n✖ compose pre-flight blocked "${slug}".`));
+        for (const line of result.proof) {
+          const colored = line.startsWith("+ ")
+            ? kleur.green(line)
+            : line.startsWith("- ")
+              ? kleur.red(line)
+              : line;
+          console.error("  " + colored);
+        }
+        for (const b of blockers) {
+          console.error(
+            "  " + kleur.red(`[${b.type}]`) + "  " + b.detail,
+          );
+        }
+        console.error(
+          kleur.dim(`\n  Pass --force to skip this check.\n`),
+        );
+        process.exit(1);
+      }
+    } catch (err) {
+      // Pre-flight failure (e.g. tsx not available) shouldn't break legacy
+      // add flow — warn but proceed.
+      console.error(
+        kleur.yellow(
+          `  ⚠ compose pre-flight skipped (${err.message ?? err}).`,
+        ),
+      );
+    }
+  } else if (flags.force) {
+    console.log(kleur.yellow(`  ⚠ --force: skipping compose pre-flight.`));
+  }
+
   if (kind === "slice") return runLift([`rahman:${entry.slug}`, ...(targetArg !== "." ? ["--target", targetArg] : [])]);
   if (kind === "layout") return addLayout(entry, target, targetArg, flags);
   if (kind === "feature") return addFeature(entry, target, targetArg);
   if (kind === "recipe") return addRecipe(entry);
 }
 
+/**
+ * `update <slug> [target] [--dry-run]` — re-pull a slice from the kitab into
+ * an existing consumer directory. Use after `@rahman/shared` bumps or when
+ * the source slice has shipped patches. `--dry-run` previews changes via
+ * `runLift`'s built-in diff.
+ *
+ * For slices only (not layouts/features/recipes — those use `add`).
+ */
+async function runUpdate(rest) {
+  // Bidirectional sync via 3-way merge engine (Phase D). The legacy
+  // raw-tiged re-pull path is reachable via `update --legacy <slug>` for
+  // back-compat with older docs that piggybacked on `runLift`.
+  const { positional, flags } = parseFlags(rest);
+  if (flags.legacy) {
+    const [slug, targetArg = "."] = positional;
+    if (!slug) {
+      console.error(kleur.red("Missing slug. Usage: rahman-resources update <slug> [--apply] [--json]"));
+      process.exit(1);
+    }
+    const found = findEntry(slug);
+    if (!found) throw new Error(`"${slug}" not found. Run ${kleur.cyan("npx rahman-resources list slices")}.`);
+    const { kind, entry } = found;
+    if (kind !== "slice") {
+      console.error(kleur.red(`update --legacy only supported for slices. "${slug}" is a ${kind}.`));
+      process.exit(1);
+    }
+    console.log(kleur.bold(`\n→ (legacy) Re-pulling ${kleur.cyan(entry.slug)} into ${kleur.dim(targetArg)}\n`));
+    const liftArgs = [`rahman:${entry.slug}`];
+    if (targetArg !== ".") liftArgs.push("--target", targetArg);
+    if (flags["dry-run"]) liftArgs.push("--dry-run");
+    return runLift(liftArgs);
+  }
+  return runUpdate3Way(rest);
+}
+
 async function addLayout(t, target, targetArg, flags = {}) {
   console.log(kleur.bold(`\n→ Installing ${kleur.cyan(t.title)} into ${kleur.dim(target)}\n`));
   if (!t.pullPaths || t.pullPaths.length === 0) {

package/bin/compose.mjs

@@ -0,0 +1,287 @@
+// `rr compose <slug1> <slug2> ...` — run the Phase B compose solver.
+//
+//   rr compose doku-payment mdx-blog
+//   rr compose doku-payment midtrans-payment --json
+//   rr compose doku-payment --rr-path ./path/to/rr.json
+//   rr compose doku-payment --no-deps
+//
+// Dispatched from bin/cli.js. Imports the pure solver from
+// ../lib/compose-solver.mjs and only handles I/O + presentation.
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import kleur from "kleur";
+
+import { loadAllContracts, compose } from "../lib/compose-solver.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Entry point invoked by cli.js with the post-`compose` argv tail.
+ * @param {string[]} rest
+ */
+export async function runCompose(rest) {
+  const { positional, flags } = parseFlags(rest);
+  const slugs = positional.filter(Boolean);
+  if (slugs.length === 0) {
+    process.stderr.write(
+      "Usage: rahman-resources compose <slug1> [<slug2> ...] [--json] [--rr-path <path>] [--no-deps] [--strict]\n",
+    );
+    process.exit(1);
+  }
+  const asJson = !!flags.json;
+  const resolveDeps = !flags["no-deps"];
+  const strict = !!flags.strict;
+
+  // Locate rr.json (optional — solver tolerates an empty state).
+  const rrPath = typeof flags["rr-path"] === "string"
+    ? path.resolve(process.cwd(), flags["rr-path"])
+    : path.resolve(process.cwd(), "rr.json");
+  const state = readStateFromRr(rrPath);
+  if (strict) state.allowUnknownSlices = false;
+
+  // Walk up from packages/cli/bin/ to the kitab repo root.
+  const repoRoot = findRepoRoot(__dirname);
+  const contracts = await loadAllContracts(repoRoot);
+
+  let result;
+  try {
+    result = compose({ state, desired: slugs, resolveDeps }, contracts);
+  } catch (err) {
+    process.stderr.write(kleur.red(`compose: ${err.message ?? err}\n`));
+    process.exit(1);
+  }
+
+  // In strict mode, elevate ALL warnings → blockers and re-derive
+  // accepted / rejected so CI gates flag every soft issue.
+  if (strict) result = applyStrictMode(result);
+
+  if (asJson) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    if (hasBlocker(result)) process.exit(1);
+    return;
+  }
+
+  printHuman(result, { rrPath, repoRoot });
+  if (hasBlocker(result)) process.exit(1);
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function parseFlags(rest) {
+  const positional = [];
+  const flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const next = rest[i + 1];
+      if (next && !next.startsWith("--")) {
+        flags[key] = next;
+        i++;
+      } else {
+        flags[key] = true;
+      }
+    } else {
+      positional.push(a);
+    }
+  }
+  return { positional, flags };
+}
+
+/**
+ * Walk up from `start` looking for the directory that contains a `packages/`
+ * folder + `package.json`. Falls back to cwd.
+ */
+function findRepoRoot(start) {
+  let dir = start;
+  for (let i = 0; i < 8; i++) {
+    if (
+      existsSync(path.join(dir, "packages")) &&
+      existsSync(path.join(dir, "package.json"))
+    ) {
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.cwd();
+}
+
+/**
+ * Parse rr.json (if present) into a {@link RrJsonState}. Tolerates a
+ * missing file by returning an empty state.
+ *
+ * Maps `rr.json#/auth.provider` to the solver's `auth` enum:
+ *   "convex-auth" → "convex"
+ *   "clerk" / "next-auth" / "none" → passthrough
+ */
+function readStateFromRr(rrPath) {
+  if (!existsSync(rrPath)) return {};
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(rrPath, "utf8"));
+  } catch {
+    return {};
+  }
+  const provider = raw?.auth?.provider;
+  const authMap = {
+    "convex-auth": "convex",
+    clerk: "clerk",
+    "next-auth": "next-auth",
+    none: "none",
+  };
+  const auth = provider ? authMap[provider] ?? undefined : undefined;
+
+  const slicesInstalled = [
+    ...(raw?.slices ?? []).map((s) => s.slug).filter(Boolean),
+    ...(raw?.features ?? []).map((f) => f.slug).filter(Boolean),
+  ];
+
+  return {
+    auth,
+    slicesInstalled,
+    envExisting: Array.isArray(raw?.envExisting) ? raw.envExisting : [],
+    rbacRolesExisting: Array.isArray(raw?.rbacRolesExisting)
+      ? raw.rbacRolesExisting
+      : [],
+    convexTablesExisting: Array.isArray(raw?.convexTablesExisting)
+      ? raw.convexTablesExisting
+      : [],
+  };
+}
+
+function hasBlocker(result) {
+  return result.conflicts.some((c) => c.severity === "blocker");
+}
+
+function printHuman(result, { rrPath, repoRoot }) {
+  const blocker = hasBlocker(result);
+  const head = blocker
+    ? kleur.red("✖ compose blocked")
+    : kleur.green("✓ compose ok");
+  console.log(
+    `\n${head}  ${kleur.dim(`rr.json: ${path.relative(repoRoot, rrPath) || rrPath}`)}\n`,
+  );
+
+  console.log(kleur.bold("Proof"));
+  if (result.proof.length === 0) {
+    console.log("  " + kleur.dim("(no decisions — empty desired set)"));
+  } else {
+    for (const line of result.proof) {
+      const colored = line.startsWith("+ ")
+        ? kleur.green(line)
+        : line.startsWith("- ")
+          ? kleur.red(line)
+          : line;
+      console.log("  " + colored);
+    }
+  }
+
+  if (result.accepted.length > 0) {
+    console.log(`\n${kleur.bold("Accepted")} ${kleur.dim(`(${result.accepted.length})`)}`);
+    for (const s of result.accepted) console.log("  " + kleur.cyan(s));
+  }
+
+  if (result.rejected.length > 0) {
+    console.log(`\n${kleur.bold("Rejected")} ${kleur.dim(`(${result.rejected.length})`)}`);
+    for (const r of result.rejected) {
+      console.log("  " + kleur.red(r.slug));
+      for (const reason of r.reasons) {
+        console.log(
+          "    " +
+            kleur.dim(`[${reason.type}]`) +
+            "  " +
+            reason.detail,
+        );
+      }
+    }
+  }
+
+  const warnings = result.conflicts.filter((c) => c.severity === "warning");
+  if (warnings.length > 0) {
+    console.log(`\n${kleur.bold("Warnings")} ${kleur.dim(`(${warnings.length})`)}`);
+    for (const w of warnings) {
+      console.log("  " + kleur.yellow(`[${w.type}]`) + "  " + w.detail);
+    }
+  }
+
+  if (result.envMissing.length > 0) {
+    console.log(`\n${kleur.bold("Env needed")}`);
+    for (const e of result.envMissing) console.log("  " + kleur.yellow(e));
+  }
+
+  if (result.rbacToCreate.length > 0) {
+    console.log(`\n${kleur.bold("RBAC to create")}`);
+    for (const p of result.rbacToCreate) console.log("  " + kleur.yellow(p));
+  }
+
+  if (result.tablesAdded.length > 0) {
+    console.log(`\n${kleur.bold("Tables added")}`);
+    for (const t of result.tablesAdded) {
+      console.log(
+        "  " + kleur.cyan(t.slug) + ": " + kleur.dim(t.tables.join(", ")),
+      );
+    }
+  }
+
+  console.log(
+    `\n${kleur.dim("appendix: pass --json for machine-readable output")}\n`,
+  );
+}
+
+/**
+ * Programmatic helper used by `rr add` for the pre-flight gate.
+ *
+ * @param {string} slug
+ * @param {string} repoRoot
+ * @param {string} targetDir Directory holding rr.json (cwd by default).
+ * @param {{ strict?: boolean }} [opts]
+ * @returns {Promise<{ result: import("../lib/compose-solver").ComposeResult; rrPath: string }>}
+ */
+export async function preflight(slug, repoRoot, targetDir = process.cwd(), opts = {}) {
+  const rrPath = path.join(targetDir, "rr.json");
+  const state = readStateFromRr(rrPath);
+  if (opts.strict) state.allowUnknownSlices = false;
+  const contracts = await loadAllContracts(repoRoot);
+  let result = compose({ state, desired: [slug], resolveDeps: true }, contracts);
+  if (opts.strict) result = applyStrictMode(result);
+  return { result, rrPath };
+}
+
+/**
+ * Elevate every `warning`-level conflict to `blocker`, then re-derive the
+ * accepted / rejected sets so the slice that triggered any warning gets
+ * rejected. Used for `--strict` / CI gating.
+ *
+ * @param {import("../lib/compose-solver").ComposeResult} result
+ * @returns {import("../lib/compose-solver").ComposeResult}
+ */
+function applyStrictMode(result) {
+  const conflicts = result.conflicts.map((c) =>
+    c.severity === "warning" ? { ...c, severity: "blocker" } : c,
+  );
+  const blockersBySlug = new Map();
+  for (const c of conflicts) {
+    if (c.severity !== "blocker") continue;
+    const cur = blockersBySlug.get(c.slug) ?? [];
+    cur.push(c);
+    blockersBySlug.set(c.slug, cur);
+  }
+  const newRejected = [...result.rejected];
+  const newAccepted = [];
+  for (const slug of result.accepted) {
+    const bl = blockersBySlug.get(slug);
+    if (bl && bl.length > 0) {
+      newRejected.push({ slug, reasons: bl, note: "strict-mode" });
+    } else {
+      newAccepted.push(slug);
+    }
+  }
+  return { ...result, conflicts, accepted: newAccepted, rejected: newRejected };
+}