@ankhorage/doctor 0.5.0 → 0.7.0

package/dist/readme-usage.js

@@ -20,8 +20,13 @@ import { runCli } from './cli/standalone.js';
  *
  * - strict `public-package` validation for extracted public package repos
  * - light recognized `integration-monorepo` validation for `ankhorage4`
+ * - canonical app-manifest authentication validation for JSON file targets
  * - non-mutating `fix` plans for deterministic mechanical changes only
  *
+ * Manifest validation accepts `infra.auth.flow` as the only auth-flow location, rejects
+ * `settings.authFlow` with a manual-migration diagnostic, and permits authentication without
+ * an authorization block.
+ *
  * Still deferred:
  *
  * - GitHub checks
@@ -31,7 +36,7 @@ import { runCli } from './cli/standalone.js';
  *
  * Path handling:
  *
- * - pass `[path]`, or
+ * - pass a repo/package directory or app-manifest JSON file as `[path]`, or
  * - omit it to inspect the current working directory
  *
  * @usage

package/dist/readme-usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"readme-usage.js","sourceRoot":"","sources":["../src/readme-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC","sourcesContent":["import { runCli } from './cli/standalone.js';\n\n/***\n * Provider and CLI surface\n *\n * `@ankhorage/doctor` is the repo/package compliance provider for Ankhorage.\n *\n * The same shared command implementation backs both:\n *\n * - `ankh doctor ...`\n * - `bunx @ankhorage/doctor ...`\n *\n * Current command surface:\n *\n * - `validate`\n * - `fix`\n * - `repo`\n * - `package`\n *\n * `doctor#2` adds a profile-based policy engine:\n *\n * - strict `public-package` validation for extracted public package repos\n * - light recognized `integration-monorepo` validation for `ankhorage4`\n * - non-mutating `fix` plans for deterministic mechanical changes only\n *\n * Still deferred:\n *\n * - GitHub checks\n * - CI checks\n * - on-disk `fix --apply`\n * - deeper cross-repo policy enforcement\n *\n * Path handling:\n *\n * - pass `[path]`, or\n * - omit it to inspect the current working directory\n *\n * @usage\n */\nawait runCli(['--help']);\n"]}
+{"version":3,"file":"readme-usage.js","sourceRoot":"","sources":["../src/readme-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC","sourcesContent":["import { runCli } from './cli/standalone.js';\n\n/***\n * Provider and CLI surface\n *\n * `@ankhorage/doctor` is the repo/package compliance provider for Ankhorage.\n *\n * The same shared command implementation backs both:\n *\n * - `ankh doctor ...`\n * - `bunx @ankhorage/doctor ...`\n *\n * Current command surface:\n *\n * - `validate`\n * - `fix`\n * - `repo`\n * - `package`\n *\n * `doctor#2` adds a profile-based policy engine:\n *\n * - strict `public-package` validation for extracted public package repos\n * - light recognized `integration-monorepo` validation for `ankhorage4`\n * - canonical app-manifest authentication validation for JSON file targets\n * - non-mutating `fix` plans for deterministic mechanical changes only\n *\n * Manifest validation accepts `infra.auth.flow` as the only auth-flow location, rejects\n * `settings.authFlow` with a manual-migration diagnostic, and permits authentication without\n * an authorization block.\n *\n * Still deferred:\n *\n * - GitHub checks\n * - CI checks\n * - on-disk `fix --apply`\n * - deeper cross-repo policy enforcement\n *\n * Path handling:\n *\n * - pass a repo/package directory or app-manifest JSON file as `[path]`, or\n * - omit it to inspect the current working directory\n *\n * @usage\n */\nawait runCli(['--help']);\n"]}

package/dist/secretManifestAnalysis.d.ts

@@ -0,0 +1,3 @@
+import type { DoctorDiagnostic } from './diagnostics.js';
+export declare function analyzeSecretStoreManifest(infra: Record<string, unknown>, manifestPath: string): DoctorDiagnostic[];
+//# sourceMappingURL=secretManifestAnalysis.d.ts.map

package/dist/secretManifestAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManifestAnalysis.d.ts","sourceRoot":"","sources":["../src/secretManifestAnalysis.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAgB,MAAM,kBAAkB,CAAC;AAIvE,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,MAAM,GACnB,gBAAgB,EAAE,CAiKpB"}

package/dist/secretManifestAnalysis.js

@@ -0,0 +1,96 @@
+import { findForbiddenInlineSecretFields, normalizeSecretRef, SECRET_STORE_PROVIDERS, } from '@ankhorage/contracts/secrets';
+const PROFILE = 'app-manifest';
+export function analyzeSecretStoreManifest(infra, manifestPath) {
+    const diagnostics = [];
+    const secretStoreProvider = validateSecretStore(infra.secretStore, manifestPath, diagnostics);
+    if (!isRecord(infra.auth))
+        return diagnostics;
+    const { oauth } = infra.auth;
+    if (oauth === undefined)
+        return diagnostics;
+    if (!isRecord(oauth)) {
+        diagnostics.push(diagnostic('field-invalid', 'manifest.infra.auth.oauth must be a JSON object when present.', manifestPath, 'manifest.auth.oauth.valid-shape'));
+        return diagnostics;
+    }
+    if (typeof oauth.enabled !== 'boolean') {
+        diagnostics.push(diagnostic(oauth.enabled === undefined ? 'field-missing' : 'field-invalid', 'manifest.infra.auth.oauth.enabled must be a boolean.', manifestPath, 'manifest.auth.oauth.valid-shape'));
+    }
+    if (typeof oauth.callbackRoute !== 'string' ||
+        oauth.callbackRoute.trim().length === 0 ||
+        !oauth.callbackRoute.trim().startsWith('/')) {
+        diagnostics.push(diagnostic(oauth.callbackRoute === undefined ? 'field-missing' : 'field-invalid', 'manifest.infra.auth.oauth.callbackRoute must be a non-empty absolute route.', manifestPath, 'manifest.auth.oauth.callback-route.valid'));
+    }
+    if (!Array.isArray(oauth.providers)) {
+        diagnostics.push(diagnostic(oauth.providers === undefined ? 'field-missing' : 'field-invalid', 'manifest.infra.auth.oauth.providers must be an array.', manifestPath, 'manifest.auth.oauth.providers.valid'));
+        return diagnostics;
+    }
+    const enabledProviders = oauth.providers.filter((provider) => isRecord(provider) && provider.enabled !== false);
+    if (oauth.enabled === true && enabledProviders.length === 0) {
+        diagnostics.push(diagnostic('field-invalid', 'OAuth is enabled, but no OAuth providers are enabled.', manifestPath, 'manifest.auth.oauth.providers.valid'));
+    }
+    if (enabledProviders.length > 0 && secretStoreProvider === null) {
+        diagnostics.push(diagnostic('field-missing', 'Enabled OAuth providers require manifest.infra.secretStore.provider.', manifestPath, 'manifest.secret-store.provider.required'));
+    }
+    const seenProviderIds = new Set();
+    for (const [index, provider] of oauth.providers.entries()) {
+        if (!isRecord(provider)) {
+            diagnostics.push(diagnostic('field-invalid', `manifest.infra.auth.oauth.providers[${index}] must be a JSON object.`, manifestPath, 'manifest.auth.oauth.providers.valid'));
+            continue;
+        }
+        const providerId = typeof provider.id === 'string' ? provider.id.trim() : '';
+        if (providerId.length === 0) {
+            diagnostics.push(diagnostic(provider.id === undefined ? 'field-missing' : 'field-invalid', `manifest.infra.auth.oauth.providers[${index}].id must be a non-empty string.`, manifestPath, 'manifest.auth.oauth.providers.valid'));
+        }
+        else if (seenProviderIds.has(providerId)) {
+            diagnostics.push(diagnostic('field-invalid', `OAuth provider id "${providerId}" is configured more than once.`, manifestPath, 'manifest.auth.oauth.provider.duplicate'));
+        }
+        else {
+            seenProviderIds.add(providerId);
+        }
+        for (const field of findForbiddenInlineSecretFields(provider)) {
+            diagnostics.push(diagnostic('field-invalid', `Inline OAuth field "${field}" is forbidden. Store the value in the configured secret store and reference it with credentialsRef.`, manifestPath, 'manifest.auth.oauth.provider.inline-secret.disallowed'));
+        }
+        if (provider.enabled === false)
+            continue;
+        if (typeof provider.credentialsRef !== 'string') {
+            diagnostics.push(diagnostic(provider.credentialsRef === undefined ? 'field-missing' : 'field-invalid', `Enabled OAuth provider "${providerId || index}" requires a credentialsRef.`, manifestPath, 'manifest.auth.oauth.provider.credentials-ref.required'));
+            continue;
+        }
+        const refResult = normalizeSecretRef(provider.credentialsRef);
+        if (!refResult.ok || refResult.data !== provider.credentialsRef) {
+            diagnostics.push(diagnostic('field-invalid', `OAuth provider "${providerId || index}" credentialsRef must be a canonical logical secret reference.`, manifestPath, 'manifest.auth.oauth.provider.credentials-ref.valid'));
+        }
+    }
+    return diagnostics;
+}
+function validateSecretStore(value, manifestPath, diagnostics) {
+    if (value === undefined)
+        return null;
+    if (!isRecord(value)) {
+        diagnostics.push(diagnostic('field-invalid', 'manifest.infra.secretStore must be a JSON object when present.', manifestPath, 'manifest.secret-store.valid-shape'));
+        return null;
+    }
+    if (typeof value.provider !== 'string' || value.provider.trim().length === 0) {
+        diagnostics.push(diagnostic(value.provider === undefined ? 'field-missing' : 'field-invalid', 'manifest.infra.secretStore.provider must be a non-empty string.', manifestPath, 'manifest.secret-store.provider.required'));
+        return null;
+    }
+    const provider = value.provider.trim();
+    if (!SECRET_STORE_PROVIDERS.includes(provider)) {
+        diagnostics.push(diagnostic('field-invalid', `Unsupported secret-store provider "${provider}". Current providers: ${SECRET_STORE_PROVIDERS.join(', ')}.`, manifestPath, 'manifest.secret-store.provider.valid'));
+    }
+    return provider;
+}
+function diagnostic(code, message, path, ruleId) {
+    return {
+        code,
+        message,
+        path,
+        profile: PROFILE,
+        ruleId,
+        severity: 'error',
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=secretManifestAnalysis.js.map

package/dist/secretManifestAnalysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManifestAnalysis.js","sourceRoot":"","sources":["../src/secretManifestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AAItC,MAAM,OAAO,GAAG,cAAuB,CAAC;AAExC,MAAM,UAAU,0BAA0B,CACxC,KAA8B,EAC9B,YAAoB;IAEpB,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAE9F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAE5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,+DAA+D,EAC/D,YAAY,EACZ,iCAAiC,CAClC,CACF,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,WAAW,CAAC,IAAI,CACd,UAAU,CACR,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAC/D,sDAAsD,EACtD,YAAY,EACZ,iCAAiC,CAClC,CACF,CAAC;IACJ,CAAC;IAED,IACE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3C,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CACR,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EACrE,6EAA6E,EAC7E,YAAY,EACZ,0CAA0C,CAC3C,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,WAAW,CAAC,IAAI,CACd,UAAU,CACR,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EACjE,uDAAuD,EACvD,YAAY,EACZ,qCAAqC,CACtC,CACF,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAC7C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAC/D,CAAC;IAEF,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,uDAAuD,EACvD,YAAY,EACZ,qCAAqC,CACtC,CACF,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QAChE,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,sEAAsE,EACtE,YAAY,EACZ,yCAAyC,CAC1C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,uCAAuC,KAAK,0BAA0B,EACtE,YAAY,EACZ,qCAAqC,CACtC,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CACd,UAAU,CACR,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAC7D,uCAAuC,KAAK,kCAAkC,EAC9E,YAAY,EACZ,qCAAqC,CACtC,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,sBAAsB,UAAU,iCAAiC,EACjE,YAAY,EACZ,wCAAwC,CACzC,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,uBAAuB,KAAK,sGAAsG,EAClI,YAAY,EACZ,uDAAuD,CACxD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QAEzC,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CACd,UAAU,CACR,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EACzE,2BAA2B,UAAU,IAAI,KAAK,8BAA8B,EAC5E,YAAY,EACZ,uDAAuD,CACxD,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YAChE,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,mBAAmB,UAAU,IAAI,KAAK,gEAAgE,EACtG,YAAY,EACZ,oDAAoD,CACrD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,YAAoB,EACpB,WAA+B;IAE/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,gEAAgE,EAChE,YAAY,EACZ,mCAAmC,CACpC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,WAAW,CAAC,IAAI,CACd,UAAU,CACR,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAChE,iEAAiE,EACjE,YAAY,EACZ,yCAAyC,CAC1C,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAE,sBAA4C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,WAAW,CAAC,IAAI,CACd,UAAU,CACR,eAAe,EACf,sCAAsC,QAAQ,yBAAyB,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC3G,YAAY,EACZ,sCAAsC,CACvC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,IAA8B,EAC9B,OAAe,EACf,IAAY,EACZ,MAAoB;IAEpB,OAAO;QACL,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,MAAM;QACN,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import {\n  findForbiddenInlineSecretFields,\n  normalizeSecretRef,\n  SECRET_STORE_PROVIDERS,\n} from '@ankhorage/contracts/secrets';\n\nimport type { DoctorDiagnostic, DoctorRuleId } from './diagnostics.js';\n\nconst PROFILE = 'app-manifest' as const;\n\nexport function analyzeSecretStoreManifest(\n  infra: Record<string, unknown>,\n  manifestPath: string,\n): DoctorDiagnostic[] {\n  const diagnostics: DoctorDiagnostic[] = [];\n  const secretStoreProvider = validateSecretStore(infra.secretStore, manifestPath, diagnostics);\n\n  if (!isRecord(infra.auth)) return diagnostics;\n  const { oauth } = infra.auth;\n  if (oauth === undefined) return diagnostics;\n\n  if (!isRecord(oauth)) {\n    diagnostics.push(\n      diagnostic(\n        'field-invalid',\n        'manifest.infra.auth.oauth must be a JSON object when present.',\n        manifestPath,\n        'manifest.auth.oauth.valid-shape',\n      ),\n    );\n    return diagnostics;\n  }\n\n  if (typeof oauth.enabled !== 'boolean') {\n    diagnostics.push(\n      diagnostic(\n        oauth.enabled === undefined ? 'field-missing' : 'field-invalid',\n        'manifest.infra.auth.oauth.enabled must be a boolean.',\n        manifestPath,\n        'manifest.auth.oauth.valid-shape',\n      ),\n    );\n  }\n\n  if (\n    typeof oauth.callbackRoute !== 'string' ||\n    oauth.callbackRoute.trim().length === 0 ||\n    !oauth.callbackRoute.trim().startsWith('/')\n  ) {\n    diagnostics.push(\n      diagnostic(\n        oauth.callbackRoute === undefined ? 'field-missing' : 'field-invalid',\n        'manifest.infra.auth.oauth.callbackRoute must be a non-empty absolute route.',\n        manifestPath,\n        'manifest.auth.oauth.callback-route.valid',\n      ),\n    );\n  }\n\n  if (!Array.isArray(oauth.providers)) {\n    diagnostics.push(\n      diagnostic(\n        oauth.providers === undefined ? 'field-missing' : 'field-invalid',\n        'manifest.infra.auth.oauth.providers must be an array.',\n        manifestPath,\n        'manifest.auth.oauth.providers.valid',\n      ),\n    );\n    return diagnostics;\n  }\n\n  const enabledProviders = oauth.providers.filter(\n    (provider) => isRecord(provider) && provider.enabled !== false,\n  );\n\n  if (oauth.enabled === true && enabledProviders.length === 0) {\n    diagnostics.push(\n      diagnostic(\n        'field-invalid',\n        'OAuth is enabled, but no OAuth providers are enabled.',\n        manifestPath,\n        'manifest.auth.oauth.providers.valid',\n      ),\n    );\n  }\n\n  if (enabledProviders.length > 0 && secretStoreProvider === null) {\n    diagnostics.push(\n      diagnostic(\n        'field-missing',\n        'Enabled OAuth providers require manifest.infra.secretStore.provider.',\n        manifestPath,\n        'manifest.secret-store.provider.required',\n      ),\n    );\n  }\n\n  const seenProviderIds = new Set<string>();\n\n  for (const [index, provider] of oauth.providers.entries()) {\n    if (!isRecord(provider)) {\n      diagnostics.push(\n        diagnostic(\n          'field-invalid',\n          `manifest.infra.auth.oauth.providers[${index}] must be a JSON object.`,\n          manifestPath,\n          'manifest.auth.oauth.providers.valid',\n        ),\n      );\n      continue;\n    }\n\n    const providerId = typeof provider.id === 'string' ? provider.id.trim() : '';\n    if (providerId.length === 0) {\n      diagnostics.push(\n        diagnostic(\n          provider.id === undefined ? 'field-missing' : 'field-invalid',\n          `manifest.infra.auth.oauth.providers[${index}].id must be a non-empty string.`,\n          manifestPath,\n          'manifest.auth.oauth.providers.valid',\n        ),\n      );\n    } else if (seenProviderIds.has(providerId)) {\n      diagnostics.push(\n        diagnostic(\n          'field-invalid',\n          `OAuth provider id \"${providerId}\" is configured more than once.`,\n          manifestPath,\n          'manifest.auth.oauth.provider.duplicate',\n        ),\n      );\n    } else {\n      seenProviderIds.add(providerId);\n    }\n\n    for (const field of findForbiddenInlineSecretFields(provider)) {\n      diagnostics.push(\n        diagnostic(\n          'field-invalid',\n          `Inline OAuth field \"${field}\" is forbidden. Store the value in the configured secret store and reference it with credentialsRef.`,\n          manifestPath,\n          'manifest.auth.oauth.provider.inline-secret.disallowed',\n        ),\n      );\n    }\n\n    if (provider.enabled === false) continue;\n\n    if (typeof provider.credentialsRef !== 'string') {\n      diagnostics.push(\n        diagnostic(\n          provider.credentialsRef === undefined ? 'field-missing' : 'field-invalid',\n          `Enabled OAuth provider \"${providerId || index}\" requires a credentialsRef.`,\n          manifestPath,\n          'manifest.auth.oauth.provider.credentials-ref.required',\n        ),\n      );\n      continue;\n    }\n\n    const refResult = normalizeSecretRef(provider.credentialsRef);\n    if (!refResult.ok || refResult.data !== provider.credentialsRef) {\n      diagnostics.push(\n        diagnostic(\n          'field-invalid',\n          `OAuth provider \"${providerId || index}\" credentialsRef must be a canonical logical secret reference.`,\n          manifestPath,\n          'manifest.auth.oauth.provider.credentials-ref.valid',\n        ),\n      );\n    }\n  }\n\n  return diagnostics;\n}\n\nfunction validateSecretStore(\n  value: unknown,\n  manifestPath: string,\n  diagnostics: DoctorDiagnostic[],\n): string | null {\n  if (value === undefined) return null;\n\n  if (!isRecord(value)) {\n    diagnostics.push(\n      diagnostic(\n        'field-invalid',\n        'manifest.infra.secretStore must be a JSON object when present.',\n        manifestPath,\n        'manifest.secret-store.valid-shape',\n      ),\n    );\n    return null;\n  }\n\n  if (typeof value.provider !== 'string' || value.provider.trim().length === 0) {\n    diagnostics.push(\n      diagnostic(\n        value.provider === undefined ? 'field-missing' : 'field-invalid',\n        'manifest.infra.secretStore.provider must be a non-empty string.',\n        manifestPath,\n        'manifest.secret-store.provider.required',\n      ),\n    );\n    return null;\n  }\n\n  const provider = value.provider.trim();\n  if (!(SECRET_STORE_PROVIDERS as readonly string[]).includes(provider)) {\n    diagnostics.push(\n      diagnostic(\n        'field-invalid',\n        `Unsupported secret-store provider \"${provider}\". Current providers: ${SECRET_STORE_PROVIDERS.join(', ')}.`,\n        manifestPath,\n        'manifest.secret-store.provider.valid',\n      ),\n    );\n  }\n\n  return provider;\n}\n\nfunction diagnostic(\n  code: DoctorDiagnostic['code'],\n  message: string,\n  path: string,\n  ruleId: DoctorRuleId,\n): DoctorDiagnostic {\n  return {\n    code,\n    message,\n    path,\n    profile: PROFILE,\n    ruleId,\n    severity: 'error',\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/doctor",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Executable Ankh provider and standalone CLI for lightweight repo and package compliance diagnostics.",
   "license": "MIT",
   "publishConfig": {
@@ -19,6 +19,9 @@
     "doctor",
     "cli",
     "compliance",
+    "manifest",
+    "secret-store",
+    "oauth",
     "typescript",
     "bun"
   ],
@@ -74,7 +77,7 @@
     "version-packages": "changeset version"
   },
   "dependencies": {
-    "@ankhorage/contracts": "^1.19.0"
+    "@ankhorage/contracts": "^2.1.0"
   },
   "devDependencies": {
     "@ankhorage/ankh": "^0.4.0",

package/src/analysis.ts

@@ -4,7 +4,7 @@ import { pathToFileURL } from 'node:url';
 
 import type { DoctorDiagnostic, DoctorPolicyProfile, DoctorRuleId } from './diagnostics.js';
 
-export type DoctorTargetCheck = 'package' | 'repo';
+export type DoctorTargetCheck = 'manifest' | 'package' | 'repo';
 export type DoctorTargetMode = 'fix' | 'package' | 'repo' | 'validate';
 export type DoctorPlannedChangeKind =
   'create-directory' | 'create-file' | 'update-json' | 'update-text';

package/src/cliLayoutAnalysis.ts

@@ -7,6 +7,7 @@ import {
   type DoctorAnalysisResult,
 } from './analysis.js';
 import type { DoctorDiagnostic, DoctorPolicyProfile } from './diagnostics.js';
+import { analyzeAppManifestTarget } from './manifestAnalysis.js';
 
 const LEGACY_ROOT_CLI_SOURCE = path.join('src', 'cli.ts');
 const CANONICAL_CLI_INDEX_SOURCE = path.join('src', 'cli', 'index.ts');
@@ -62,6 +63,11 @@ interface DependencyEntry {
 export async function analyzeDoctorTargetWithCliLayout(
   request: DoctorAnalysisRequest,
 ): Promise<DoctorAnalysisResult> {
+  const manifestResult = await analyzeAppManifestTarget(request);
+  if (manifestResult !== null) {
+    return manifestResult;
+  }
+
   const result = await analyzeDoctorTarget(request);
   if (!result.hasPackageJson) {
     return result;

package/src/commands.ts

@@ -1,7 +1,7 @@
 import type { AnkhCapabilityId, AnkhCommandDescriptor } from '@ankhorage/contracts/cli';
 
 import type { DoctorAnalysisResult, DoctorPlannedChange, DoctorTargetMode } from './analysis.js';
-import { analyzeDoctorTarget } from './analysis.js';
+import { analyzeDoctorTargetWithCliLayout } from './cliLayoutAnalysis.js';
 import type { DoctorCommandContext, DoctorCommandRunResult } from './commandContext.js';
 import {
   countErrorDiagnostics,
@@ -38,7 +38,7 @@ export interface DoctorCommandInvocation {
 }
 
 export interface DoctorCommandServices {
-  readonly analyzeTarget: typeof analyzeDoctorTarget;
+  readonly analyzeTarget: typeof analyzeDoctorTargetWithCliLayout;
 }
 
 export interface RunDoctorCommandOptions {
@@ -64,7 +64,8 @@ export const DOCTOR_COMMANDS = [
     path: ['validate'],
     capability: COMMAND_CAPABILITIES.validate,
     mode: 'validate',
-    summary: 'Auto-detect the applicable doctor policy profile and validate a local path.',
+    summary:
+      'Validate a repo, package, or app-manifest JSON path with the applicable Doctor profile.',
     run: runValidateCommand,
   },
   {
@@ -147,7 +148,7 @@ export function renderRootHelp(version: string): string {
     commandLines,
     '',
     'Path resolution:',
-    '  Pass [path], or omit it to validate the current working directory.',
+    '  Pass a repo/package directory or app-manifest JSON file, or omit [path] to inspect the current directory.',
     '',
   ].join('\n');
 }
@@ -165,7 +166,7 @@ function renderCommandHelp(command: DoctorCommandDefinition): string {
     `  ankh ${DOCTOR_COMMAND_CATEGORY} ${command.path.join(' ')} [path]`,
     '',
     'Path resolution:',
-    '  Pass [path], or omit it to validate the current working directory.',
+    '  Pass a repo/package directory or app-manifest JSON file, or omit [path] to inspect the current directory.',
     '',
   ].join('\n');
 }
@@ -174,7 +175,7 @@ function createDoctorCommandServices(
   overrides: Partial<DoctorCommandServices> = {},
 ): DoctorCommandServices {
   return {
-    analyzeTarget: overrides.analyzeTarget ?? analyzeDoctorTarget,
+    analyzeTarget: overrides.analyzeTarget ?? analyzeDoctorTargetWithCliLayout,
   };
 }
 

package/src/diagnostics.ts

@@ -2,6 +2,7 @@ export type DoctorDiagnosticCode =
   | 'field-invalid'
   | 'field-missing'
   | 'invalid-ankh-metadata'
+  | 'invalid-app-manifest-json'
   | 'invalid-package-json'
   | 'missing-dependency'
   | 'missing-path'
@@ -13,11 +14,37 @@ export type DoctorDiagnosticCode =
   | 'unsupported-target';
 
 export type DoctorDiagnosticSeverity = 'error' | 'warning';
-export type DoctorPolicyProfile = 'integration-monorepo' | 'public-package' | 'unknown';
+export type DoctorPolicyProfile =
+  'app-manifest' | 'integration-monorepo' | 'public-package' | 'unknown';
 export type DoctorRuleId =
   | 'integration.package.ankh.disallowed'
   | 'integration.package.private.required'
   | 'integration.package.workspaces.required'
+  | 'manifest.auth.authorization.engine.valid'
+  | 'manifest.auth.authorization.kind.valid'
+  | 'manifest.auth.authorization.valid-shape'
+  | 'manifest.auth.flow.post-sign-in.distinct'
+  | 'manifest.auth.flow.route.required'
+  | 'manifest.auth.flow.route.unique'
+  | 'manifest.auth.flow.route.valid'
+  | 'manifest.auth.flow.unauthorized-route.valid'
+  | 'manifest.auth.flow.valid-shape'
+  | 'manifest.auth.oauth.callback-route.valid'
+  | 'manifest.auth.oauth.provider.credentials-ref.required'
+  | 'manifest.auth.oauth.provider.credentials-ref.valid'
+  | 'manifest.auth.oauth.provider.duplicate'
+  | 'manifest.auth.oauth.provider.inline-secret.disallowed'
+  | 'manifest.auth.oauth.providers.valid'
+  | 'manifest.auth.oauth.valid-shape'
+  | 'manifest.auth.valid-shape'
+  | 'manifest.infra.valid-shape'
+  | 'manifest.json.readable'
+  | 'manifest.json.valid'
+  | 'manifest.root.valid-shape'
+  | 'manifest.secret-store.provider.required'
+  | 'manifest.secret-store.provider.valid'
+  | 'manifest.secret-store.valid-shape'
+  | 'manifest.settings.auth-flow.removed'
   | 'package.ankh.capabilities.match-provider'
   | 'package.ankh.present.valid-shape'
   | 'package.ankh.provider-path.required'

package/src/index.ts

@@ -23,6 +23,11 @@ export type {
   DoctorPolicyProfile,
   DoctorRuleId,
 } from './diagnostics.js';
+export {
+  analyzeAppManifest,
+  analyzeAppManifestFile,
+  analyzeAppManifestTarget,
+} from './manifestAnalysis.js';
 export {
   DOCTOR_CAPABILITIES,
   DOCTOR_COMMAND_CATEGORY,