@brandlab-digital/conformance 0.1.0-alpha.8 → 1.0.0-rc.1

package/dist/project.js

@@ -0,0 +1,1039 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { BRANDLAB_FORBIDDEN_SOURCE_PATTERNS, evaluateBrandlabArchitecture, evaluateSharedPackageVersionSpecs, findForbiddenBrandlabPatterns, } from "./vitest.js";
+import { DEFAULT_BRANDLAB_RELEASE_CATALOG, } from "./release-catalog.js";
+import { inspectBrandlabConfigV2, } from "./project-config.js";
+import { BRANDLAB_SHARED_PACKAGE_NAMES, compareBrandlabSemver, digestBrandlabAuthority, isBrandlabSemver, validateBrandlabReleaseCatalog, validateBrandlabRuntimeReleaseCatalog, validateBrandlabRuntimeReleaseCatalogAgainstManifests, validateBrandlabSupportPolicy, } from "./release-manifest.js";
+export const BRANDLAB_CONFORMANCE_SCHEMA_VERSION = "brandlab.conformance.v1";
+export const BRANDLAB_CONFORMANCE_EVALUATOR_VERSION = "control-plane-v1";
+export const BRANDLAB_ARCHITECTURE_EVALUATOR_CONTRACT = "architecture-v3";
+const LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT = "architecture-v2";
+const LEGACY_CONFIGURATION_CONTRACT = "legacy-config-v1";
+const CONFIGURATION_V2_CONTRACT = "project-config-v2";
+const RUNTIME_PACKAGE_FIELDS = [
+    ["next", "next"],
+    ["react", "react"],
+    ["react-dom", "reactDom"],
+    ["typescript", "typescript"],
+];
+export function evaluateBrandlabProject(options) {
+    const root = resolve(options.root);
+    const mode = options.mode ?? "local";
+    const releaseCatalog = options.releaseCatalog ?? DEFAULT_BRANDLAB_RELEASE_CATALOG;
+    const supportPolicy = options.supportPolicy;
+    validateBrandlabRuntimeReleaseCatalog(releaseCatalog);
+    if (options.releaseManifests) {
+        validateBrandlabReleaseCatalog(options.releaseManifests);
+        validateBrandlabRuntimeReleaseCatalogAgainstManifests(releaseCatalog, options.releaseManifests);
+    }
+    validateBrandlabSupportPolicy(supportPolicy, releaseCatalog);
+    const packageJson = readPackageJson(root);
+    const packageLock = readPackageLock(root);
+    const detectedRelease = detectInstalledBrandlabRelease(packageJson);
+    const installedRelease = options.installedRelease === undefined
+        ? detectedRelease
+        : options.installedRelease;
+    const targetRelease = options.targetRelease ?? null;
+    const releaseByVersion = new Map(releaseCatalog.map((manifest) => [manifest.releaseVersion, manifest]));
+    const installedManifest = installedRelease
+        ? releaseByVersion.get(installedRelease) ?? null
+        : null;
+    const targetManifest = targetRelease
+        ? releaseByVersion.get(targetRelease) ?? null
+        : null;
+    const releaseManifestByVersion = new Map((options.releaseManifests ?? []).map((manifest) => [manifest.releaseVersion, manifest]));
+    const findings = [];
+    addReleaseMaintenanceFindings({
+        findings,
+        packageJson,
+        packageLock,
+        installedRelease,
+        detectedRelease,
+        installedManifest,
+        installedAttestation: installedRelease
+            ? releaseManifestByVersion.get(installedRelease) ?? null
+            : null,
+        supportPolicy,
+    });
+    addMigrationFindings({
+        findings,
+        installedRelease,
+        targetRelease,
+        targetManifest,
+        supportPolicy,
+        packageJson,
+        packageLock,
+    });
+    const architectureFingerprint = evaluateApplicableArchitectureContracts({
+        root,
+        findings,
+        installedManifest,
+        targetManifest,
+        targetRelease,
+        architecture: options.architecture,
+    });
+    const sourceRoot = join(root, "src");
+    if (existsSync(sourceRoot)) {
+        for (const match of findForbiddenBrandlabPatterns({
+            roots: [sourceRoot],
+            patterns: BRANDLAB_FORBIDDEN_SOURCE_PATTERNS,
+        })) {
+            findings.push({
+                ruleId: `brandlab-source-${slugify(match.patternName)}`,
+                surface: surfaceForRule(match.patternName),
+                classification: "maintenance",
+                severity: "blocker",
+                contract: {
+                    name: "source-safety",
+                    version: installedManifest?.contracts.architecture ?? "unversioned",
+                },
+                evidenceKind: "static",
+                path: normalizePath(relative(root, match.file)),
+                line: match.line,
+                expected: `No ${match.patternName} source pattern`,
+                actual: `A prohibited source pattern was detected at line ${match.line}.`,
+                remediation: `Remove the ${match.patternName} implementation and use the supported shared-platform path.`,
+            });
+        }
+    }
+    const sortedFindings = findings.sort(compareFindings);
+    const authorityDigest = digestBrandlabAuthority({
+        releaseCatalog,
+        supportPolicy,
+        releaseManifests: options.releaseManifests ?? null,
+    });
+    const contractDigest = digestBrandlabAuthority({
+        installed: installedManifest?.contracts ?? null,
+        target: targetManifest?.contracts ?? null,
+        evaluator: BRANDLAB_ARCHITECTURE_EVALUATOR_CONTRACT,
+    });
+    const implementationFingerprint = digestBrandlabAuthority({
+        packageJson: packageJson ?? null,
+        packageLock: packageLock.fingerprint,
+        brandlabConfig: readOptionalText(join(root, "brandlab.config.ts")),
+        architecture: architectureFingerprint,
+        evidence: sortedFindings.map(({ ruleId, classification, severity, path, line }) => ({
+            ruleId,
+            classification,
+            severity,
+            path: path ?? null,
+            line: line ?? null,
+        })),
+    });
+    return {
+        schemaVersion: BRANDLAB_CONFORMANCE_SCHEMA_VERSION,
+        evaluatorVersion: BRANDLAB_CONFORMANCE_EVALUATOR_VERSION,
+        authorityDigest,
+        contractDigest,
+        implementationFingerprint,
+        mode,
+        installedRelease,
+        targetRelease,
+        findings: sortedFindings,
+        maintenance: summarize(sortedFindings, "maintenance"),
+        migration: summarize(sortedFindings, "migration"),
+        advisory: summarize(sortedFindings, "advisory"),
+    };
+}
+export function shouldFailBrandlabConformance(result) {
+    if (result.maintenance.blockers > 0)
+        return true;
+    return result.mode === "preflight" && result.migration.blockers > 0;
+}
+export function detectInstalledBrandlabRelease(packageJson) {
+    if (!packageJson)
+        return null;
+    const versions = BRANDLAB_SHARED_PACKAGE_NAMES.map((packageName) => packageJson.dependencies?.[packageName] ??
+        packageJson.devDependencies?.[packageName] ??
+        null);
+    if (versions.some((version) => !version || !isBrandlabSemver(version)))
+        return null;
+    return new Set(versions).size === 1 ? versions[0] : null;
+}
+export function readBrandlabArchitectureConfig(root) {
+    const source = readOptionalText(join(root, "brandlab.config.ts"));
+    if (!source)
+        return null;
+    const architectureSource = extractDelimitedProperty(source, "architecture", "{", "}");
+    if (!architectureSource)
+        return null;
+    const architecture = {};
+    assignString(architecture, "profile", extractStringProperty(architectureSource, "profile"));
+    assignString(architecture, "status", extractStringProperty(architectureSource, "status"));
+    assignString(architecture, "targetProfile", extractStringProperty(architectureSource, "targetProfile"));
+    assignString(architecture, "migrationRationale", extractStringProperty(architectureSource, "migrationRationale"));
+    assignNumber(architecture, "staticRouteFileLimit", extractNumberProperty(architectureSource, "staticRouteFileLimit"));
+    assignNumber(architecture, "largeRouteFileLineLimit", extractNumberProperty(architectureSource, "largeRouteFileLineLimit"));
+    assignNumber(architecture, "routeFileContentCharLimit", extractNumberProperty(architectureSource, "routeFileContentCharLimit"));
+    const routeFamiliesSource = extractDelimitedProperty(architectureSource, "routeFamilies", "[", "]");
+    if (routeFamiliesSource) {
+        architecture.routeFamilies = extractObjectBodies(routeFamiliesSource).map((routeFamily) => ({
+            name: extractStringProperty(routeFamily, "name") ?? undefined,
+            model: extractStringProperty(routeFamily, "model") ?? undefined,
+            route: extractStringProperty(routeFamily, "route") ?? undefined,
+            dataSource: extractStringProperty(routeFamily, "dataSource") ?? undefined,
+        }));
+    }
+    const contentOwnershipSource = extractDelimitedProperty(architectureSource, "contentOwnership", "{", "}");
+    if (contentOwnershipSource) {
+        architecture.contentOwnership = {
+            routeFiles: extractStringProperty(contentOwnershipSource, "routeFiles") ?? undefined,
+            pageData: extractStringProperty(contentOwnershipSource, "pageData") ?? undefined,
+            componentCopy: extractStringProperty(contentOwnershipSource, "componentCopy") ?? undefined,
+        };
+    }
+    const topologySource = extractDelimitedProperty(architectureSource, "topology", "{", "}");
+    if (topologySource) {
+        architecture.topology = {
+            allowedRootDirs: extractStringArray(topologySource, "allowedRootDirs"),
+            allowedComponentDirs: extractStringArray(topologySource, "allowedComponentDirs"),
+            allowedLibDirs: extractStringArray(topologySource, "allowedLibDirs"),
+            allowedTypeFiles: extractStringArray(topologySource, "allowedTypeFiles"),
+            legacyAllowedRootDirs: extractStringArray(topologySource, "legacyAllowedRootDirs"),
+            legacyAllowedComponentDirs: extractStringArray(topologySource, "legacyAllowedComponentDirs"),
+            legacyAllowedLibDirs: extractStringArray(topologySource, "legacyAllowedLibDirs"),
+            legacyAllowedTypeFiles: extractStringArray(topologySource, "legacyAllowedTypeFiles"),
+            targetTopology: extractStringProperty(topologySource, "targetTopology") ?? undefined,
+        };
+    }
+    return architecture;
+}
+function addReleaseMaintenanceFindings(options) {
+    const packageJson = options.packageJson;
+    if (!packageJson) {
+        options.findings.push(releaseFinding({
+            ruleId: "brandlab-release-package-json-missing",
+            severity: "blocker",
+            expected: "A readable project package.json",
+            actual: "package.json is missing or invalid.",
+            remediation: "Restore a valid package.json before evaluating Brandlab conformance.",
+        }));
+        return;
+    }
+    const installedRelease = options.installedRelease;
+    if (!installedRelease) {
+        options.findings.push(releaseFinding({
+            ruleId: "brandlab-release-installed-version-unresolved",
+            severity: "blocker",
+            expected: "Four exact, internally aligned Brandlab package versions",
+            actual: "The installed Brandlab release could not be resolved.",
+            remediation: "Pin all four Brandlab packages to one exact supported release.",
+        }));
+        return;
+    }
+    if (!options.installedManifest) {
+        options.findings.push(releaseFinding({
+            ruleId: "brandlab-release-unsupported",
+            severity: "blocker",
+            expected: "An installed release with an embedded runtime contract",
+            actual: `${options.installedRelease} has no runtime release contract.`,
+            remediation: "Use a supported exact release or add and verify its external manifest and runtime projection.",
+        }));
+    }
+    addInstalledPackageLockFindings({
+        findings: options.findings,
+        packageJson,
+        packageLock: options.packageLock,
+        installedRelease,
+        installedAttestation: options.installedAttestation,
+    });
+    const versionIssues = evaluateSharedPackageVersionSpecs({
+        packageJson,
+        expectedVersion: installedRelease,
+        packageNames: BRANDLAB_SHARED_PACKAGE_NAMES,
+    });
+    for (const issue of versionIssues) {
+        options.findings.push(releaseFinding({
+            ruleId: `brandlab-release-package-${issue.issue}`,
+            severity: "blocker",
+            expected: `${issue.packageName}@${installedRelease}`,
+            actual: `${issue.packageName} is ${issue.installedVersion ?? "missing"}.`,
+            remediation: "Restore exact lockstep package pins; do not use ranges, tags or mixed releases.",
+            path: "package.json",
+        }));
+    }
+    if (options.detectedRelease && options.detectedRelease !== installedRelease) {
+        options.findings.push(releaseFinding({
+            ruleId: "brandlab-release-declared-installed-mismatch",
+            severity: "blocker",
+            expected: `Detected package release ${installedRelease}`,
+            actual: `package.json resolves to ${options.detectedRelease}.`,
+            remediation: "Use the detected exact release or correct all four package pins.",
+            path: "package.json",
+        }));
+    }
+    const lifecycle = options.supportPolicy.releases[installedRelease]?.lifecycle;
+    if (options.installedManifest && !lifecycle) {
+        options.findings.push(releaseFinding({
+            ruleId: "brandlab-release-not-operationally-supported",
+            severity: "blocker",
+            expected: "An installed release listed in mutable support policy",
+            actual: `${installedRelease} has a runtime contract but is not approved for operational use.`,
+            remediation: "Use the current supported release or supply the synthetic candidate policy only inside packed release fixtures.",
+        }));
+    }
+    if (lifecycle === "security-blocked" || lifecycle === "retired") {
+        options.findings.push(releaseFinding({
+            ruleId: `brandlab-release-${lifecycle}`,
+            severity: "blocker",
+            expected: "A current or tolerated installed release",
+            actual: `${installedRelease} is ${lifecycle}.`,
+            remediation: "Prepare an owner-approved migration to a supported release.",
+        }));
+    }
+    if (options.installedManifest) {
+        addInstalledRuntimeFindings({
+            findings: options.findings,
+            packageJson,
+            packageLock: options.packageLock,
+            manifest: options.installedManifest,
+        });
+    }
+}
+function addMigrationFindings(options) {
+    if (!options.targetRelease) {
+        if (options.installedRelease &&
+            options.installedRelease !== options.supportPolicy.currentReleaseVersion) {
+            options.findings.push({
+                ...releaseFinding({
+                    ruleId: "brandlab-release-upgrade-available",
+                    severity: "info",
+                    expected: "No migration is active until a target release is approved.",
+                    actual: `${options.supportPolicy.currentReleaseVersion} is current; ${options.installedRelease} remains installed.`,
+                    remediation: "Keep monitoring the tolerated exact pin or select a separately approved target release.",
+                }),
+                classification: "advisory",
+            });
+        }
+        return;
+    }
+    if (!options.targetManifest) {
+        options.findings.push({
+            ...releaseFinding({
+                ruleId: "brandlab-migration-target-unsupported",
+                severity: "blocker",
+                expected: "A target release with an embedded runtime contract",
+                actual: `${options.targetRelease} has no runtime release contract.`,
+                remediation: "Select a manifest-backed runtime contract before preparing migration work.",
+            }),
+            classification: "migration",
+        });
+        return;
+    }
+    const targetLifecycle = options.supportPolicy.releases[options.targetRelease]?.lifecycle;
+    if (!targetLifecycle) {
+        options.findings.push({
+            ...releaseFinding({
+                ruleId: "brandlab-migration-target-not-approved",
+                severity: "blocker",
+                expected: "A target release explicitly approved in mutable support policy",
+                actual: `${options.targetRelease} has a runtime contract but no approved support-policy lifecycle.`,
+                remediation: "Keep the installed release unchanged until the candidate release and project migration are separately approved.",
+            }),
+            classification: "migration",
+        });
+    }
+    if (targetLifecycle === "security-blocked" || targetLifecycle === "retired") {
+        options.findings.push({
+            ...releaseFinding({
+                ruleId: `brandlab-migration-target-${targetLifecycle}`,
+                severity: "blocker",
+                expected: "A current or tolerated target release",
+                actual: `${options.targetRelease} is ${targetLifecycle}.`,
+                remediation: "Select a current or tolerated target release.",
+            }),
+            classification: "migration",
+        });
+        return;
+    }
+    if (!options.installedRelease || options.installedRelease === options.targetRelease)
+        return;
+    const comparison = compareBrandlabSemver(options.targetRelease, options.installedRelease);
+    options.findings.push({
+        ...releaseFinding({
+            ruleId: comparison < 0
+                ? "brandlab-migration-downgrade-review"
+                : "brandlab-migration-target-selected",
+            severity: comparison < 0 ? "blocker" : "info",
+            expected: comparison < 0
+                ? "A separately documented rollback decision"
+                : "Target-release migration evidence",
+            actual: `${options.installedRelease} -> ${options.targetRelease}`,
+            remediation: comparison < 0
+                ? "Use the immutable rollback manifest and record explicit owner approval."
+                : "Address migration findings and preserve the installed release until target proof passes.",
+        }),
+        classification: "migration",
+    });
+    addTargetRuntimeFindings({
+        findings: options.findings,
+        packageJson: options.packageJson,
+        packageLock: options.packageLock,
+        targetManifest: options.targetManifest,
+    });
+}
+function addInstalledPackageLockFindings(options) {
+    const { packageLock } = options;
+    if (packageLock.state !== "valid") {
+        const detail = packageLock.state === "missing"
+            ? "package-lock.json is missing."
+            : packageLock.state === "unsupported"
+                ? `package-lock.json uses unsupported lockfileVersion ${String(packageLock.lockfileVersion)}.`
+                : "package-lock.json is invalid or has no npm root package entry.";
+        options.findings.push(releaseFinding({
+            ruleId: `brandlab-release-package-lock-${packageLock.state}`,
+            severity: "blocker",
+            expected: "A valid npm package-lock.json (lockfile v2 or v3) with root and resolved package evidence",
+            actual: detail,
+            remediation: "Regenerate the npm lockfile from the exact supported package declarations and review the resulting diff.",
+            path: "package-lock.json",
+        }));
+        return;
+    }
+    for (const packageName of BRANDLAB_SHARED_PACKAGE_NAMES) {
+        const declared = declaredPackageSpec(options.packageJson, packageName);
+        const lockedSpec = lockedRootSpec(packageLock, packageName);
+        const resolvedPackage = packageLock.resolvedPackages.get(packageName);
+        if (options.packageJson.dependencies?.[packageName] !== undefined &&
+            options.packageJson.devDependencies?.[packageName] !== undefined) {
+            options.findings.push(releaseFinding({
+                ruleId: "brandlab-release-package-duplicate-declaration",
+                severity: "blocker",
+                expected: `${packageName} declared exactly once`,
+                actual: `${packageName} appears in both dependencies and devDependencies.`,
+                remediation: "Keep each Brandlab package in one appropriate dependency section.",
+                path: "package.json",
+            }));
+        }
+        if (packageLock.rootDependencies[packageName] !== undefined &&
+            packageLock.rootDevDependencies[packageName] !== undefined) {
+            options.findings.push(releaseFinding({
+                ruleId: "brandlab-release-lock-duplicate-declaration",
+                severity: "blocker",
+                expected: `${packageName} recorded once in the lockfile root`,
+                actual: `${packageName} appears in both root dependency sections.`,
+                remediation: "Regenerate the lockfile from the single package.json declaration.",
+                path: "package-lock.json",
+            }));
+        }
+        if (lockedSpec !== options.installedRelease || lockedSpec !== declared) {
+            options.findings.push(releaseFinding({
+                ruleId: "brandlab-release-lock-root-spec-mismatch",
+                severity: "blocker",
+                expected: `${packageName}@${options.installedRelease} in package.json and the lockfile root`,
+                actual: `package.json=${declared ?? "missing"}; lockfile=${lockedSpec ?? "missing"}.`,
+                remediation: "Reinstall from the exact lockstep package declarations so root lock specifications match package.json.",
+                path: "package-lock.json",
+            }));
+        }
+        if (!resolvedPackage ||
+            resolvedPackage.version !== options.installedRelease ||
+            resolvedPackage.linked ||
+            !resolvedPackage.resolved ||
+            !resolvedPackage.integrity) {
+            options.findings.push(releaseFinding({
+                ruleId: "brandlab-release-lock-resolution-mismatch",
+                severity: "blocker",
+                expected: `${packageName} resolved to immutable ${options.installedRelease}`,
+                actual: !resolvedPackage
+                    ? "No resolved node_modules package entry exists."
+                    : `version=${resolvedPackage.version ?? "missing"}; linked=${String(resolvedPackage.linked)}; resolved=${resolvedPackage.resolved ? "present" : "missing"}; integrity=${resolvedPackage.integrity ? "present" : "missing"}.`,
+                remediation: "Produce a clean lockfile with a non-workspace resolved package, source and integrity at the declared exact release.",
+                path: "package-lock.json",
+            }));
+        }
+        const expectedIntegrity = options.installedAttestation?.packages[packageName].registry.integrity;
+        if (expectedIntegrity && resolvedPackage?.integrity !== expectedIntegrity) {
+            options.findings.push(releaseFinding({
+                ruleId: "brandlab-release-lock-integrity-mismatch",
+                severity: "blocker",
+                expected: `${packageName} lock integrity matching the immutable release manifest`,
+                actual: resolvedPackage?.integrity
+                    ? "The lock integrity differs from verified registry evidence."
+                    : "The lock integrity is missing.",
+                remediation: "Recreate the lock from the verified registry release and investigate unexpected package content.",
+                path: "package-lock.json",
+            }));
+        }
+    }
+}
+function addInstalledRuntimeFindings(options) {
+    for (const [packageName, runtimeField] of RUNTIME_PACKAGE_FIELDS) {
+        const expected = options.manifest.runtime[runtimeField];
+        const declared = declaredPackageSpec(options.packageJson, packageName);
+        if (declared !== expected) {
+            options.findings.push(runtimeFinding({
+                ruleId: `brandlab-runtime-${slugify(packageName)}-declaration`,
+                expected: `${packageName}@${expected} declared exactly`,
+                actual: `${packageName} is ${declared ?? "missing"}.`,
+                remediation: `Use the ${options.manifest.releaseVersion} embedded runtime contract.`,
+                path: "package.json",
+            }));
+        }
+        if (options.packageLock.state !== "valid")
+            continue;
+        const lockedSpec = lockedRootSpec(options.packageLock, packageName);
+        const resolved = options.packageLock.resolvedPackages.get(packageName);
+        if (lockedSpec !== expected || lockedSpec !== declared) {
+            options.findings.push(runtimeFinding({
+                ruleId: `brandlab-runtime-${slugify(packageName)}-lock-spec`,
+                expected: `${packageName}@${expected} in the lockfile root`,
+                actual: `package.json=${declared ?? "missing"}; lockfile=${lockedSpec ?? "missing"}.`,
+                remediation: "Regenerate package-lock.json from the exact runtime declaration.",
+                path: "package-lock.json",
+            }));
+        }
+        if (!resolved || resolved.version !== expected || resolved.linked) {
+            options.findings.push(runtimeFinding({
+                ruleId: `brandlab-runtime-${slugify(packageName)}-resolution`,
+                expected: `${packageName} resolved to ${expected}`,
+                actual: !resolved
+                    ? "No resolved node_modules package entry exists."
+                    : `version=${resolved.version ?? "missing"}; linked=${String(resolved.linked)}.`,
+                remediation: "Reinstall the immutable runtime baseline and preserve the reviewed lockfile.",
+                path: "package-lock.json",
+            }));
+        }
+    }
+    const nodeEngine = options.packageJson.engines?.node ?? null;
+    if (nodeEngine !== options.manifest.runtime.node) {
+        options.findings.push(runtimeFinding({
+            ruleId: "brandlab-runtime-node-declaration",
+            expected: `engines.node=${options.manifest.runtime.node}`,
+            actual: `engines.node=${nodeEngine ?? "missing"}.`,
+            remediation: "Restore the installed release's Node engine declaration.",
+            path: "package.json",
+        }));
+    }
+    if (options.packageLock.state === "valid" &&
+        options.packageLock.rootEngines.node !== options.manifest.runtime.node) {
+        options.findings.push(runtimeFinding({
+            ruleId: "brandlab-runtime-node-lock-spec",
+            expected: `lockfile root engines.node=${options.manifest.runtime.node}`,
+            actual: `lockfile root engines.node=${options.packageLock.rootEngines.node ?? "missing"}.`,
+            remediation: "Regenerate package-lock.json after restoring the supported Node engine.",
+            path: "package-lock.json",
+        }));
+    }
+    if (options.packageJson.packageManager !== options.manifest.runtime.packageManager) {
+        options.findings.push(runtimeFinding({
+            ruleId: "brandlab-runtime-package-manager",
+            expected: `packageManager=${options.manifest.runtime.packageManager}`,
+            actual: `packageManager=${options.packageJson.packageManager ?? "missing"}.`,
+            remediation: "Restore the installed release's exact npm package-manager declaration.",
+            path: "package.json",
+        }));
+    }
+}
+function addTargetRuntimeFindings(options) {
+    if (!options.packageJson)
+        return;
+    const packageMismatches = [];
+    for (const packageName of BRANDLAB_SHARED_PACKAGE_NAMES) {
+        const declared = declaredPackageSpec(options.packageJson, packageName);
+        const locked = lockedRootSpec(options.packageLock, packageName);
+        const resolved = options.packageLock.resolvedPackages.get(packageName)?.version ?? null;
+        if (declared !== options.targetManifest.releaseVersion ||
+            locked !== options.targetManifest.releaseVersion ||
+            resolved !== options.targetManifest.releaseVersion) {
+            packageMismatches.push(`${packageName}(declared=${declared ?? "missing"},locked=${locked ?? "missing"},resolved=${resolved ?? "missing"})`);
+        }
+    }
+    if (packageMismatches.length > 0) {
+        options.findings.push(migrationRuntimeFinding({
+            ruleId: "brandlab-migration-package-provenance",
+            expected: `All four packages declared and locked at ${options.targetManifest.releaseVersion}`,
+            actual: packageMismatches.join("; "),
+            remediation: "Apply the target exact pins in an approved migration branch and regenerate the reviewed lockfile.",
+        }));
+    }
+    const runtimeMismatches = [];
+    for (const [packageName, runtimeField] of RUNTIME_PACKAGE_FIELDS) {
+        const expected = options.targetManifest.runtime[runtimeField];
+        const declared = declaredPackageSpec(options.packageJson, packageName);
+        const locked = lockedRootSpec(options.packageLock, packageName);
+        const resolved = options.packageLock.resolvedPackages.get(packageName)?.version ?? null;
+        if (declared !== expected || locked !== expected || resolved !== expected) {
+            runtimeMismatches.push(`${packageName}(expected=${expected},declared=${declared ?? "missing"},locked=${locked ?? "missing"},resolved=${resolved ?? "missing"})`);
+        }
+    }
+    if (options.packageJson.engines?.node !== options.targetManifest.runtime.node) {
+        runtimeMismatches.push(`node(expected=${options.targetManifest.runtime.node},actual=${options.packageJson.engines?.node ?? "missing"})`);
+    }
+    if (options.packageJson.packageManager !== options.targetManifest.runtime.packageManager) {
+        runtimeMismatches.push(`packageManager(expected=${options.targetManifest.runtime.packageManager},actual=${options.packageJson.packageManager ?? "missing"})`);
+    }
+    if (runtimeMismatches.length > 0) {
+        options.findings.push(migrationRuntimeFinding({
+            ruleId: "brandlab-migration-runtime-baseline",
+            expected: `The ${options.targetManifest.releaseVersion} immutable runtime baseline`,
+            actual: runtimeMismatches.join("; "),
+            remediation: "Apply and lock the target runtime only inside the separately approved migration.",
+        }));
+    }
+}
+function runtimeFinding(options) {
+    return {
+        ruleId: options.ruleId,
+        surface: "runtime",
+        classification: "maintenance",
+        severity: "blocker",
+        contract: { name: "runtime", version: "installed-runtime-contract" },
+        evidenceKind: "static",
+        path: options.path,
+        expected: options.expected,
+        actual: options.actual,
+        remediation: options.remediation,
+    };
+}
+function migrationRuntimeFinding(options) {
+    return {
+        ruleId: options.ruleId,
+        surface: "runtime",
+        classification: "migration",
+        severity: "blocker",
+        contract: { name: "runtime", version: "target-runtime-contract" },
+        evidenceKind: "static",
+        path: "package-lock.json",
+        expected: options.expected,
+        actual: options.actual,
+        remediation: options.remediation,
+    };
+}
+function evaluateApplicableArchitectureContracts(options) {
+    const installedConfiguration = options.installedManifest?.contracts.configuration ?? null;
+    const targetConfiguration = options.targetManifest?.contracts.configuration ?? null;
+    const hasDistinctTarget = Boolean(options.targetRelease &&
+        options.targetRelease !== options.installedManifest?.releaseVersion);
+    let configV2Inspection = null;
+    const inspectConfigV2 = () => {
+        configV2Inspection ??= inspectBrandlabConfigV2(options.root);
+        return configV2Inspection;
+    };
+    let legacyReport = null;
+    const inspectLegacy = () => {
+        if (legacyReport)
+            return legacyReport;
+        const architecture = options.architecture === undefined
+            ? readBrandlabArchitectureConfig(options.root)
+            : options.architecture;
+        legacyReport = evaluateBrandlabArchitecture({ root: options.root, architecture });
+        return legacyReport;
+    };
+    if (installedConfiguration === CONFIGURATION_V2_CONTRACT) {
+        const inspection = inspectConfigV2();
+        for (const issue of inspection.issues) {
+            options.findings.push(mapConfigV2Issue(issue, "maintenance", installedConfiguration));
+        }
+    }
+    else if (installedConfiguration === LEGACY_CONFIGURATION_CONTRACT) {
+        const report = inspectLegacy();
+        const installedArchitecture = options.installedManifest?.contracts.architecture ?? null;
+        for (const issue of report.issues) {
+            const classification = installedArchitecture === LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT ||
+                issue.code === "brandlab-architecture-config-missing"
+                ? "maintenance"
+                : "advisory";
+            if (classification === "advisory" &&
+                hasDistinctTarget &&
+                options.targetManifest?.contracts.architecture === LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT) {
+                continue;
+            }
+            options.findings.push(mapArchitectureIssue(issue, classification, {
+                contractVersion: classification === "maintenance"
+                    ? installedArchitecture
+                    : LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
+            }));
+        }
+    }
+    else if (!options.installedManifest) {
+        // Unsupported or unadopted projects still benefit from architecture
+        // diagnosis, but no current evaluator may retroactively become their
+        // installed maintenance contract. Keep this lane advisory until a
+        // supported target release is explicitly selected.
+        const configSource = readOptionalText(join(options.root, "brandlab.config.ts"));
+        if (/\bdefineBrandlabProject\s*\(/.test(configSource ?? "")) {
+            for (const issue of inspectConfigV2().issues) {
+                options.findings.push(mapConfigV2Issue(issue, "advisory", CONFIGURATION_V2_CONTRACT));
+            }
+        }
+        else {
+            for (const issue of inspectLegacy().issues) {
+                options.findings.push(mapArchitectureIssue(issue, "advisory", {
+                    contractVersion: LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
+                }));
+            }
+        }
+    }
+    if (hasDistinctTarget && targetConfiguration === CONFIGURATION_V2_CONTRACT) {
+        for (const issue of inspectConfigV2().issues) {
+            options.findings.push(mapConfigV2Issue(issue, "migration", targetConfiguration));
+        }
+    }
+    else if (hasDistinctTarget &&
+        targetConfiguration === LEGACY_CONFIGURATION_CONTRACT &&
+        options.targetManifest?.contracts.architecture === LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT &&
+        options.installedManifest?.contracts.architecture !== LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT) {
+        for (const issue of inspectLegacy().issues) {
+            options.findings.push(mapArchitectureIssue(issue, "migration", {
+                contractVersion: LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
+            }));
+        }
+    }
+    const inspectedLegacy = legacyReport;
+    const inspectedConfigV2 = configV2Inspection;
+    return {
+        evaluator: BRANDLAB_ARCHITECTURE_EVALUATOR_CONTRACT,
+        installedContract: options.installedManifest?.contracts.architecture ?? null,
+        targetContract: options.targetManifest?.contracts.architecture ?? null,
+        legacy: inspectedLegacy
+            ? {
+                evaluator: LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
+                profile: inspectedLegacy.profile,
+                status: inspectedLegacy.status,
+                pages: inspectedLegacy.pageFileCount,
+            }
+            : null,
+        configV2: inspectedConfigV2
+            ? {
+                projectId: inspectedConfigV2.config?.projectId ?? null,
+                profile: inspectedConfigV2.config?.profile ?? null,
+                imports: [...inspectedConfigV2.imports].sort(),
+                executableImports: [...inspectedConfigV2.executableImports].sort(),
+            }
+            : null,
+    };
+}
+function mapArchitectureIssue(issue, classification, options) {
+    const rawSeverity = issue.severity === "error"
+        ? "blocker"
+        : issue.severity === "warning"
+            ? "warning"
+            : "info";
+    const severity = classification === "advisory" && rawSeverity === "blocker"
+        ? "warning"
+        : rawSeverity;
+    return {
+        ruleId: issue.code,
+        surface: surfaceForRule(issue.code),
+        classification,
+        severity,
+        contract: {
+            name: "architecture",
+            version: options.contractVersion ?? LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
+        },
+        evidenceKind: "static",
+        path: issue.path,
+        expected: issue.fix ?? "The project matches its applicable Brandlab architecture contract.",
+        actual: issue.detail,
+        remediation: issue.fix ?? "Apply the supported shared-platform implementation for this rule.",
+    };
+}
+function mapConfigV2Issue(issue, classification, contractVersion) {
+    const severity = classification === "advisory" && issue.severity === "blocker"
+        ? "warning"
+        : issue.severity;
+    return {
+        ruleId: issue.ruleId,
+        surface: issue.surface,
+        classification,
+        severity,
+        contract: {
+            name: "configuration",
+            version: contractVersion ?? "project-config-v2",
+        },
+        evidenceKind: issue.evidenceKind,
+        path: issue.path,
+        line: issue.line,
+        expected: issue.expected,
+        actual: issue.actual,
+        remediation: issue.remediation,
+    };
+}
+function releaseFinding(options) {
+    return {
+        ruleId: options.ruleId,
+        surface: "release",
+        classification: "maintenance",
+        severity: options.severity,
+        contract: { name: "release-authority", version: "v3" },
+        evidenceKind: "static",
+        path: options.path,
+        expected: options.expected,
+        actual: options.actual,
+        remediation: options.remediation,
+    };
+}
+function summarize(findings, classification) {
+    const relevant = findings.filter((finding) => finding.classification === classification);
+    const blockers = relevant.filter((finding) => finding.severity === "blocker").length;
+    const warnings = relevant.filter((finding) => finding.severity === "warning").length;
+    const info = relevant.filter((finding) => finding.severity === "info").length;
+    return {
+        status: blockers > 0 ? "blocked" : warnings > 0 ? "warning" : "pass",
+        total: relevant.length,
+        blockers,
+        warnings,
+        info,
+    };
+}
+function readPackageJson(root) {
+    const source = readOptionalText(join(root, "package.json"));
+    if (!source)
+        return null;
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+}
+function readPackageLock(root) {
+    const path = join(root, "package-lock.json");
+    const source = readOptionalText(path);
+    if (!source) {
+        return emptyPackageLockInspection("missing");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        return emptyPackageLockInspection("invalid", {
+            digest: digestBrandlabAuthority(source),
+        });
+    }
+    if (!isObjectRecord(parsed)) {
+        return emptyPackageLockInspection("invalid", {
+            digest: digestBrandlabAuthority(parsed),
+        });
+    }
+    const lockfileVersion = typeof parsed.lockfileVersion === "number"
+        ? parsed.lockfileVersion
+        : null;
+    if (lockfileVersion !== 2 && lockfileVersion !== 3) {
+        return emptyPackageLockInspection("unsupported", {
+            lockfileVersion,
+            digest: digestBrandlabAuthority(parsed),
+        });
+    }
+    if (!isObjectRecord(parsed.packages) || !isObjectRecord(parsed.packages[""])) {
+        return emptyPackageLockInspection("invalid", {
+            lockfileVersion,
+            digest: digestBrandlabAuthority(parsed),
+        });
+    }
+    const rootPackage = parsed.packages[""];
+    const rootDependencies = stringRecord(rootPackage.dependencies);
+    const rootDevDependencies = stringRecord(rootPackage.devDependencies);
+    const rootEngines = stringRecord(rootPackage.engines);
+    const resolvedPackages = new Map();
+    for (const packageName of [...BRANDLAB_SHARED_PACKAGE_NAMES, ...RUNTIME_PACKAGE_FIELDS.map(([name]) => name)]) {
+        const entry = parsed.packages[`node_modules/${packageName}`];
+        if (!isObjectRecord(entry))
+            continue;
+        resolvedPackages.set(packageName, {
+            version: typeof entry.version === "string" ? entry.version : null,
+            resolved: typeof entry.resolved === "string" ? entry.resolved : null,
+            integrity: typeof entry.integrity === "string" ? entry.integrity : null,
+            linked: entry.link === true,
+        });
+    }
+    return {
+        state: "valid",
+        lockfileVersion,
+        rootDependencies,
+        rootDevDependencies,
+        rootEngines,
+        resolvedPackages,
+        fingerprint: {
+            state: "valid",
+            lockfileVersion,
+            root: {
+                packages: Object.fromEntries([...BRANDLAB_SHARED_PACKAGE_NAMES, ...RUNTIME_PACKAGE_FIELDS.map(([name]) => name)]
+                    .map((packageName) => [packageName, lockedRootSpec({
+                        state: "valid",
+                        lockfileVersion,
+                        rootDependencies,
+                        rootDevDependencies,
+                        rootEngines,
+                        resolvedPackages,
+                        fingerprint: {},
+                    }, packageName)])),
+                node: rootEngines.node ?? null,
+            },
+            resolved: Object.fromEntries([...resolvedPackages.entries()].map(([packageName, entry]) => [
+                packageName,
+                { version: entry.version, linked: entry.linked },
+            ])),
+        },
+    };
+}
+function emptyPackageLockInspection(state, extra = {}) {
+    return {
+        state,
+        lockfileVersion: typeof extra.lockfileVersion === "number" ? extra.lockfileVersion : null,
+        rootDependencies: {},
+        rootDevDependencies: {},
+        rootEngines: {},
+        resolvedPackages: new Map(),
+        fingerprint: { state, ...extra },
+    };
+}
+function declaredPackageSpec(packageJson, packageName) {
+    return packageJson.dependencies?.[packageName] ??
+        packageJson.devDependencies?.[packageName] ??
+        null;
+}
+function lockedRootSpec(packageLock, packageName) {
+    return packageLock.rootDependencies[packageName] ??
+        packageLock.rootDevDependencies[packageName] ??
+        null;
+}
+function stringRecord(value) {
+    if (!isObjectRecord(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function isObjectRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function readOptionalText(path) {
+    return existsSync(path) ? readFileSync(path, "utf8") : null;
+}
+function extractDelimitedProperty(source, propertyName, openChar, closeChar) {
+    const propertyMatch = source.match(new RegExp(`\\b${escapeRegExp(propertyName)}\\s*:`));
+    if (!propertyMatch || propertyMatch.index === undefined)
+        return null;
+    const start = source.indexOf(openChar, propertyMatch.index + propertyMatch[0].length);
+    if (start === -1)
+        return null;
+    return extractDelimitedBody(source, start, openChar, closeChar);
+}
+function extractDelimitedBody(source, start, openChar, closeChar) {
+    let depth = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = start; index < source.length; index += 1) {
+        const char = source[index];
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === "`")
+            quote = char;
+        else if (char === openChar)
+            depth += 1;
+        else if (char === closeChar) {
+            depth -= 1;
+            if (depth === 0)
+                return source.slice(start + 1, index);
+        }
+    }
+    return null;
+}
+function extractObjectBodies(source) {
+    const bodies = [];
+    let quote = null;
+    let escaped = false;
+    let arrayDepth = 0;
+    for (let index = 0; index < source.length; index += 1) {
+        const char = source[index];
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === "`") {
+            quote = char;
+            continue;
+        }
+        if (char === "[")
+            arrayDepth += 1;
+        else if (char === "]")
+            arrayDepth -= 1;
+        else if (char === "{" && arrayDepth === 0) {
+            const body = extractDelimitedBody(source, index, "{", "}");
+            if (body !== null) {
+                bodies.push(body);
+                index += body.length + 1;
+            }
+        }
+    }
+    return bodies;
+}
+function extractStringProperty(source, propertyName) {
+    return source.match(new RegExp("\\b" + escapeRegExp(propertyName) + "\\s*:\\s*['\"`]([^'\"`]+)['\"`]", "m"))?.[1] ?? null;
+}
+function extractNumberProperty(source, propertyName) {
+    const raw = source.match(new RegExp(`\\b${escapeRegExp(propertyName)}\\s*:\\s*(\\d+)`, "m"))?.[1];
+    return raw ? Number(raw) : null;
+}
+function extractStringArray(source, propertyName) {
+    const arraySource = extractDelimitedProperty(source, propertyName, "[", "]");
+    if (arraySource === null)
+        return undefined;
+    return [...arraySource.matchAll(/['\"]([^'\"]+)['\"]/g)].map((match) => match[1]);
+}
+function assignString(target, key, value) {
+    if (value !== null)
+        target[key] = value;
+}
+function assignNumber(target, key, value) {
+    if (value !== null)
+        target[key] = value;
+}
+function surfaceForRule(ruleId) {
+    for (const surface of [
+        "contact",
+        "metadata",
+        "schema",
+        "sitemap",
+        "breadcrumb",
+        "analytics",
+        "accessibility",
+        "runtime",
+        "release",
+    ]) {
+        if (ruleId.toLowerCase().includes(surface))
+            return surface;
+    }
+    if (/api key|secret|credential|recaptcha/i.test(ruleId))
+        return "security";
+    return "architecture";
+}
+function slugify(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function normalizePath(value) {
+    return value.split(/[/\\]/).join("/");
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function compareFindings(first, second) {
+    const classificationOrder = {
+        maintenance: 0,
+        migration: 1,
+        advisory: 2,
+    };
+    const severityOrder = {
+        blocker: 0,
+        warning: 1,
+        info: 2,
+    };
+    return (classificationOrder[first.classification] - classificationOrder[second.classification] ||
+        severityOrder[first.severity] - severityOrder[second.severity] ||
+        first.ruleId.localeCompare(second.ruleId) ||
+        (first.path ?? "").localeCompare(second.path ?? ""));
+}
+//# sourceMappingURL=project.js.map