@brandlab-digital/conformance 1.0.0-rc.9 → 1.0.0

package/dist/project.js

@@ -1,195 +1,147 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import { evaluateSharedPackageVersionSpecs, findForbiddenBrandlabPatterns, } from "./vitest.js";
-import { DEFAULT_BRANDLAB_RELEASE_CATALOG, } from "./release-catalog.js";
-import { BRANDLAB_CONFIG_V3_RULESET_ID, inspectBrandlabConfigV3, } from "./project-config-v3.js";
-import { BRANDLAB_CONFIG_V2_RULESET_ID, inspectBrandlabConfigV2 as inspectImmutableBrandlabConfigV2, } from "./project-config-v2-contract.js";
-import { BRANDLAB_DEPRECATED_SCHEMA_SOURCE_PATTERNS, BRANDLAB_SCHEMA_HYGIENE_V3_RULESET_ID, } from "./schema-hygiene.js";
-import { BRANDLAB_SOURCE_SAFETY_V2_PATTERNS, BRANDLAB_SOURCE_SAFETY_V2_RULESET_ID, sourceSafetyRulesetForArchitecture, targetOnlySourceSafetyPatterns, } from "./source-safety-contracts.js";
-import { inspectLegacyArchitectureContract, legacyArchitectureRulesetId, targetOnlyLegacyArchitectureIssues, } from "./legacy-architecture-contracts.js";
-import { BRANDLAB_SHARED_PACKAGE_NAMES, compareBrandlabSemver, digestBrandlabAuthority, isBrandlabSemver, validateBrandlabReleaseCatalog, validateBrandlabRuntimeReleaseCatalog, validateBrandlabRuntimeReleaseManifestSubsetAgainstCatalog, validateBrandlabSupportPolicy, } from "./release-manifest.js";
-export const BRANDLAB_CONFORMANCE_SCHEMA_VERSION = "brandlab.conformance.v1";
-export const BRANDLAB_CONFORMANCE_EVALUATOR_VERSION = "control-plane-v1";
-export const BRANDLAB_ARCHITECTURE_DISPATCH_RULESET_ID = "version-aware-architecture-dispatch-v1";
-const LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT = "architecture-v2";
-const LEGACY_CONFIGURATION_CONTRACT = "legacy-config-v1";
-const CONFIGURATION_V2_CONTRACT = "project-config-v2";
-const CONFIGURATION_V3_CONTRACT = "project-config-v3";
-const SEO_V3_CONTRACT = "seo-v3";
+import { BRANDLAB_CURRENT_RUNTIME_RELEASE } from "./current-release.js";
+import { BRANDLAB_SHARED_PACKAGE_NAMES, compareBrandlabSemver, digestBrandlabAuthority, isBrandlabSemver, projectBrandlabRuntimeReleaseContract, validateBrandlabReleaseManifest, validateBrandlabRuntimeReleaseContract, } from "./release-manifest.js";
+import { applyBrandlabVerificationPolicy, BRANDLAB_VERIFICATION_POLICY_VERSION, } from "./verification-policy.js";
+export { BRANDLAB_VERIFICATION_CHECKS, BRANDLAB_VERIFICATION_FAMILIES, BRANDLAB_VERIFICATION_POLICY_VERSION, } from "./verification-policy.js";
+export const BRANDLAB_CONFORMANCE_SCHEMA_VERSION = "brandlab.conformance.v2";
+export const BRANDLAB_CONFORMANCE_EVALUATOR_VERSION = "current-only-v2";
 const RUNTIME_PACKAGE_FIELDS = [
     ["next", "next"],
     ["react", "react"],
     ["react-dom", "reactDom"],
     ["typescript", "typescript"],
 ];
+const SOURCE_EXTENSIONS = new Set([".js", ".jsx", ".mjs", ".ts", ".tsx"]);
+const SOURCE_RULES = [
+    {
+        ruleId: "brandlab-source-retired-analytics-event",
+        surface: "analytics",
+        pattern: /\b(?:contact_form_submission|phone_calls|form_start|cta_click)\b/,
+        expected: "Only the current Brandlab analytics event contract is used.",
+        remediation: "Use the canonical phone_call and contact_form events.",
+    },
+    {
+        ruleId: "brandlab-source-local-google-tag-bootstrap",
+        surface: "analytics",
+        pattern: /googletagmanager\.com\/gtag\/js|window\.dataLayer\s*=\s*window\.dataLayer|function\s+gtag\s*\(/,
+        expected: "Google tag bootstrap is owned by the shared analytics runtime.",
+        remediation: "Remove the project-local bootstrap and supply only approved analytics identifiers.",
+    },
+    {
+        ruleId: "brandlab-source-local-contact-delivery",
+        surface: "contact",
+        pattern: /\.emails\.send\s*\(|resend\.emails\.send\s*\(/,
+        expected: "Email delivery is owned by the shared contact runtime.",
+        remediation: "Pass the Resend client to the shared contact adapter instead of sending locally.",
+    },
+    {
+        ruleId: "brandlab-source-local-contact-email-renderer",
+        surface: "contact",
+        pattern: /\bContactFormEmail\b|\brenderContactEmail\b/,
+        expected: "Contact email rendering is owned by the shared contact runtime.",
+        remediation: "Remove the local email renderer and configure shared brand variation only.",
+    },
+    {
+        ruleId: "brandlab-source-dangerously-set-inner-html",
+        surface: "security",
+        pattern: /\bdangerouslySetInnerHTML\b/,
+        expected: "No project-owned raw HTML injection.",
+        remediation: "Use structured React output or the shared sanitised renderer.",
+    },
+    {
+        ruleId: "brandlab-source-raw-json-ld",
+        surface: "schema",
+        pattern: /application\/ld\+json/,
+        expected: "Structured data is rendered through the shared schema component.",
+        remediation: "Replace raw JSON-LD output with the shared schema graph renderer.",
+    },
+    {
+        ruleId: "brandlab-source-self-serving-rating-schema",
+        surface: "schema",
+        pattern: /['"]AggregateRating['"]/,
+        expected: "No self-serving aggregate rating schema.",
+        remediation: "Show verified review proof visibly without LocalBusiness or Organization rating schema.",
+    },
+    {
+        ruleId: "brandlab-source-synthetic-offer-schema",
+        surface: "schema",
+        pattern: /\bpriceValidUntil\b|['"]@type['"]\s*:\s*['"]Offer['"]/,
+        expected: "No synthetic Offer markup on service pages.",
+        remediation: "Remove invented Offer data and use the shared service schema.",
+    },
+    {
+        ruleId: "brandlab-source-local-google-reviews-fetch",
+        surface: "reviews",
+        pattern: /places\.googleapis\.com|maps\.googleapis\.com\/maps\/api\/place/,
+        expected: "Google Places fetching is owned by the shared review runtime.",
+        remediation: "Provide only the verified Place ID, Maps URL and server-side API key.",
+    },
+    {
+        ruleId: "brandlab-source-public-secret",
+        surface: "security",
+        pattern: /NEXT_PUBLIC_[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN)/,
+        expected: "Secrets remain server-only.",
+        remediation: "Move the credential to an approved server-only environment variable.",
+    },
+    {
+        ruleId: "brandlab-source-retired-contact-state",
+        surface: "contact",
+        pattern: /\bCONTACT_CONTEXT_SECRET\b|\bKV_REST_API_(?:URL|TOKEN)\b/,
+        expected: "The simplified contact runtime has no project-level state-service requirement.",
+        remediation: "Remove the retired contact state variables and use the shared stateless contact flow.",
+    },
+];
 export function evaluateBrandlabProject(options) {
     const root = resolve(options.root);
     const mode = options.mode ?? "local";
-    const releaseCatalog = options.releaseCatalog ?? DEFAULT_BRANDLAB_RELEASE_CATALOG;
-    const supportPolicy = options.supportPolicy;
-    validateBrandlabRuntimeReleaseCatalog(releaseCatalog);
-    if (options.releaseManifests) {
-        validateBrandlabReleaseCatalog(options.releaseManifests);
-        validateBrandlabRuntimeReleaseManifestSubsetAgainstCatalog(releaseCatalog, options.releaseManifests);
+    const release = options.release ?? BRANDLAB_CURRENT_RUNTIME_RELEASE;
+    validateBrandlabRuntimeReleaseContract(release);
+    if (options.releaseManifest) {
+        validateBrandlabReleaseManifest(options.releaseManifest);
+        if (digestBrandlabAuthority(projectBrandlabRuntimeReleaseContract(options.releaseManifest)) !==
+            digestBrandlabAuthority(release)) {
+            throw new Error("The release manifest differs from the embedded current release.");
+        }
     }
-    validateBrandlabSupportPolicy(supportPolicy, releaseCatalog);
     const packageJson = readPackageJson(root);
     const packageLock = readPackageLock(root);
     const detectedRelease = detectInstalledBrandlabRelease(packageJson);
-    const installedRelease = options.installedRelease === undefined
-        ? detectedRelease
-        : options.installedRelease;
-    const targetRelease = options.targetRelease ?? null;
-    const releaseByVersion = new Map(releaseCatalog.map((manifest) => [manifest.releaseVersion, manifest]));
-    const installedManifest = installedRelease
-        ? releaseByVersion.get(installedRelease) ?? null
-        : null;
-    const targetManifest = targetRelease
-        ? releaseByVersion.get(targetRelease) ?? null
+    const installedRelease = options.installedRelease === undefined ? detectedRelease : options.installedRelease;
+    const manifest = release.releaseVersion === installedRelease ? release : null;
+    const attestation = options.releaseManifest?.releaseVersion === installedRelease
+        ? options.releaseManifest
         : null;
-    const releaseManifestByVersion = new Map((options.releaseManifests ?? []).map((manifest) => [manifest.releaseVersion, manifest]));
     const findings = [];
-    addReleaseMaintenanceFindings({
+    inspectRelease({
         findings,
         packageJson,
         packageLock,
         installedRelease,
         detectedRelease,
-        installedManifest,
-        installedAttestation: installedRelease
-            ? releaseManifestByVersion.get(installedRelease) ?? null
-            : null,
-        releaseAttestationsRequired: options.releaseManifests !== undefined,
-        supportPolicy,
-    });
-    addMigrationFindings({
-        findings,
-        installedRelease,
-        targetRelease,
-        targetManifest,
-        supportPolicy,
-        packageJson,
-        packageLock,
+        manifest,
+        attestation,
     });
-    const architectureFingerprint = evaluateApplicableArchitectureContracts({
-        root,
-        findings,
-        installedManifest,
-        targetManifest,
-        targetRelease,
-        architecture: options.architecture,
-    });
-    const sourceRoot = join(root, "src");
-    const installedSourceSafety = sourceSafetyRulesetForArchitecture(installedManifest?.contracts.architecture);
-    const targetSourceSafety = sourceSafetyRulesetForArchitecture(targetManifest?.contracts.architecture);
-    if (existsSync(sourceRoot)) {
-        if (installedSourceSafety) {
-            addSourcePatternFindings({
-                root,
-                sourceRoot,
-                findings,
-                patterns: installedSourceSafety.patterns,
-                classification: "maintenance",
-                contract: {
-                    name: "source-safety",
-                    version: installedSourceSafety.id,
-                },
-            });
-            if (!targetSourceSafety &&
-                installedSourceSafety.id !== BRANDLAB_SOURCE_SAFETY_V2_RULESET_ID) {
-                addSourcePatternFindings({
-                    root,
-                    sourceRoot,
-                    findings,
-                    patterns: targetOnlySourceSafetyPatterns(installedSourceSafety, {
-                        id: BRANDLAB_SOURCE_SAFETY_V2_RULESET_ID,
-                        patterns: BRANDLAB_SOURCE_SAFETY_V2_PATTERNS,
-                    }),
-                    classification: "advisory",
-                    contract: {
-                        name: "source-safety",
-                        version: BRANDLAB_SOURCE_SAFETY_V2_RULESET_ID,
-                    },
-                });
-            }
-        }
-        else if (!installedManifest && !targetSourceSafety) {
-            addSourcePatternFindings({
-                root,
-                sourceRoot,
-                findings,
-                patterns: BRANDLAB_SOURCE_SAFETY_V2_PATTERNS,
-                classification: "advisory",
-                contract: {
-                    name: "source-safety",
-                    version: BRANDLAB_SOURCE_SAFETY_V2_RULESET_ID,
-                },
-            });
-        }
-        if (targetSourceSafety &&
-            targetManifest?.releaseVersion !== installedManifest?.releaseVersion) {
-            addSourcePatternFindings({
-                root,
-                sourceRoot,
-                findings,
-                patterns: targetOnlySourceSafetyPatterns(installedSourceSafety, targetSourceSafety),
-                classification: "migration",
-                contract: {
-                    name: "source-safety",
-                    version: targetSourceSafety.id,
-                },
-            });
-        }
-        if (installedManifest?.contracts.seo === SEO_V3_CONTRACT) {
-            addSourcePatternFindings({
-                root,
-                sourceRoot,
-                findings,
-                patterns: BRANDLAB_DEPRECATED_SCHEMA_SOURCE_PATTERNS,
-                classification: "maintenance",
-                contract: { name: "seo", version: SEO_V3_CONTRACT },
-            });
-        }
-        if (targetManifest?.contracts.seo === SEO_V3_CONTRACT &&
-            targetManifest.releaseVersion !== installedManifest?.releaseVersion) {
-            addSourcePatternFindings({
-                root,
-                sourceRoot,
-                findings,
-                patterns: BRANDLAB_DEPRECATED_SCHEMA_SOURCE_PATTERNS,
-                classification: "migration",
-                contract: { name: "seo", version: SEO_V3_CONTRACT },
-            });
-        }
-    }
+    inspectProjectConfig(root, findings);
+    inspectProjectSource(root, findings);
     const sortedFindings = findings.sort(compareFindings);
+    const policyResult = applyBrandlabVerificationPolicy(sortedFindings, options.verificationEvidence);
+    const operationalFindings = policyResult.operationalFindings.sort(compareFindings);
     const authorityDigest = digestBrandlabAuthority({
-        releaseCatalog,
-        supportPolicy,
-        releaseManifests: options.releaseManifests ?? null,
+        release,
+        releaseManifest: options.releaseManifest ?? null,
     });
     const contractDigest = digestBrandlabAuthority({
-        installed: installedManifest?.contracts ?? null,
-        target: targetManifest?.contracts ?? null,
-        evaluator: BRANDLAB_ARCHITECTURE_DISPATCH_RULESET_ID,
-        rulesets: {
-            configurationV2: BRANDLAB_CONFIG_V2_RULESET_ID,
-            configurationV3: BRANDLAB_CONFIG_V3_RULESET_ID,
-            seoV3: BRANDLAB_SCHEMA_HYGIENE_V3_RULESET_ID,
-            installedSourceSafety: installedSourceSafety?.id ?? null,
-            targetSourceSafety: targetSourceSafety?.id ?? null,
-            installedLegacyArchitecture: legacyArchitectureRulesetId(installedManifest?.contracts.architecture),
-            targetLegacyArchitecture: legacyArchitectureRulesetId(targetManifest?.contracts.architecture),
-        },
+        installed: manifest?.contracts ?? null,
+        evaluator: BRANDLAB_CONFORMANCE_EVALUATOR_VERSION,
+        verificationPolicy: BRANDLAB_VERIFICATION_POLICY_VERSION,
     });
     const implementationFingerprint = digestBrandlabAuthority({
         packageJson: packageJson ?? null,
         packageLock: packageLock.fingerprint,
         brandlabConfig: readOptionalText(join(root, "brandlab.config.ts")),
-        architecture: architectureFingerprint,
-        evidence: sortedFindings.map(({ ruleId, classification, severity, path, line }) => ({
+        findings: sortedFindings.map(({ ruleId, severity, path, line }) => ({
             ruleId,
-            classification,
             severity,
             path: path ?? null,
             line: line ?? null,
@@ -203,37 +155,14 @@ export function evaluateBrandlabProject(options) {
         implementationFingerprint,
         mode,
         installedRelease,
-        targetRelease,
-        findings: sortedFindings,
-        maintenance: summarize(sortedFindings, "maintenance"),
-        migration: summarize(sortedFindings, "migration"),
-        advisory: summarize(sortedFindings, "advisory"),
+        findings: operationalFindings,
+        operationalFindings,
+        verification: policyResult.verification,
+        summary: policyResult.verification.summary,
     };
 }
-function addSourcePatternFindings(options) {
-    for (const match of findForbiddenBrandlabPatterns({
-        roots: [options.sourceRoot],
-        patterns: options.patterns,
-    })) {
-        options.findings.push({
-            ruleId: `brandlab-source-${slugify(match.patternName)}`,
-            surface: surfaceForRule(match.patternName),
-            classification: options.classification,
-            severity: options.classification === "advisory" ? "warning" : "blocker",
-            contract: options.contract,
-            evidenceKind: "static",
-            path: normalizePath(relative(options.root, match.file)),
-            line: match.line,
-            expected: `No ${match.patternName} source pattern`,
-            actual: `A prohibited source pattern was detected at line ${match.line}.`,
-            remediation: `Remove the ${match.patternName} implementation and use the supported shared-platform path.`,
-        });
-    }
-}
 export function shouldFailBrandlabConformance(result) {
-    if (result.maintenance.blockers > 0)
-        return true;
-    return result.mode === "preflight" && result.migration.blockers > 0;
+    return result.verification.summary.blockers > 0;
 }
 export function detectInstalledBrandlabRelease(packageJson) {
     if (!packageJson)
@@ -245,759 +174,261 @@ export function detectInstalledBrandlabRelease(packageJson) {
         return null;
     return new Set(versions).size === 1 ? versions[0] : null;
 }
-export function readBrandlabArchitectureConfig(root) {
-    const source = readOptionalText(join(root, "brandlab.config.ts"));
-    if (!source)
-        return null;
-    const architectureSource = extractDelimitedProperty(source, "architecture", "{", "}");
-    if (!architectureSource)
-        return null;
-    const architecture = {};
-    assignString(architecture, "profile", extractStringProperty(architectureSource, "profile"));
-    assignString(architecture, "status", extractStringProperty(architectureSource, "status"));
-    assignString(architecture, "targetProfile", extractStringProperty(architectureSource, "targetProfile"));
-    assignString(architecture, "migrationRationale", extractStringProperty(architectureSource, "migrationRationale"));
-    assignNumber(architecture, "staticRouteFileLimit", extractNumberProperty(architectureSource, "staticRouteFileLimit"));
-    assignNumber(architecture, "largeRouteFileLineLimit", extractNumberProperty(architectureSource, "largeRouteFileLineLimit"));
-    assignNumber(architecture, "routeFileContentCharLimit", extractNumberProperty(architectureSource, "routeFileContentCharLimit"));
-    const routeFamiliesSource = extractDelimitedProperty(architectureSource, "routeFamilies", "[", "]");
-    if (routeFamiliesSource) {
-        architecture.routeFamilies = extractObjectBodies(routeFamiliesSource).map((routeFamily) => ({
-            name: extractStringProperty(routeFamily, "name") ?? undefined,
-            model: extractStringProperty(routeFamily, "model") ?? undefined,
-            route: extractStringProperty(routeFamily, "route") ?? undefined,
-            dataSource: extractStringProperty(routeFamily, "dataSource") ?? undefined,
-        }));
-    }
-    const contentOwnershipSource = extractDelimitedProperty(architectureSource, "contentOwnership", "{", "}");
-    if (contentOwnershipSource) {
-        architecture.contentOwnership = {
-            routeFiles: extractStringProperty(contentOwnershipSource, "routeFiles") ?? undefined,
-            pageData: extractStringProperty(contentOwnershipSource, "pageData") ?? undefined,
-            componentCopy: extractStringProperty(contentOwnershipSource, "componentCopy") ?? undefined,
-        };
-    }
-    const topologySource = extractDelimitedProperty(architectureSource, "topology", "{", "}");
-    if (topologySource) {
-        architecture.topology = {
-            allowedRootDirs: extractStringArray(topologySource, "allowedRootDirs"),
-            allowedComponentDirs: extractStringArray(topologySource, "allowedComponentDirs"),
-            allowedLibDirs: extractStringArray(topologySource, "allowedLibDirs"),
-            allowedTypeFiles: extractStringArray(topologySource, "allowedTypeFiles"),
-            legacyAllowedRootDirs: extractStringArray(topologySource, "legacyAllowedRootDirs"),
-            legacyAllowedComponentDirs: extractStringArray(topologySource, "legacyAllowedComponentDirs"),
-            legacyAllowedLibDirs: extractStringArray(topologySource, "legacyAllowedLibDirs"),
-            legacyAllowedTypeFiles: extractStringArray(topologySource, "legacyAllowedTypeFiles"),
-            targetTopology: extractStringProperty(topologySource, "targetTopology") ?? undefined,
-        };
+function inspectRelease(options) {
+    if (!options.packageJson) {
+        options.findings.push(releaseFinding("brandlab-release-package-json-missing", "A readable package.json", "package.json is missing or invalid.", "Restore a valid package.json."));
+        return;
     }
-    return architecture;
-}
-function addReleaseMaintenanceFindings(options) {
-    const packageJson = options.packageJson;
-    if (!packageJson) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-package-json-missing",
-            severity: "blocker",
-            expected: "A readable project package.json",
-            actual: "package.json is missing or invalid.",
-            remediation: "Restore a valid package.json before evaluating Brandlab conformance.",
-        }));
+    if (!options.installedRelease) {
+        options.findings.push(releaseFinding("brandlab-release-installed-version-unresolved", "All four Brandlab packages pinned to one exact release", "The installed Brandlab release could not be resolved.", "Pin all four packages to one exact supported version."));
         return;
     }
-    const installedRelease = options.installedRelease;
-    if (!installedRelease) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-installed-version-unresolved",
-            severity: "blocker",
-            expected: "Four exact, internally aligned Brandlab package versions",
-            actual: "The installed Brandlab release could not be resolved.",
-            remediation: "Pin all four Brandlab packages to one exact supported release.",
-        }));
+    if (!options.manifest) {
+        options.findings.push(releaseFinding("brandlab-release-unsupported", "The release selected by the active Brandlab channel", `${options.installedRelease} is not supported by the active platform.`, "Upgrade the project to the current candidate before further work."));
         return;
     }
-    if (!options.installedManifest) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-unsupported",
-            severity: "blocker",
-            expected: "An installed release with an embedded runtime contract",
-            actual: `${options.installedRelease} has no runtime release contract.`,
-            remediation: "Use a supported exact release or add and verify its external manifest and runtime projection.",
-        }));
+    if (options.detectedRelease !== options.installedRelease) {
+        options.findings.push(releaseFinding("brandlab-release-declared-installed-mismatch", options.installedRelease, options.detectedRelease ?? "unresolved", "Restore one exact package version across all four Brandlab packages.", "package.json"));
     }
-    if (options.releaseAttestationsRequired &&
-        options.installedManifest &&
-        !options.installedAttestation) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-attestation-missing",
-            severity: "blocker",
-            expected: `Immutable registry attestation for ${installedRelease}`,
-            actual: "The operational release-manifest set does not attest the installed release.",
-            remediation: "Load the installed release manifest referenced by support policy before accepting package provenance.",
-        }));
-    }
-    addInstalledPackageLockFindings({
+    inspectBrandlabPackages({
         findings: options.findings,
-        packageJson,
+        packageJson: options.packageJson,
         packageLock: options.packageLock,
-        installedRelease,
-        installedAttestation: options.installedAttestation,
-    });
-    const versionIssues = evaluateSharedPackageVersionSpecs({
-        packageJson,
-        expectedVersion: installedRelease,
-        packageNames: BRANDLAB_SHARED_PACKAGE_NAMES,
-    });
-    for (const issue of versionIssues) {
-        options.findings.push(releaseFinding({
-            ruleId: `brandlab-release-package-${issue.issue}`,
-            severity: "blocker",
-            expected: `${issue.packageName}@${installedRelease}`,
-            actual: `${issue.packageName} is ${issue.installedVersion ?? "missing"}.`,
-            remediation: "Restore exact lockstep package pins; do not use ranges, tags or mixed releases.",
-            path: "package.json",
-        }));
-    }
-    if (options.detectedRelease && options.detectedRelease !== installedRelease) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-declared-installed-mismatch",
-            severity: "blocker",
-            expected: `Detected package release ${installedRelease}`,
-            actual: `package.json resolves to ${options.detectedRelease}.`,
-            remediation: "Use the detected exact release or correct all four package pins.",
-            path: "package.json",
-        }));
-    }
-    const lifecycle = options.supportPolicy.releases[installedRelease]?.lifecycle;
-    if (options.installedManifest && !lifecycle) {
-        options.findings.push(releaseFinding({
-            ruleId: "brandlab-release-not-operationally-supported",
-            severity: "blocker",
-            expected: "An installed release listed in mutable support policy",
-            actual: `${installedRelease} has a runtime contract but is not approved for operational use.`,
-            remediation: "Use the current supported release or supply the synthetic candidate policy only inside packed release fixtures.",
-        }));
-    }
-    if (lifecycle === "security-blocked" || lifecycle === "retired") {
-        options.findings.push(releaseFinding({
-            ruleId: `brandlab-release-${lifecycle}`,
-            severity: "blocker",
-            expected: "A current or tolerated installed release",
-            actual: `${installedRelease} is ${lifecycle}.`,
-            remediation: "Prepare an owner-approved migration to a supported release.",
-        }));
-    }
-    if (options.installedManifest) {
-        addInstalledRuntimeFindings({
-            findings: options.findings,
-            packageJson,
-            packageLock: options.packageLock,
-            manifest: options.installedManifest,
-        });
-    }
-}
-function addMigrationFindings(options) {
-    if (!options.targetRelease) {
-        if (options.installedRelease &&
-            options.installedRelease !== options.supportPolicy.currentReleaseVersion) {
-            options.findings.push({
-                ...releaseFinding({
-                    ruleId: "brandlab-release-upgrade-available",
-                    severity: "info",
-                    expected: "No migration is active until a target release is approved.",
-                    actual: `${options.supportPolicy.currentReleaseVersion} is current; ${options.installedRelease} remains installed.`,
-                    remediation: "Keep monitoring the tolerated exact pin or select a separately approved target release.",
-                }),
-                classification: "advisory",
-            });
-        }
-        return;
-    }
-    if (!options.targetManifest) {
-        options.findings.push({
-            ...releaseFinding({
-                ruleId: "brandlab-migration-target-unsupported",
-                severity: "blocker",
-                expected: "A target release with an embedded runtime contract",
-                actual: `${options.targetRelease} has no runtime release contract.`,
-                remediation: "Select a manifest-backed runtime contract before preparing migration work.",
-            }),
-            classification: "migration",
-        });
-        return;
-    }
-    const targetLifecycle = options.supportPolicy.releases[options.targetRelease]?.lifecycle;
-    if (!targetLifecycle) {
-        options.findings.push({
-            ...releaseFinding({
-                ruleId: "brandlab-migration-target-not-approved",
-                severity: "blocker",
-                expected: "A target release explicitly approved in mutable support policy",
-                actual: `${options.targetRelease} has a runtime contract but no approved support-policy lifecycle.`,
-                remediation: "Keep the installed release unchanged until the candidate release and project migration are separately approved.",
-            }),
-            classification: "migration",
-        });
-    }
-    if (targetLifecycle === "security-blocked" || targetLifecycle === "retired") {
-        options.findings.push({
-            ...releaseFinding({
-                ruleId: `brandlab-migration-target-${targetLifecycle}`,
-                severity: "blocker",
-                expected: "A current or tolerated target release",
-                actual: `${options.targetRelease} is ${targetLifecycle}.`,
-                remediation: "Select a current or tolerated target release.",
-            }),
-            classification: "migration",
-        });
-        return;
-    }
-    if (!options.installedRelease || options.installedRelease === options.targetRelease)
-        return;
-    const comparison = compareBrandlabSemver(options.targetRelease, options.installedRelease);
-    options.findings.push({
-        ...releaseFinding({
-            ruleId: comparison < 0
-                ? "brandlab-migration-downgrade-review"
-                : "brandlab-migration-target-selected",
-            severity: comparison < 0 ? "blocker" : "info",
-            expected: comparison < 0
-                ? "A separately documented rollback decision"
-                : "Target-release migration evidence",
-            actual: `${options.installedRelease} -> ${options.targetRelease}`,
-            remediation: comparison < 0
-                ? "Use the immutable rollback manifest and record explicit owner approval."
-                : "Address migration findings and preserve the installed release until target proof passes.",
-        }),
-        classification: "migration",
+        installedRelease: options.installedRelease,
+        attestation: options.attestation,
     });
-    addTargetRuntimeFindings({
+    inspectRuntime({
         findings: options.findings,
         packageJson: options.packageJson,
         packageLock: options.packageLock,
-        targetManifest: options.targetManifest,
+        manifest: options.manifest,
     });
 }
-function addInstalledPackageLockFindings(options) {
-    const { packageLock } = options;
-    if (packageLock.state !== "valid") {
-        const detail = packageLock.state === "missing"
-            ? "package-lock.json is missing."
-            : packageLock.state === "unsupported"
-                ? `package-lock.json uses unsupported lockfileVersion ${String(packageLock.lockfileVersion)}.`
-                : "package-lock.json is invalid or has no npm root package entry.";
-        options.findings.push(releaseFinding({
-            ruleId: `brandlab-release-package-lock-${packageLock.state}`,
-            severity: "blocker",
-            expected: "A valid npm package-lock.json (lockfile v2 or v3) with root and resolved package evidence",
-            actual: detail,
-            remediation: "Regenerate the npm lockfile from the exact supported package declarations and review the resulting diff.",
-            path: "package-lock.json",
-        }));
+function inspectBrandlabPackages(options) {
+    if (options.packageLock.state !== "valid") {
+        options.findings.push(releaseFinding(`brandlab-release-package-lock-${options.packageLock.state}`, "A valid npm lockfile v2 or v3", `package-lock.json state is ${options.packageLock.state}.`, "Regenerate the lockfile from the exact package declarations.", "package-lock.json"));
         return;
     }
     for (const packageName of BRANDLAB_SHARED_PACKAGE_NAMES) {
         const declared = declaredPackageSpec(options.packageJson, packageName);
-        const lockedSpec = lockedRootSpec(packageLock, packageName);
-        const resolvedPackage = packageLock.resolvedPackages.get(packageName);
-        if (options.packageJson.dependencies?.[packageName] !== undefined &&
-            options.packageJson.devDependencies?.[packageName] !== undefined) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-package-duplicate-declaration",
-                severity: "blocker",
-                expected: `${packageName} declared exactly once`,
-                actual: `${packageName} appears in both dependencies and devDependencies.`,
-                remediation: "Keep each Brandlab package in one appropriate dependency section.",
-                path: "package.json",
-            }));
-        }
-        if (packageLock.rootDependencies[packageName] !== undefined &&
-            packageLock.rootDevDependencies[packageName] !== undefined) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-lock-duplicate-declaration",
-                severity: "blocker",
-                expected: `${packageName} recorded once in the lockfile root`,
-                actual: `${packageName} appears in both root dependency sections.`,
-                remediation: "Regenerate the lockfile from the single package.json declaration.",
-                path: "package-lock.json",
-            }));
-        }
-        if (lockedSpec !== options.installedRelease || lockedSpec !== declared) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-lock-root-spec-mismatch",
-                severity: "blocker",
-                expected: `${packageName}@${options.installedRelease} in package.json and the lockfile root`,
-                actual: `package.json=${declared ?? "missing"}; lockfile=${lockedSpec ?? "missing"}.`,
-                remediation: "Reinstall from the exact lockstep package declarations so root lock specifications match package.json.",
-                path: "package-lock.json",
-            }));
-        }
-        if (!resolvedPackage ||
-            resolvedPackage.version !== options.installedRelease ||
-            resolvedPackage.linked ||
-            !resolvedPackage.resolved ||
-            !resolvedPackage.integrity) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-lock-resolution-mismatch",
-                severity: "blocker",
-                expected: `${packageName} resolved to immutable ${options.installedRelease}`,
-                actual: !resolvedPackage
-                    ? "No resolved node_modules package entry exists."
-                    : `version=${resolvedPackage.version ?? "missing"}; linked=${String(resolvedPackage.linked)}; resolved=${resolvedPackage.resolved ? "present" : "missing"}; integrity=${resolvedPackage.integrity ? "present" : "missing"}.`,
-                remediation: "Produce a clean lockfile with a non-workspace resolved package, source and integrity at the declared exact release.",
-                path: "package-lock.json",
-            }));
+        const locked = lockedRootSpec(options.packageLock, packageName);
+        const resolved = options.packageLock.resolvedPackages.get(packageName);
+        const duplicate = options.packageJson.dependencies?.[packageName] !== undefined &&
+            options.packageJson.devDependencies?.[packageName] !== undefined;
+        if (duplicate || declared !== options.installedRelease || locked !== declared) {
+            options.findings.push(releaseFinding("brandlab-release-package-pin-mismatch", `${packageName}@${options.installedRelease} declared once and locked exactly`, `package.json=${declared ?? "missing"}; lockfile=${locked ?? "missing"}; duplicate=${String(duplicate)}.`, "Restore exact lockstep package declarations and regenerate the lockfile.", "package.json"));
         }
-        const registryAttestation = options.installedAttestation?.packages[packageName].registry ?? null;
-        const expectedIntegrity = registryAttestation?.integrity ?? null;
-        if (registryAttestation &&
-            (registryAttestation.state !== "verified" || !expectedIntegrity)) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-registry-attestation-unverified",
-                severity: "blocker",
-                expected: `${packageName} with verified immutable npm registry integrity`,
-                actual: `The ${options.installedRelease} release manifest does not contain verified registry integrity for ${packageName}.`,
-                remediation: "Do not adopt this release until publication evidence is finalized and independently verified.",
-            }));
+        if (!resolved ||
+            resolved.version !== options.installedRelease ||
+            resolved.linked ||
+            !resolved.integrity ||
+            !resolved.resolved ||
+            !isApprovedRegistryResolution(resolved.resolved, packageName, options.installedRelease)) {
+            options.findings.push(releaseFinding("brandlab-release-package-resolution-mismatch", `${packageName}@${options.installedRelease} from the canonical npm registry`, !resolved
+                ? "The resolved lockfile package is missing."
+                : `version=${resolved.version ?? "missing"}; linked=${String(resolved.linked)}; integrity=${resolved.integrity ? "present" : "missing"}.`, "Run a clean npm install from the exact published release.", "package-lock.json"));
         }
-        if (expectedIntegrity && resolvedPackage?.integrity !== expectedIntegrity) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-lock-integrity-mismatch",
-                severity: "blocker",
-                expected: `${packageName} lock integrity matching the immutable release manifest`,
-                actual: resolvedPackage?.integrity
-                    ? "The lock integrity differs from verified registry evidence."
-                    : "The lock integrity is missing.",
-                remediation: "Recreate the lock from the verified registry release and investigate unexpected package content.",
-                path: "package-lock.json",
-            }));
+        const expectedIntegrity = options.attestation?.packages[packageName].registry.integrity ?? null;
+        if (expectedIntegrity && resolved?.integrity !== expectedIntegrity) {
+            options.findings.push(releaseFinding("brandlab-release-package-integrity-mismatch", `${packageName} integrity matching the immutable manifest`, "The lockfile integrity differs from the release attestation.", "Regenerate the lockfile from the verified registry package.", "package-lock.json"));
         }
-        if (options.installedAttestation &&
-            (!resolvedPackage?.resolved ||
-                !isApprovedBrandlabRegistryResolution(resolvedPackage.resolved, packageName, options.installedRelease))) {
-            options.findings.push(releaseFinding({
-                ruleId: "brandlab-release-lock-registry-source-mismatch",
-                severity: "blocker",
-                expected: `${packageName}@${options.installedRelease} from the canonical HTTPS npm registry artifact`,
-                actual: resolvedPackage?.resolved
-                    ? "The lockfile resolution does not use the approved registry.npmjs.org package artifact."
-                    : "The lockfile resolution source is missing.",
-                remediation: "Regenerate the lockfile with the canonical npm registry and the immutable manifest integrity; do not accept file, Git or alternate-registry resolutions.",
-                path: "package-lock.json",
-            }));
-        }
-    }
-}
-function isApprovedBrandlabRegistryResolution(resolved, packageName, version) {
-    try {
-        const url = new URL(resolved);
-        const artifactName = packageName.split("/").at(-1);
-        if (!artifactName)
-            return false;
-        return url.protocol === "https:" &&
-            url.hostname === "registry.npmjs.org" &&
-            url.port === "" &&
-            url.username === "" &&
-            url.password === "" &&
-            url.search === "" &&
-            url.hash === "" &&
-            url.pathname === `/${packageName}/-/${artifactName}-${version}.tgz`;
-    }
-    catch {
-        return false;
     }
 }
-function addInstalledRuntimeFindings(options) {
+function inspectRuntime(options) {
     for (const [packageName, runtimeField] of RUNTIME_PACKAGE_FIELDS) {
         const expected = options.manifest.runtime[runtimeField];
         const declared = declaredPackageSpec(options.packageJson, packageName);
-        if (declared !== expected) {
-            options.findings.push(runtimeFinding({
-                ruleId: `brandlab-runtime-${slugify(packageName)}-declaration`,
-                expected: `${packageName}@${expected} declared exactly`,
-                actual: `${packageName} is ${declared ?? "missing"}.`,
-                remediation: `Use the ${options.manifest.releaseVersion} embedded runtime contract.`,
-                path: "package.json",
-            }));
-        }
-        if (options.packageLock.state !== "valid")
-            continue;
-        const lockedSpec = lockedRootSpec(options.packageLock, packageName);
+        const locked = lockedRootSpec(options.packageLock, packageName);
         const resolved = options.packageLock.resolvedPackages.get(packageName);
-        if (lockedSpec !== expected || lockedSpec !== declared) {
-            options.findings.push(runtimeFinding({
-                ruleId: `brandlab-runtime-${slugify(packageName)}-lock-spec`,
-                expected: `${packageName}@${expected} in the lockfile root`,
-                actual: `package.json=${declared ?? "missing"}; lockfile=${lockedSpec ?? "missing"}.`,
-                remediation: "Regenerate package-lock.json from the exact runtime declaration.",
-                path: "package-lock.json",
-            }));
-        }
-        if (!resolved || resolved.version !== expected || resolved.linked) {
-            options.findings.push(runtimeFinding({
-                ruleId: `brandlab-runtime-${slugify(packageName)}-resolution`,
-                expected: `${packageName} resolved to ${expected}`,
-                actual: !resolved
-                    ? "No resolved node_modules package entry exists."
-                    : `version=${resolved.version ?? "missing"}; linked=${String(resolved.linked)}.`,
-                remediation: "Reinstall the immutable runtime baseline and preserve the reviewed lockfile.",
-                path: "package-lock.json",
-            }));
+        if (!runtimeVersionSatisfiesRelease(packageName, declared, expected) ||
+            locked !== declared ||
+            resolved?.version !== declared ||
+            resolved.linked) {
+            options.findings.push(runtimeFinding(`brandlab-runtime-${slugify(packageName)}`, runtimeExpectation(packageName, expected), `package.json=${declared ?? "missing"}; lockfile=${locked ?? "missing"}; resolved=${resolved?.version ?? "missing"}.`, `Use the supported ${options.manifest.releaseVersion} runtime or a newer exact security patch in the same framework line.`, "package.json"));
         }
     }
-    const nodeEngine = options.packageJson.engines?.node ?? null;
-    if (nodeEngine !== options.manifest.runtime.node) {
-        options.findings.push(runtimeFinding({
-            ruleId: "brandlab-runtime-node-declaration",
-            expected: `engines.node=${options.manifest.runtime.node}`,
-            actual: `engines.node=${nodeEngine ?? "missing"}.`,
-            remediation: "Restore the installed release's Node engine declaration.",
-            path: "package.json",
-        }));
-    }
-    if (options.packageLock.state === "valid" &&
-        options.packageLock.rootEngines.node !== options.manifest.runtime.node) {
-        options.findings.push(runtimeFinding({
-            ruleId: "brandlab-runtime-node-lock-spec",
-            expected: `lockfile root engines.node=${options.manifest.runtime.node}`,
-            actual: `lockfile root engines.node=${options.packageLock.rootEngines.node ?? "missing"}.`,
-            remediation: "Regenerate package-lock.json after restoring the supported Node engine.",
-            path: "package-lock.json",
-        }));
+    const node = options.packageJson.engines?.node ?? null;
+    const lockNode = options.packageLock.rootEngines.node ?? null;
+    if (node !== options.manifest.runtime.node || lockNode !== node) {
+        options.findings.push(runtimeFinding("brandlab-runtime-node", `engines.node=${options.manifest.runtime.node}`, `package.json=${node ?? "missing"}; lockfile=${lockNode ?? "missing"}.`, "Restore the supported Node engine and regenerate the lockfile.", "package.json"));
     }
     if (options.packageJson.packageManager !== options.manifest.runtime.packageManager) {
-        options.findings.push(runtimeFinding({
-            ruleId: "brandlab-runtime-package-manager",
-            expected: `packageManager=${options.manifest.runtime.packageManager}`,
-            actual: `packageManager=${options.packageJson.packageManager ?? "missing"}.`,
-            remediation: "Restore the installed release's exact npm package-manager declaration.",
-            path: "package.json",
-        }));
+        options.findings.push(runtimeFinding("brandlab-runtime-package-manager", options.manifest.runtime.packageManager, options.packageJson.packageManager ?? "missing", "Use the package manager declared by the current release.", "package.json"));
     }
-}
-function addTargetRuntimeFindings(options) {
-    if (!options.packageJson)
-        return;
-    const packageMismatches = [];
-    for (const packageName of BRANDLAB_SHARED_PACKAGE_NAMES) {
-        const declared = declaredPackageSpec(options.packageJson, packageName);
-        const locked = lockedRootSpec(options.packageLock, packageName);
-        const resolved = options.packageLock.resolvedPackages.get(packageName)?.version ?? null;
-        if (declared !== options.targetManifest.releaseVersion ||
-            locked !== options.targetManifest.releaseVersion ||
-            resolved !== options.targetManifest.releaseVersion) {
-            packageMismatches.push(`${packageName}(declared=${declared ?? "missing"},locked=${locked ?? "missing"},resolved=${resolved ?? "missing"})`);
+    const expectedSharp = options.manifest.runtime.sharp;
+    if (expectedSharp) {
+        const override = options.packageJson.overrides?.sharp ?? null;
+        if (override !== expectedSharp ||
+            options.packageLock.sharpResolutions.length !== 1 ||
+            options.packageLock.sharpResolutions[0]?.version !== expectedSharp) {
+            options.findings.push(runtimeFinding("brandlab-runtime-sharp", `one sharp@${expectedSharp} resolution`, `override=${override ?? "missing"}; resolutions=${options.packageLock.sharpResolutions.map((entry) => `${entry.path}=${entry.version}`).join(", ") || "none"}.`, "Restore the release-owned Sharp override and regenerate the lockfile.", "package-lock.json"));
         }
     }
-    if (packageMismatches.length > 0) {
-        options.findings.push(migrationRuntimeFinding({
-            ruleId: "brandlab-migration-package-provenance",
-            expected: `All four packages declared and locked at ${options.targetManifest.releaseVersion}`,
-            actual: packageMismatches.join("; "),
-            remediation: "Apply the target exact pins in an approved migration branch and regenerate the reviewed lockfile.",
+}
+function inspectProjectConfig(root, findings) {
+    const configPath = join(root, "brandlab.config.ts");
+    const source = readOptionalText(configPath);
+    if (!source) {
+        findings.push(staticFinding({
+            ruleId: "brandlab-config-missing",
+            surface: "routes",
+            path: "brandlab.config.ts",
+            expected: "One small typed Brandlab project configuration",
+            actual: "brandlab.config.ts is missing.",
+            remediation: "Add project identity, route families and enabled capabilities.",
         }));
+        return;
     }
-    const runtimeMismatches = [];
-    for (const [packageName, runtimeField] of RUNTIME_PACKAGE_FIELDS) {
-        const expected = options.targetManifest.runtime[runtimeField];
-        const declared = declaredPackageSpec(options.packageJson, packageName);
-        const locked = lockedRootSpec(options.packageLock, packageName);
-        const resolved = options.packageLock.resolvedPackages.get(packageName)?.version ?? null;
-        if (declared !== expected || locked !== expected || resolved !== expected) {
-            runtimeMismatches.push(`${packageName}(expected=${expected},declared=${declared ?? "missing"},locked=${locked ?? "missing"},resolved=${resolved ?? "missing"})`);
-        }
-    }
-    if (options.packageJson.engines?.node !== options.targetManifest.runtime.node) {
-        runtimeMismatches.push(`node(expected=${options.targetManifest.runtime.node},actual=${options.packageJson.engines?.node ?? "missing"})`);
-    }
-    if (options.packageJson.packageManager !== options.targetManifest.runtime.packageManager) {
-        runtimeMismatches.push(`packageManager(expected=${options.targetManifest.runtime.packageManager},actual=${options.packageJson.packageManager ?? "missing"})`);
-    }
-    if (runtimeMismatches.length > 0) {
-        options.findings.push(migrationRuntimeFinding({
-            ruleId: "brandlab-migration-runtime-baseline",
-            expected: `The ${options.targetManifest.releaseVersion} immutable runtime baseline`,
-            actual: runtimeMismatches.join("; "),
-            remediation: "Apply and lock the target runtime only inside the separately approved migration.",
+    if (!/\bdefineBrandlabProject\s*\(\s*\{/.test(source) ||
+        !/\bprojectId\s*:\s*['"][a-z0-9][a-z0-9-]*['"]/.test(source) ||
+        !/\bprofile\s*:\s*['"]next-(?:local-service|root-level)['"]/.test(source)) {
+        findings.push(staticFinding({
+            ruleId: "brandlab-config-invalid",
+            surface: "routes",
+            path: "brandlab.config.ts",
+            expected: "A literal defineBrandlabProject configuration with projectId and profile",
+            actual: "The minimum project identity contract could not be verified.",
+            remediation: "Keep the configuration literal and limited to project variation.",
         }));
     }
-}
-function runtimeFinding(options) {
-    return {
-        ruleId: options.ruleId,
-        surface: "runtime",
-        classification: "maintenance",
-        severity: "blocker",
-        contract: { name: "runtime", version: "installed-runtime-contract" },
-        evidenceKind: "static",
-        path: options.path,
-        expected: options.expected,
-        actual: options.actual,
-        remediation: options.remediation,
-    };
-}
-function migrationRuntimeFinding(options) {
-    return {
-        ruleId: options.ruleId,
-        surface: "runtime",
-        classification: "migration",
-        severity: "blocker",
-        contract: { name: "runtime", version: "target-runtime-contract" },
-        evidenceKind: "static",
-        path: "package-lock.json",
-        expected: options.expected,
-        actual: options.actual,
-        remediation: options.remediation,
-    };
-}
-function evaluateApplicableArchitectureContracts(options) {
-    const installedConfiguration = options.installedManifest?.contracts.configuration ?? null;
-    const targetConfiguration = options.targetManifest?.contracts.configuration ?? null;
-    const hasDistinctTarget = Boolean(options.targetRelease &&
-        options.targetRelease !== options.installedManifest?.releaseVersion);
-    let configV2Inspection = null;
-    const inspectConfigV2 = () => {
-        configV2Inspection ??= inspectImmutableBrandlabConfigV2(options.root);
-        return configV2Inspection;
-    };
-    let configV3Inspection = null;
-    const inspectConfigV3 = () => {
-        configV3Inspection ??= inspectBrandlabConfigV3(options.root);
-        return configV3Inspection;
-    };
-    const legacyInspections = new Map();
-    let legacyArchitectureInput;
-    let legacyArchitectureInputResolved = false;
-    const inspectLegacy = (contract) => {
-        const cached = legacyInspections.get(contract);
-        if (cached)
-            return cached;
-        if (!legacyArchitectureInputResolved) {
-            legacyArchitectureInput = options.architecture === undefined
-                ? readBrandlabArchitectureConfig(options.root)
-                : options.architecture;
-            legacyArchitectureInputResolved = true;
-        }
-        const inspection = inspectLegacyArchitectureContract({
-            root: options.root,
-            architecture: legacyArchitectureInput,
-            contract,
-        });
-        legacyInspections.set(contract, inspection);
-        return inspection;
-    };
-    if (installedConfiguration === CONFIGURATION_V2_CONTRACT) {
-        const inspection = inspectConfigV2();
-        for (const issue of inspection.issues) {
-            options.findings.push(mapConfigIssue(issue, "maintenance", options.installedManifest?.contracts));
+    const envSource = readOptionalText(join(root, ".env.example")) ?? "";
+    if (/\bcontact\s*:\s*\{/.test(source)) {
+        requireEnvKey(findings, envSource, "RESEND_API_KEY", "contact");
+        requireEnvKey(findings, envSource, "CONTACT_EMAIL", "contact");
+    }
+    if (/\breviews\s*:\s*\{[\s\S]*?\bprovider\s*:\s*['"]google-places['"]/.test(source)) {
+        requireEnvKey(findings, envSource, "GOOGLE_MAPS_PLATFORM_API_KEY", "reviews");
+    }
+    for (const retired of ["CONTACT_CONTEXT_SECRET", "KV_REST_API_URL", "KV_REST_API_TOKEN"]) {
+        if (new RegExp(`^${retired}=`, "m").test(envSource)) {
+            findings.push(staticFinding({
+                ruleId: "brandlab-environment-retired-contact-state",
+                surface: "environment",
+                path: ".env.example",
+                expected: "Only current contact environment variables",
+                actual: `${retired} is still documented.`,
+                remediation: `Remove ${retired}; it is not part of the simplified contact standard.`,
+            }));
         }
     }
-    else if (installedConfiguration === CONFIGURATION_V3_CONTRACT) {
-        const inspection = inspectConfigV3();
-        for (const issue of inspection.issues) {
-            options.findings.push(mapConfigIssue(issue, "maintenance", options.installedManifest?.contracts));
+}
+function requireEnvKey(findings, envSource, key, capability) {
+    if (new RegExp(`^${key}=`, "m").test(envSource))
+        return;
+    findings.push(staticFinding({
+        ruleId: `brandlab-environment-${capability}-${slugify(key)}`,
+        surface: "environment",
+        path: ".env.example",
+        expected: `${key} documented for the enabled ${capability} capability`,
+        actual: `${key} is missing from .env.example.`,
+        remediation: `Document the non-secret ${key} variable name without adding a credential value.`,
+    }));
+}
+function inspectProjectSource(root, findings) {
+    const sourceRoot = join(root, "src");
+    if (!existsSync(sourceRoot))
+        return;
+    for (const file of sourceFiles(sourceRoot)) {
+        const source = readFileSync(file, "utf8");
+        const executableSource = stripCommentsPreservingLayout(source);
+        for (const rule of SOURCE_RULES) {
+            const match = executableSource.match(rule.pattern);
+            if (!match || match.index === undefined)
+                continue;
+            findings.push(staticFinding({
+                ruleId: rule.ruleId,
+                surface: rule.surface,
+                path: normalizePath(relative(root, file)),
+                line: lineAt(source, match.index),
+                expected: rule.expected,
+                actual: "A project-owned implementation was detected.",
+                remediation: rule.remediation,
+            }));
         }
     }
-    else if (installedConfiguration === LEGACY_CONFIGURATION_CONTRACT) {
-        const installedArchitecture = options.installedManifest?.contracts.architecture ?? null;
-        if (installedArchitecture === "architecture-v1" || installedArchitecture === "architecture-v2") {
-            const installedInspection = inspectLegacy(installedArchitecture);
-            for (const issue of installedInspection.issues) {
-                options.findings.push(mapArchitectureIssue(issue, "maintenance", {
-                    contractVersion: installedArchitecture,
-                }));
+}
+function stripCommentsPreservingLayout(source) {
+    const output = [...source];
+    let state = "code";
+    let escaped = false;
+    for (let index = 0; index < output.length; index += 1) {
+        const current = output[index];
+        const next = output[index + 1];
+        if (state === "line") {
+            if (current === "\n" || current === "\r") {
+                state = "code";
             }
-            if (installedArchitecture === "architecture-v1" &&
-                !(hasDistinctTarget &&
-                    options.targetManifest?.contracts.architecture === "architecture-v2")) {
-                const v2Inspection = inspectLegacy("architecture-v2");
-                for (const issue of targetOnlyLegacyArchitectureIssues(installedInspection, v2Inspection)) {
-                    options.findings.push(mapArchitectureIssue(issue, "advisory", {
-                        contractVersion: "architecture-v2",
-                    }));
-                }
+            else {
+                output[index] = " ";
             }
+            continue;
         }
-    }
-    else if (!options.installedManifest) {
-        // Unsupported or unadopted projects still benefit from architecture
-        // diagnosis, but no current evaluator may retroactively become their
-        // installed maintenance contract. Keep this lane advisory until a
-        // supported target release is explicitly selected.
-        const configSource = readOptionalText(join(options.root, "brandlab.config.ts"));
-        if (/\bdefineBrandlabProject\s*\(/.test(configSource ?? "")) {
-            for (const issue of inspectConfigV3().issues) {
-                options.findings.push(mapConfigIssue(issue, "advisory", {
-                    configuration: CONFIGURATION_V3_CONTRACT,
-                }));
+        if (state === "block") {
+            if (current === "*" && next === "/") {
+                output[index] = " ";
+                output[index + 1] = " ";
+                index += 1;
+                state = "code";
+            }
+            else if (current !== "\n" && current !== "\r") {
+                output[index] = " ";
             }
+            continue;
         }
-        else {
-            for (const issue of inspectLegacy("architecture-v2").issues) {
-                options.findings.push(mapArchitectureIssue(issue, "advisory", {
-                    contractVersion: "architecture-v2",
-                }));
+        if (state !== "code") {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (current === "\\") {
+                escaped = true;
             }
+            else if ((state === "single" && current === "'") ||
+                (state === "double" && current === '"') ||
+                (state === "template" && current === "`")) {
+                state = "code";
+            }
+            continue;
         }
-    }
-    if (hasDistinctTarget && targetConfiguration === CONFIGURATION_V2_CONTRACT) {
-        for (const issue of inspectConfigV2().issues) {
-            options.findings.push(mapConfigIssue(issue, "migration", options.targetManifest?.contracts));
+        if (current === "'") {
+            state = "single";
         }
-    }
-    else if (hasDistinctTarget && targetConfiguration === CONFIGURATION_V3_CONTRACT) {
-        for (const issue of inspectConfigV3().issues) {
-            options.findings.push(mapConfigIssue(issue, "migration", options.targetManifest?.contracts));
+        else if (current === '"') {
+            state = "double";
         }
-    }
-    else if (hasDistinctTarget && targetConfiguration === LEGACY_CONFIGURATION_CONTRACT) {
-        const targetArchitecture = options.targetManifest?.contracts.architecture ?? null;
-        if (targetArchitecture === "architecture-v1" || targetArchitecture === "architecture-v2") {
-            const installedArchitecture = options.installedManifest?.contracts.architecture ?? null;
-            const installedInspection = installedConfiguration === LEGACY_CONFIGURATION_CONTRACT &&
-                (installedArchitecture === "architecture-v1" || installedArchitecture === "architecture-v2")
-                ? inspectLegacy(installedArchitecture)
-                : null;
-            const targetInspection = inspectLegacy(targetArchitecture);
-            for (const issue of targetOnlyLegacyArchitectureIssues(installedInspection, targetInspection)) {
-                options.findings.push(mapArchitectureIssue(issue, "migration", {
-                    contractVersion: targetArchitecture,
-                }));
-            }
+        else if (current === "`") {
+            state = "template";
+        }
+        else if (current === "/" && next === "/") {
+            output[index] = " ";
+            output[index + 1] = " ";
+            index += 1;
+            state = "line";
+        }
+        else if (current === "/" && next === "*") {
+            output[index] = " ";
+            output[index + 1] = " ";
+            index += 1;
+            state = "block";
         }
     }
-    const inspectedConfigV2 = configV2Inspection;
-    const inspectedConfigV3 = configV3Inspection;
-    return {
-        evaluator: BRANDLAB_ARCHITECTURE_DISPATCH_RULESET_ID,
-        installedContract: options.installedManifest?.contracts.architecture ?? null,
-        targetContract: options.targetManifest?.contracts.architecture ?? null,
-        legacy: Object.fromEntries([...legacyInspections.entries()]
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([contract, inspection]) => [
-            contract,
-            {
-                rulesetId: inspection.rulesetId,
-                profile: inspection.report.profile,
-                status: inspection.report.status,
-                pages: inspection.report.pageFileCount,
-                applicableRuleIds: inspection.issues.map((issue) => issue.code).sort(),
-            },
-        ])),
-        configV2: inspectedConfigV2
-            ? {
-                projectId: inspectedConfigV2.config?.projectId ?? null,
-                profile: inspectedConfigV2.config?.profile ?? null,
-                imports: [...inspectedConfigV2.imports].sort(),
-                executableImports: [...inspectedConfigV2.executableImports].sort(),
-            }
-            : null,
-        configV3: inspectedConfigV3
-            ? {
-                projectId: inspectedConfigV3.config?.projectId ?? null,
-                profile: inspectedConfigV3.config?.profile ?? null,
-                imports: [...inspectedConfigV3.imports].sort(),
-                executableImports: [...inspectedConfigV3.executableImports].sort(),
-                outputOwnedImports: [...inspectedConfigV3.outputOwnedImports].sort(),
-                executableExports: Object.fromEntries([...inspectedConfigV3.executableExports.entries()]
-                    .sort(([left], [right]) => left.localeCompare(right))
-                    .map(([moduleName, exports]) => [moduleName, [...exports].sort()])),
-                outputOwnedExports: Object.fromEntries([...inspectedConfigV3.outputOwnedExports.entries()]
-                    .sort(([left], [right]) => left.localeCompare(right))
-                    .map(([moduleName, exports]) => [moduleName, [...exports].sort()])),
-            }
-            : null,
-    };
-}
-function mapArchitectureIssue(issue, classification, options) {
-    const rawSeverity = issue.severity === "error"
-        ? "blocker"
-        : issue.severity === "warning"
-            ? "warning"
-            : "info";
-    const severity = classification === "advisory" && rawSeverity === "blocker"
-        ? "warning"
-        : rawSeverity;
-    return {
-        ruleId: issue.code,
-        surface: surfaceForRule(issue.code),
-        classification,
-        severity,
-        contract: {
-            name: "architecture",
-            version: options.contractVersion ?? LEGACY_ARCHITECTURE_EVALUATOR_CONTRACT,
-        },
-        evidenceKind: "static",
-        path: issue.path,
-        expected: issue.fix ?? "The project matches its applicable Brandlab architecture contract.",
-        actual: issue.detail,
-        remediation: issue.fix ?? "Apply the supported shared-platform implementation for this rule.",
-    };
+    return output.join("");
 }
-function mapConfigIssue(issue, classification, contracts) {
-    const severity = classification === "advisory" && issue.severity === "blocker"
-        ? "warning"
-        : issue.severity;
-    const contractName = contractNameForConfigSurface(issue.surface);
-    const contractVersion = contracts?.[contractName] ??
-        contracts?.configuration ??
-        CONFIGURATION_V3_CONTRACT;
-    return {
-        ruleId: issue.ruleId,
-        surface: issue.surface,
-        classification,
-        severity,
-        contract: {
-            name: contractName,
-            version: contractVersion,
-        },
-        evidenceKind: issue.evidenceKind,
-        path: issue.path,
-        line: issue.line,
-        expected: issue.expected,
-        actual: issue.actual,
-        remediation: issue.remediation,
-    };
-}
-function contractNameForConfigSurface(surface) {
-    if (/contact|email|delivery|attachment/.test(surface))
-        return "contact";
-    if (/analytics/.test(surface))
-        return "analytics";
-    if (/metadata|schema|breadcrumb|sitemap|robots|location|review|google-places/.test(surface)) {
-        return "seo";
-    }
-    if (/platform-contract|business|routes|headers|accessibility|blog|architecture/.test(surface)) {
-        return "architecture";
+function sourceFiles(root) {
+    const files = [];
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (entry.name.startsWith(".") || entry.name === "node_modules")
+            continue;
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...sourceFiles(path));
+            continue;
+        }
+        if (SOURCE_EXTENSIONS.has(extension(entry.name)) &&
+            !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
+            files.push(path);
+        }
     }
-    return "configuration";
-}
-function releaseFinding(options) {
-    return {
-        ruleId: options.ruleId,
-        surface: "release",
-        classification: "maintenance",
-        severity: options.severity,
-        contract: { name: "release-authority", version: "v3" },
-        evidenceKind: "static",
-        path: options.path,
-        expected: options.expected,
-        actual: options.actual,
-        remediation: options.remediation,
-    };
-}
-function summarize(findings, classification) {
-    const relevant = findings.filter((finding) => finding.classification === classification);
-    const blockers = relevant.filter((finding) => finding.severity === "blocker").length;
-    const warnings = relevant.filter((finding) => finding.severity === "warning").length;
-    const info = relevant.filter((finding) => finding.severity === "info").length;
-    return {
-        status: blockers > 0 ? "blocked" : warnings > 0 ? "warning" : "pass",
-        total: relevant.length,
-        blockers,
-        warnings,
-        info,
-    };
+    return files.sort();
 }
 function readPackageJson(root) {
     const source = readOptionalText(join(root, "package.json"));
@@ -1011,48 +442,38 @@ function readPackageJson(root) {
     }
 }
 function readPackageLock(root) {
-    const path = join(root, "package-lock.json");
-    const source = readOptionalText(path);
-    if (!source) {
-        return emptyPackageLockInspection("missing");
-    }
+    const source = readOptionalText(join(root, "package-lock.json"));
+    if (!source)
+        return emptyPackageLock("missing");
     let parsed;
     try {
         parsed = JSON.parse(source);
     }
     catch {
-        return emptyPackageLockInspection("invalid", {
-            digest: digestBrandlabAuthority(source),
-        });
-    }
-    if (!isObjectRecord(parsed)) {
-        return emptyPackageLockInspection("invalid", {
-            digest: digestBrandlabAuthority(parsed),
-        });
+        return emptyPackageLock("invalid", { digest: digestBrandlabAuthority(source) });
     }
-    const lockfileVersion = typeof parsed.lockfileVersion === "number"
-        ? parsed.lockfileVersion
-        : null;
+    if (!isRecord(parsed))
+        return emptyPackageLock("invalid");
+    const lockfileVersion = typeof parsed.lockfileVersion === "number" ? parsed.lockfileVersion : null;
     if (lockfileVersion !== 2 && lockfileVersion !== 3) {
-        return emptyPackageLockInspection("unsupported", {
-            lockfileVersion,
-            digest: digestBrandlabAuthority(parsed),
-        });
+        return emptyPackageLock("unsupported", { lockfileVersion });
     }
-    if (!isObjectRecord(parsed.packages) || !isObjectRecord(parsed.packages[""])) {
-        return emptyPackageLockInspection("invalid", {
-            lockfileVersion,
-            digest: digestBrandlabAuthority(parsed),
-        });
+    if (!isRecord(parsed.packages) || !isRecord(parsed.packages[""])) {
+        return emptyPackageLock("invalid", { lockfileVersion });
     }
     const rootPackage = parsed.packages[""];
     const rootDependencies = stringRecord(rootPackage.dependencies);
     const rootDevDependencies = stringRecord(rootPackage.devDependencies);
     const rootEngines = stringRecord(rootPackage.engines);
     const resolvedPackages = new Map();
-    for (const packageName of [...BRANDLAB_SHARED_PACKAGE_NAMES, ...RUNTIME_PACKAGE_FIELDS.map(([name]) => name)]) {
+    const packageNames = [
+        ...BRANDLAB_SHARED_PACKAGE_NAMES,
+        ...RUNTIME_PACKAGE_FIELDS.map(([name]) => name),
+        "sharp",
+    ];
+    for (const packageName of packageNames) {
         const entry = parsed.packages[`node_modules/${packageName}`];
-        if (!isObjectRecord(entry))
+        if (!isRecord(entry))
             continue;
         resolvedPackages.set(packageName, {
             version: typeof entry.version === "string" ? entry.version : null,
@@ -1061,6 +482,13 @@ function readPackageLock(root) {
             linked: entry.link === true,
         });
     }
+    const sharpResolutions = Object.entries(parsed.packages)
+        .filter(([path]) => path === "node_modules/sharp" || path.endsWith("/node_modules/sharp"))
+        .map(([path, entry]) => ({
+        path,
+        version: isRecord(entry) && typeof entry.version === "string" ? entry.version : null,
+    }))
+        .sort((left, right) => left.path.localeCompare(right.path));
     return {
         state: "valid",
         lockfileVersion,
@@ -1068,170 +496,135 @@ function readPackageLock(root) {
         rootDevDependencies,
         rootEngines,
         resolvedPackages,
+        sharpResolutions,
         fingerprint: {
-            state: "valid",
             lockfileVersion,
-            root: {
-                packages: Object.fromEntries([...BRANDLAB_SHARED_PACKAGE_NAMES, ...RUNTIME_PACKAGE_FIELDS.map(([name]) => name)]
-                    .map((packageName) => [packageName, lockedRootSpec({
-                        state: "valid",
-                        lockfileVersion,
-                        rootDependencies,
-                        rootDevDependencies,
-                        rootEngines,
-                        resolvedPackages,
-                        fingerprint: {},
-                    }, packageName)])),
-                node: rootEngines.node ?? null,
-            },
-            resolved: Object.fromEntries([...resolvedPackages.entries()].map(([packageName, entry]) => [
-                packageName,
-                { version: entry.version, linked: entry.linked },
+            rootDependencies,
+            rootDevDependencies,
+            rootEngines,
+            resolved: Object.fromEntries([...resolvedPackages].map(([name, value]) => [
+                name,
+                { version: value.version, linked: value.linked },
             ])),
+            sharpResolutions,
         },
     };
 }
-function emptyPackageLockInspection(state, extra = {}) {
+function emptyPackageLock(state, fingerprint = {}) {
     return {
         state,
-        lockfileVersion: typeof extra.lockfileVersion === "number" ? extra.lockfileVersion : null,
+        lockfileVersion: typeof fingerprint.lockfileVersion === "number"
+            ? fingerprint.lockfileVersion
+            : null,
         rootDependencies: {},
         rootDevDependencies: {},
         rootEngines: {},
         resolvedPackages: new Map(),
-        fingerprint: { state, ...extra },
+        sharpResolutions: [],
+        fingerprint: { state, ...fingerprint },
     };
 }
+function runtimeVersionSatisfiesRelease(packageName, actual, expected) {
+    if (!actual || !isBrandlabSemver(actual))
+        return false;
+    if (!["next", "react", "react-dom"].includes(packageName))
+        return actual === expected;
+    const actualParts = actual.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    const expectedParts = expected.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    return Boolean(actualParts &&
+        expectedParts &&
+        actualParts[1] === expectedParts[1] &&
+        actualParts[2] === expectedParts[2] &&
+        compareBrandlabSemver(actual, expected) >= 0);
+}
+function runtimeExpectation(packageName, expected) {
+    return ["next", "react", "react-dom"].includes(packageName)
+        ? `${packageName}@${expected} or a newer exact patch in the same major/minor line`
+        : `${packageName}@${expected}`;
+}
+function isApprovedRegistryResolution(resolved, packageName, version) {
+    try {
+        const url = new URL(resolved);
+        const artifact = packageName.split("/").at(-1);
+        return Boolean(artifact &&
+            url.protocol === "https:" &&
+            url.hostname === "registry.npmjs.org" &&
+            url.pathname === `/${packageName}/-/${artifact}-${version}.tgz`);
+    }
+    catch {
+        return false;
+    }
+}
 function declaredPackageSpec(packageJson, packageName) {
-    return packageJson.dependencies?.[packageName] ??
+    return (packageJson.dependencies?.[packageName] ??
         packageJson.devDependencies?.[packageName] ??
-        null;
-}
-function lockedRootSpec(packageLock, packageName) {
-    return packageLock.rootDependencies[packageName] ??
-        packageLock.rootDevDependencies[packageName] ??
-        null;
-}
-function stringRecord(value) {
-    if (!isObjectRecord(value))
-        return {};
-    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
-}
-function isObjectRecord(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+        null);
 }
-function readOptionalText(path) {
-    return existsSync(path) ? readFileSync(path, "utf8") : null;
+function lockedRootSpec(lock, packageName) {
+    return lock.rootDependencies[packageName] ?? lock.rootDevDependencies[packageName] ?? null;
 }
-function extractDelimitedProperty(source, propertyName, openChar, closeChar) {
-    const propertyMatch = source.match(new RegExp(`\\b${escapeRegExp(propertyName)}\\s*:`));
-    if (!propertyMatch || propertyMatch.index === undefined)
-        return null;
-    const start = source.indexOf(openChar, propertyMatch.index + propertyMatch[0].length);
-    if (start === -1)
-        return null;
-    return extractDelimitedBody(source, start, openChar, closeChar);
+function releaseFinding(ruleId, expected, actual, remediation, path) {
+    return {
+        ruleId,
+        surface: "release",
+        severity: "blocker",
+        contract: { name: "release", version: "current-release" },
+        evidenceKind: "static",
+        ...(path ? { path } : {}),
+        expected,
+        actual,
+        remediation,
+    };
 }
-function extractDelimitedBody(source, start, openChar, closeChar) {
-    let depth = 0;
-    let quote = null;
-    let escaped = false;
-    for (let index = start; index < source.length; index += 1) {
-        const char = source[index];
-        if (quote) {
-            if (escaped)
-                escaped = false;
-            else if (char === "\\")
-                escaped = true;
-            else if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === '"' || char === "'" || char === "`")
-            quote = char;
-        else if (char === openChar)
-            depth += 1;
-        else if (char === closeChar) {
-            depth -= 1;
-            if (depth === 0)
-                return source.slice(start + 1, index);
-        }
-    }
-    return null;
+function runtimeFinding(ruleId, expected, actual, remediation, path) {
+    return {
+        ruleId,
+        surface: "runtime",
+        severity: "blocker",
+        contract: { name: "runtime", version: "installed-release" },
+        evidenceKind: "static",
+        path,
+        expected,
+        actual,
+        remediation,
+    };
 }
-function extractObjectBodies(source) {
-    const bodies = [];
-    let quote = null;
-    let escaped = false;
-    let arrayDepth = 0;
-    for (let index = 0; index < source.length; index += 1) {
-        const char = source[index];
-        if (quote) {
-            if (escaped)
-                escaped = false;
-            else if (char === "\\")
-                escaped = true;
-            else if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === '"' || char === "'" || char === "`") {
-            quote = char;
-            continue;
-        }
-        if (char === "[")
-            arrayDepth += 1;
-        else if (char === "]")
-            arrayDepth -= 1;
-        else if (char === "{" && arrayDepth === 0) {
-            const body = extractDelimitedBody(source, index, "{", "}");
-            if (body !== null) {
-                bodies.push(body);
-                index += body.length + 1;
-            }
-        }
-    }
-    return bodies;
+function staticFinding(options) {
+    return {
+        ruleId: options.ruleId,
+        surface: options.surface,
+        severity: "blocker",
+        contract: { name: "project", version: "current-only-v2" },
+        evidenceKind: "static",
+        ...(options.path ? { path: options.path } : {}),
+        ...(options.line ? { line: options.line } : {}),
+        expected: options.expected,
+        actual: options.actual,
+        remediation: options.remediation,
+    };
 }
-function extractStringProperty(source, propertyName) {
-    return source.match(new RegExp("\\b" + escapeRegExp(propertyName) + "\\s*:\\s*['\"`]([^'\"`]+)['\"`]", "m"))?.[1] ?? null;
+function compareFindings(left, right) {
+    return (left.ruleId.localeCompare(right.ruleId) ||
+        (left.path ?? "").localeCompare(right.path ?? "") ||
+        (left.line ?? 0) - (right.line ?? 0));
 }
-function extractNumberProperty(source, propertyName) {
-    const raw = source.match(new RegExp(`\\b${escapeRegExp(propertyName)}\\s*:\\s*(\\d+)`, "m"))?.[1];
-    return raw ? Number(raw) : null;
+function readOptionalText(path) {
+    return existsSync(path) ? readFileSync(path, "utf8") : null;
 }
-function extractStringArray(source, propertyName) {
-    const arraySource = extractDelimitedProperty(source, propertyName, "[", "]");
-    if (arraySource === null)
-        return undefined;
-    return [...arraySource.matchAll(/['\"]([^'\"]+)['\"]/g)].map((match) => match[1]);
+function stringRecord(value) {
+    if (!isRecord(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
 }
-function assignString(target, key, value) {
-    if (value !== null)
-        target[key] = value;
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function assignNumber(target, key, value) {
-    if (value !== null)
-        target[key] = value;
+function extension(name) {
+    const index = name.lastIndexOf(".");
+    return index === -1 ? "" : name.slice(index);
 }
-function surfaceForRule(ruleId) {
-    for (const surface of [
-        "contact",
-        "metadata",
-        "schema",
-        "sitemap",
-        "breadcrumb",
-        "analytics",
-        "accessibility",
-        "runtime",
-        "release",
-    ]) {
-        if (ruleId.toLowerCase().includes(surface))
-            return surface;
-    }
-    if (/api key|secret|credential|recaptcha/i.test(ruleId))
-        return "security";
-    return "architecture";
+function lineAt(source, index) {
+    return source.slice(0, index).split("\n").length;
 }
 function slugify(value) {
     return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
@@ -1239,23 +632,4 @@ function slugify(value) {
 function normalizePath(value) {
     return value.split(/[/\\]/).join("/");
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function compareFindings(first, second) {
-    const classificationOrder = {
-        maintenance: 0,
-        migration: 1,
-        advisory: 2,
-    };
-    const severityOrder = {
-        blocker: 0,
-        warning: 1,
-        info: 2,
-    };
-    return (classificationOrder[first.classification] - classificationOrder[second.classification] ||
-        severityOrder[first.severity] - severityOrder[second.severity] ||
-        first.ruleId.localeCompare(second.ruleId) ||
-        (first.path ?? "").localeCompare(second.path ?? ""));
-}
 //# sourceMappingURL=project.js.map