@decantr/verifier 1.0.0 → 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Decantr AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.js

@@ -596,10 +596,13 @@ function auditProjectSourceTree(projectRoot) {
   const summary = {
     filesChecked: sourceFiles.length,
     inlineStyles: createSourceAuditBucket(),
+    componentStyleTags: createSourceAuditBucket(),
     localCssRuntimeSignals: createSourceAuditBucket(),
     securityRiskPatterns: createSourceAuditBucket(),
     localhostEndpointSignals: createSourceAuditBucket(),
     placeholderRoutes: createSourceAuditBucket(),
+    commandPaletteSignals: createSourceAuditBucket(),
+    keyboardShortcutSignals: createSourceAuditBucket(),
     protectedSurfaceSignals: createSourceAuditBucket(),
     authProtectedRedirectSignals: createSourceAuditBucket(),
     authAnonymousRedirectSignals: createSourceAuditBucket(),
@@ -666,11 +669,17 @@ function auditProjectSourceTree(projectRoot) {
     const securityRiskPatternCount = signals.dangerousHtmlCount + signals.rawHtmlInjectionCount + signals.dynamicEvalCount + signals.hardcodedSecretSignalCount + signals.clientSecretEnvReferenceCount + signals.localhostEndpointCount + signals.wildcardPostMessageCount + signals.windowOpenWithoutNoopenerCount + signals.externalIframeWithoutSandboxCount + signals.insecureExternalIframeCount + signals.insecureFormActionCount + signals.insecureAuthFormMethodCount + signals.insecureTransportEndpointCount + signals.insecureExternalImageCount + signals.authCookieMissingHardeningCount + signals.authOpenRedirectSignalCount + signals.authExternalRedirectSignalCount + signals.authProviderStateMissingCount + signals.authProviderPkceMissingCount + signals.authProviderNonceMissingCount + signals.externalBlankLinkWithoutRelCount;
     const authInputHintIssueCount = signals.emailAutocompleteMissingCount + signals.passwordAutocompleteMissingCount + signals.otpAutocompleteMissingCount + signals.authAutocompleteDisabledCount + signals.authAutocompleteSemanticMismatchCount + signals.authInputTypeMismatchCount;
     const localCssRuntimeCount = /(?:^|\/)(?:lib|utils)\/css\.(?:[cm]?[jt]sx?)$/i.test(relativePath) || /(?:^|\/)styles\/atoms\.css$/i.test(relativePath) || /Lightweight @decantr\/css atom runtime/i.test(code) ? 1 : 0;
+    const componentStyleTagCount = countComponentStyleTagSignals(code);
+    const commandPaletteSignalCount = countCommandPaletteSignals(code);
+    const keyboardShortcutSignalCount = countKeyboardShortcutSignals(code);
     recordSourceAudit(summary.inlineStyles, relativePath, signals.inlineStyleAttributeCount);
+    recordSourceAudit(summary.componentStyleTags, relativePath, componentStyleTagCount);
     recordSourceAudit(summary.localCssRuntimeSignals, relativePath, localCssRuntimeCount);
     recordSourceAudit(summary.securityRiskPatterns, relativePath, securityRiskPatternCount);
     recordSourceAudit(summary.localhostEndpointSignals, relativePath, signals.localhostEndpointCount);
     recordSourceAudit(summary.placeholderRoutes, relativePath, signals.placeholderNavigationTargetCount);
+    recordSourceAudit(summary.commandPaletteSignals, relativePath, commandPaletteSignalCount);
+    recordSourceAudit(summary.keyboardShortcutSignals, relativePath, keyboardShortcutSignalCount);
     recordSourceAudit(summary.protectedSurfaceSignals, relativePath, signals.protectedSurfaceSignalCount);
     recordSourceAudit(summary.authProtectedRedirectSignals, relativePath, signals.authProtectedRedirectSignalCount);
     recordSourceAudit(summary.authAnonymousRedirectSignals, relativePath, signals.authAnonymousRedirectSignalCount);
@@ -1536,6 +1545,16 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       suggestedFix: "Move inline styling into treatments, atoms, or design-token-backed classes so generation stays aligned with the Decantr contract."
     }));
   }
+  if (sourceAudit.componentStyleTags.count > 0) {
+    findings.push(makeFinding({
+      id: "source-component-style-tags-present",
+      category: "Source Audit",
+      severity: "warn",
+      message: "Source files inject component-scoped style tags or dynamic style elements, which bypass the compiled Decantr layer contract.",
+      evidence: buildSourceAuditEvidence(sourceAudit, sourceAudit.componentStyleTags, "Component-level style tag signals"),
+      suggestedFix: "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so styling stays inside the reviewed Decantr layer stack."
+    }));
+  }
   if (sourceAudit.localCssRuntimeSignals.count > 0) {
     findings.push(makeFinding({
       id: "source-local-css-runtime-stub-present",
@@ -1576,6 +1595,33 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       suggestedFix: "Replace placeholder href/to values with the actual routes declared in the compiled packs and essence."
     }));
   }
+  const navigation = essence && isV3(essence) ? essence.meta.navigation : null;
+  if (navigation?.command_palette && sourceAudit.commandPaletteSignals.count === 0) {
+    findings.push(makeFinding({
+      id: "source-command-palette-missing",
+      category: "Source Audit",
+      severity: "warn",
+      message: "The essence declares a command palette, but the source tree does not show an obvious command-palette implementation signal.",
+      evidence: [
+        `Source files checked: ${sourceAudit.filesChecked}`,
+        "Command palette declared in essence navigation."
+      ],
+      suggestedFix: "Implement a real command palette surface with its keyboard trigger instead of merely acknowledging the feature in copy or comments."
+    }));
+  }
+  if (navigation?.hotkeys?.length && sourceAudit.keyboardShortcutSignals.count === 0) {
+    findings.push(makeFinding({
+      id: "source-hotkeys-missing",
+      category: "Source Audit",
+      severity: "warn",
+      message: "The essence declares hotkeys, but the source tree does not show obvious keyboard-shortcut handling.",
+      evidence: [
+        `Source files checked: ${sourceAudit.filesChecked}`,
+        `Hotkeys declared: ${navigation.hotkeys.length}`
+      ],
+      suggestedFix: "Implement the declared hotkeys with real keydown handlers or a reviewed shortcut helper rather than leaving them as documentation-only features."
+    }));
+  }
   if (sourceAudit.authStorageWrites.count > 0) {
     findings.push(makeFinding({
       id: "source-auth-storage-writes-present",
@@ -2470,6 +2516,19 @@ function findUtilityFrameworkSignals(code) {
   const matches = code.match(/\b(?:bg|text|border|shadow|rounded|px|py|mx|my|gap|grid-cols|col-span|row-span|sm|md|lg|xl|hover):[-\w/.[\]]+/g) ?? [];
   return [...new Set(matches)];
 }
+function countComponentStyleTagSignals(code) {
+  const jsxStyleTags = code.match(/<style(?:\s|>)/gi)?.length ?? 0;
+  const dynamicStyleElements = code.match(/document\.createElement\((['"])style\1\)/g)?.length ?? 0;
+  return jsxStyleTags + dynamicStyleElements;
+}
+function countCommandPaletteSignals(code) {
+  const matches = code.match(/\b(?:commandpalette|command palette|cmd\+k|⌘k|openCommandPalette|setCommandPaletteOpen|paletteOpen|paletteTrigger)\b/gi) ?? [];
+  return matches.length;
+}
+function countKeyboardShortcutSignals(code) {
+  const matches = code.match(/\b(?:keydown|keyup|metaKey|ctrlKey|altKey|shiftKey|hotkey|shortcut)\b/gi) ?? [];
+  return matches.length;
+}
 function getScriptKind(filePath) {
   switch (extname2(filePath).toLowerCase()) {
     case ".tsx":
@@ -8016,6 +8075,18 @@ function critiqueSource({
       suggestedFix: "Replace inline visual values with treatments, decorators, and CSS variables from the compiled contract."
     }));
   }
+  const componentStyleTagSignals = countComponentStyleTagSignals(code);
+  if (componentStyleTagSignals > 0) {
+    findings.push(makeFinding({
+      id: "anti-pattern-component-style-tags",
+      category: "Anti-Patterns",
+      severity: resolveSeverityFromChecks(reviewPack, "warn", ["review-contract-baseline", "theme-consistency"]),
+      message: "Component-scoped style tags or dynamic style elements were detected in the reviewed file.",
+      evidence: [filePath, `Component style tag signals: ${componentStyleTagSignals}`],
+      file: filePath,
+      suggestedFix: "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so the file stays aligned with the Decantr layer contract."
+    }));
+  }
   const hardcodedColors = antiPatternIds.has("hardcoded-colors") ? findHardcodedColors(code) : [];
   if (hardcodedColors.length > 0) {
     findings.push(makeFinding({