@decantr/verifier 1.1.0 → 2.0.0

package/README.md

@@ -51,7 +51,7 @@ function isBlocking(report: ProjectHealthReport) {
 
 ## Compatibility
 
-`@decantr/verifier` is stable in the `1.x` line for the documented verifier APIs and published report-schema exports.
+`@decantr/verifier` is stable in the `2.x` line for the documented verifier APIs and published report-schema exports.
 
 - new checks and additive report fields may appear in compatible releases
 - breaking report-shape or exported API changes require a major version

package/dist/index.d.ts

@@ -54,7 +54,7 @@ declare function emptyRuntimeAudit(failures?: string[]): RuntimeAudit;
 declare function auditBuiltDist(projectRoot: string, options?: BuiltDistAuditOptions): Promise<RuntimeAudit>;
 
 /**
- * v2.1 Tier C4 — Experiential interaction verifier.
+ * Experiential interaction verifier.
  *
  * Scans generated source files for evidence that declared `interactions[]`
  * (from pattern.v2.json) are actually implemented. This is the enforcement

package/dist/index.js

@@ -1,12 +1,12 @@
 // src/index.ts
-import { existsSync as existsSync2, realpathSync, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync } from "fs";
 import { readFile } from "fs/promises";
-import { extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
-import { evaluateGuard, isV3, validateEssence } from "@decantr/essence-spec";
+import { dirname, extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
+import { evaluateGuard, isV4, validateEssence } from "@decantr/essence-spec";
 import * as ts from "typescript";
 
 // src/runtime.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { createServer } from "http";
 import { extname, join, normalize } from "path";
 var CONTENT_TYPES = {
@@ -224,6 +224,122 @@ function countSecretLeakSignals(js) {
   ];
   return patterns.reduce((count, pattern) => count + (js.match(pattern)?.length ?? 0), 0);
 }
+function collectFiles(rootDir, predicate) {
+  if (!existsSync(rootDir)) return [];
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (entry.isFile() && predicate(path)) {
+        files.push(path);
+      }
+    }
+  };
+  walk(rootDir);
+  return files.sort();
+}
+function auditNextBuildOutput(projectRoot) {
+  const nextDir = join(projectRoot, ".next");
+  const buildIdPresent = existsSync(join(nextDir, "BUILD_ID"));
+  const buildManifestPresent = existsSync(join(nextDir, "build-manifest.json"));
+  const appServerDir = join(nextDir, "server", "app");
+  const htmlFiles = collectFiles(appServerDir, (filePath) => {
+    const relativePath = filePath.slice(appServerDir.length + 1).replace(/\\/g, "/");
+    return filePath.endsWith(".html") && !relativePath.startsWith("_");
+  });
+  const htmlDocuments = htmlFiles.map((filePath) => readFileSync(filePath, "utf-8"));
+  const staticAssetFiles = collectFiles(
+    join(nextDir, "static"),
+    (filePath) => /\.(?:js|css|json|svg|png|jpe?g|webp)$/i.test(filePath)
+  );
+  let totalAssetBytes = 0;
+  let jsAssetBytes = 0;
+  let cssAssetBytes = 0;
+  let largestAssetPath = null;
+  let largestAssetBytes = 0;
+  let combinedJs = "";
+  for (const assetFile of staticAssetFiles) {
+    const byteLength = statSync(assetFile).size;
+    const assetPath = `/_next/static/${assetFile.slice(join(nextDir, "static").length + 1).replace(/\\/g, "/")}`;
+    totalAssetBytes += byteLength;
+    if (assetFile.endsWith(".js")) {
+      jsAssetBytes += byteLength;
+      combinedJs += readFileSync(assetFile, "utf-8");
+    }
+    if (assetFile.endsWith(".css")) {
+      cssAssetBytes += byteLength;
+    }
+    if (byteLength > largestAssetBytes) {
+      largestAssetBytes = byteLength;
+      largestAssetPath = assetPath;
+    }
+  }
+  const hasHtmlDocuments = htmlDocuments.length > 0;
+  const titleOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<title>[^<]+<\/title>/i.test(html));
+  const langOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<html[^>]*\slang=(["'])[^"']+\1/i.test(html));
+  const viewportOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<meta[^>]+name=(["'])viewport\1[^>]*>/i.test(html));
+  const charsetOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<meta[^>]+charset=/i.test(html));
+  const failures = ["next-build-output"];
+  if (!buildIdPresent) {
+    failures.push("next-build-id-missing");
+  }
+  if (!buildManifestPresent) {
+    failures.push("next-build-manifest-missing");
+  }
+  if (staticAssetFiles.length === 0) {
+    failures.push("next-assets-missing");
+  }
+  const passed = buildIdPresent && buildManifestPresent && staticAssetFiles.length > 0;
+  return {
+    distPresent: true,
+    indexPresent: true,
+    checked: true,
+    passed,
+    rootDocumentOk: hasHtmlDocuments || passed,
+    titleOk,
+    langOk,
+    viewportOk,
+    charsetOk,
+    cspSignalOk: true,
+    inlineScriptCount: 0,
+    inlineEventHandlerCount: 0,
+    externalScriptsWithoutIntegrityCount: 0,
+    externalScriptsWithIntegrityMissingCrossoriginCount: 0,
+    externalStylesheetsWithoutIntegrityCount: 0,
+    externalStylesheetsWithIntegrityMissingCrossoriginCount: 0,
+    externalScriptsWithInsecureTransportCount: 0,
+    externalStylesheetsWithInsecureTransportCount: 0,
+    externalMediaSourcesWithInsecureTransportCount: 0,
+    externalBlankLinksWithoutRelCount: 0,
+    externalIframesWithoutSandboxCount: 0,
+    externalIframesWithInsecureTransportCount: 0,
+    jsEvalSignalCount: countDynamicCodeSignals(combinedJs),
+    jsHtmlInjectionSignalCount: countHtmlInjectionSignals(combinedJs),
+    jsInsecureTransportSignalCount: countInsecureTransportSignals(combinedJs),
+    jsSecretSignalCount: countSecretLeakSignals(combinedJs),
+    assetCount: staticAssetFiles.length,
+    assetsPassed: staticAssetFiles.length,
+    routeHintsChecked: [],
+    routeHintsMatched: 0,
+    routeHintsCoverageOk: true,
+    routeDocumentsChecked: 0,
+    routeDocumentsPassed: 0,
+    routeDocumentsHardenedCount: 0,
+    routeDocumentsCoverageOk: true,
+    routeDocumentsHardeningOk: true,
+    fullRouteCoverageOk: true,
+    totalAssetBytes,
+    jsAssetBytes,
+    cssAssetBytes,
+    largestAssetPath,
+    largestAssetBytes,
+    failures
+  };
+}
 function normalizeRouteHint(route) {
   if (!route || route === "/") return "/";
   const dynamicIndex = route.indexOf("/:");
@@ -280,6 +396,9 @@ async function startStaticServer(rootDir) {
 async function auditBuiltDist(projectRoot, options = {}) {
   const distDir = options.distDir ?? join(projectRoot, "dist");
   if (!existsSync(distDir)) {
+    if (!options.distDir && existsSync(join(projectRoot, ".next"))) {
+      return auditNextBuildOutput(projectRoot);
+    }
     return emptyRuntimeAudit(["dist-missing"]);
   }
   const indexPath = join(distDir, "index.html");
@@ -686,6 +805,54 @@ function recordSourceAudit(bucket, filePath, count) {
 function sourceAuditBucketsOverlap(a, b) {
   return a.files.some((file) => b.files.includes(file));
 }
+function normalizeSourceAuditPath(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+function getNextAppLayoutGuardRoot(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  const match = normalized.match(
+    /^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)\/layout\.[cm]?[jt]sx?$/i
+  );
+  return match?.[1] ?? null;
+}
+function getNextAppRouteRoot(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  const match = normalized.match(/^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)(?:\/|$)/i);
+  return match?.[1] ?? null;
+}
+function getRouteRoot(route) {
+  const firstSegment = route.replace(/^\/+/, "").split("/")[0];
+  if (!firstSegment || firstSegment.startsWith(":") || firstSegment.startsWith("[")) {
+    return null;
+  }
+  return firstSegment;
+}
+function isNextAppPublicChromeFile(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  return /^(?:src\/)?app\/(?:\([^/]+\)\/)*(?:layout|nav|nav-header|navigation|header|footer|sidebar)\.[cm]?[jt]sx?$/i.test(
+    normalized
+  );
+}
+function sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(protectedSurfaces, authGuards, topology) {
+  const guardedRoots = /* @__PURE__ */ new Set();
+  for (const file of authGuards.files) {
+    const root = getNextAppLayoutGuardRoot(file);
+    if (root) {
+      guardedRoots.add(root);
+    }
+  }
+  if (guardedRoots.size === 0 || protectedSurfaces.files.length === 0) {
+    return false;
+  }
+  const guardedPrimaryRouteRoots = topology.primaryRoutes.map(getRouteRoot).filter((root) => Boolean(root)).filter((root) => guardedRoots.has(root));
+  return protectedSurfaces.files.every((file) => {
+    const appRoot = getNextAppRouteRoot(file);
+    if (appRoot && guardedRoots.has(appRoot)) {
+      return true;
+    }
+    return isNextAppPublicChromeFile(file) && guardedPrimaryRouteRoots.length > 0;
+  });
+}
 function isAuditableSourceFile(filePath) {
   if (/\.d\.ts$/i.test(filePath)) return false;
   return /\.(?:[cm]?[jt]sx?)$/i.test(filePath);
@@ -726,7 +893,7 @@ function collectProjectSourceFiles(projectRoot) {
     "coverage"
   ]);
   const walk = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (ignoredDirNames.has(entry.name)) continue;
       const absolutePath = join2(dir, entry.name);
       if (entry.isDirectory()) {
@@ -770,7 +937,7 @@ function collectProjectStyleFiles(projectRoot) {
     "coverage"
   ]);
   const walk = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (ignoredDirNames.has(entry.name)) continue;
       const absolutePath = join2(dir, entry.name);
       if (entry.isDirectory()) {
@@ -799,8 +966,126 @@ function countReducedMotionSignals(code) {
   ];
   return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
 }
+function hasModuleDirective(filePath, code, directive) {
+  const sourceFile = ts.createSourceFile(
+    filePath,
+    code,
+    ts.ScriptTarget.Latest,
+    true,
+    getScriptKind(filePath)
+  );
+  for (const statement of sourceFile.statements) {
+    if (ts.isExpressionStatement(statement) && ts.isStringLiteralLike(statement.expression)) {
+      if (statement.expression.text === directive) {
+        return true;
+      }
+      continue;
+    }
+    break;
+  }
+  return false;
+}
+function importDeclarationHasRuntimeBinding(statement) {
+  const clause = statement.importClause;
+  if (!clause) return true;
+  if (clause.isTypeOnly) return false;
+  if (clause.name) return true;
+  if (!clause.namedBindings) return true;
+  if (ts.isNamespaceImport(clause.namedBindings)) return true;
+  return clause.namedBindings.elements.some((element) => !element.isTypeOnly);
+}
+function collectRuntimeImportSpecifiers(entry) {
+  const sourceFile = ts.createSourceFile(
+    entry.relativePath,
+    entry.code,
+    ts.ScriptTarget.Latest,
+    true,
+    getScriptKind(entry.relativePath)
+  );
+  const specifiers = [];
+  for (const statement of sourceFile.statements) {
+    if (ts.isImportDeclaration(statement) && ts.isStringLiteralLike(statement.moduleSpecifier) && importDeclarationHasRuntimeBinding(statement)) {
+      specifiers.push(statement.moduleSpecifier.text);
+    }
+  }
+  return specifiers;
+}
+function resolveSourceImportTarget(projectRoot, sourceAbsolutePath, specifier) {
+  let basePath = null;
+  if (specifier.startsWith("@/")) {
+    basePath = join2(projectRoot, "src", specifier.slice(2));
+  } else if (specifier.startsWith("./") || specifier.startsWith("../")) {
+    basePath = resolve(dirname(sourceAbsolutePath), specifier);
+  }
+  if (!basePath) return null;
+  const candidates = [
+    basePath,
+    `${basePath}.ts`,
+    `${basePath}.tsx`,
+    `${basePath}.js`,
+    `${basePath}.jsx`,
+    `${basePath}.mts`,
+    `${basePath}.cts`,
+    join2(basePath, "index.ts"),
+    join2(basePath, "index.tsx"),
+    join2(basePath, "index.js"),
+    join2(basePath, "index.jsx")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync2(candidate) && isAuditableSourceFile(candidate)) {
+      return relative(projectRoot, candidate) || candidate;
+    }
+  }
+  return null;
+}
+function collectClientReachableSourceFiles(projectRoot, entries) {
+  const entriesByRelativePath = new Map(entries.map((entry) => [entry.relativePath, entry]));
+  const runtimeImportGraph = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const targets = collectRuntimeImportSpecifiers(entry).map((specifier) => resolveSourceImportTarget(projectRoot, entry.absolutePath, specifier)).filter((target) => Boolean(target));
+    runtimeImportGraph.set(entry.relativePath, targets);
+  }
+  const reachable = /* @__PURE__ */ new Set();
+  const queue = entries.filter((entry) => hasModuleDirective(entry.relativePath, entry.code, "use client")).map((entry) => entry.relativePath);
+  for (const root of queue) {
+    reachable.add(root);
+  }
+  while (queue.length > 0) {
+    const current = queue.shift();
+    for (const target of runtimeImportGraph.get(current) ?? []) {
+      const targetEntry = entriesByRelativePath.get(target);
+      if (targetEntry && hasModuleDirective(target, targetEntry.code, "use server")) {
+        continue;
+      }
+      if (!reachable.has(target)) {
+        reachable.add(target);
+        queue.push(target);
+      }
+    }
+  }
+  return reachable;
+}
+function isClientAuthHeaderSource(relativePath, code, clientReachableFiles) {
+  if (hasModuleDirective(relativePath, code, "use server")) {
+    return false;
+  }
+  if (clientReachableFiles.has(relativePath)) {
+    return true;
+  }
+  const normalized = normalizeSourceAuditPath(relativePath);
+  if (/^(?:src\/)?app\//i.test(normalized)) {
+    return false;
+  }
+  return /(?:^|\/)(?:components|routes|pages|hooks|providers)\//i.test(normalized);
+}
 function auditProjectSourceTree(projectRoot) {
   const sourceFiles = collectProjectSourceFiles(projectRoot);
+  const sourceEntries = sourceFiles.map((sourceFile) => ({
+    absolutePath: sourceFile,
+    relativePath: relative(projectRoot, sourceFile) || sourceFile,
+    code: readFileSync2(sourceFile, "utf-8")
+  }));
+  const clientReachableFiles = collectClientReachableSourceFiles(projectRoot, sourceEntries);
   const summary = {
     filesChecked: sourceFiles.length,
     inlineStyles: createSourceAuditBucket(),
@@ -869,10 +1154,13 @@ function auditProjectSourceTree(projectRoot) {
     interactionSafetyIssues: createSourceAuditBucket(),
     authInputHintIssues: createSourceAuditBucket()
   };
-  for (const sourceFile of sourceFiles) {
-    const relativePath = relative(projectRoot, sourceFile) || sourceFile;
-    const code = readFileSync2(sourceFile, "utf-8");
+  for (const { relativePath, code } of sourceEntries) {
     const signals = analyzeAstSignals(relativePath, code);
+    const isClientAuthHeaderSourceFile = isClientAuthHeaderSource(
+      relativePath,
+      code,
+      clientReachableFiles
+    );
     const accessibilityIssueCount = signals.iconOnlyButtonWithoutLabelCount + signals.iconOnlyLinkWithoutLabelCount + signals.clickableNonSemanticCount + signals.unlabeledNavigationLandmarkCount + signals.imageWithoutAltCount + signals.iframeWithoutTitleCount + signals.dialogWithoutLabelCount + signals.dialogWithoutModalHintCount + signals.tableWithoutHeaderCount + signals.tableWithoutCaptionCount + signals.formControlWithoutLabelCount;
     const securityRiskPatternCount = signals.dangerousHtmlCount + signals.rawHtmlInjectionCount + signals.dynamicEvalCount + signals.hardcodedSecretSignalCount + signals.clientSecretEnvReferenceCount + signals.localhostEndpointCount + signals.wildcardPostMessageCount + signals.windowOpenWithoutNoopenerCount + signals.externalIframeWithoutSandboxCount + signals.insecureExternalIframeCount + signals.insecureFormActionCount + signals.insecureAuthFormMethodCount + signals.insecureTransportEndpointCount + signals.insecureExternalImageCount + signals.authCookieMissingHardeningCount + signals.authOpenRedirectSignalCount + signals.authExternalRedirectSignalCount + signals.authProviderStateMissingCount + signals.authProviderPkceMissingCount + signals.authProviderNonceMissingCount + signals.externalBlankLinkWithoutRelCount;
     const authInputHintIssueCount = signals.emailAutocompleteMissingCount + signals.passwordAutocompleteMissingCount + signals.otpAutocompleteMissingCount + signals.authAutocompleteDisabledCount + signals.authAutocompleteSemanticMismatchCount + signals.authInputTypeMismatchCount;
@@ -1042,8 +1330,16 @@ function auditProjectSourceTree(projectRoot) {
     recordSourceAudit(summary.authStorageClears, relativePath, signals.authStorageClearCount);
     recordSourceAudit(summary.authCookieWrites, relativePath, signals.authCookieWriteCount);
     recordSourceAudit(summary.authCookieClears, relativePath, signals.authCookieClearCount);
-    recordSourceAudit(summary.authHeaderWrites, relativePath, signals.authHeaderWriteCount);
-    recordSourceAudit(summary.authHeaderClears, relativePath, signals.authHeaderClearCount);
+    recordSourceAudit(
+      summary.authHeaderWrites,
+      relativePath,
+      isClientAuthHeaderSourceFile ? signals.authHeaderWriteCount : 0
+    );
+    recordSourceAudit(
+      summary.authHeaderClears,
+      relativePath,
+      isClientAuthHeaderSourceFile ? signals.authHeaderClearCount : 0
+    );
     recordSourceAudit(summary.authCacheClients, relativePath, signals.authCacheClientCount);
     recordSourceAudit(summary.authCacheClears, relativePath, signals.authCacheClearCount);
     recordSourceAudit(summary.authRefreshSignals, relativePath, signals.authRefreshSignalCount);
@@ -1115,7 +1411,7 @@ function buildRegistryContext(projectRoot) {
   const cachedThemesDir = join2(cacheDir, "@official", "themes");
   try {
     if (existsSync2(cachedThemesDir)) {
-      for (const file of readdirSync(cachedThemesDir).filter(
+      for (const file of readdirSync2(cachedThemesDir).filter(
         (name) => name.endsWith(".json") && name !== "index.json"
       )) {
         const data = JSON.parse(readFileSync2(join2(cachedThemesDir, file), "utf-8"));
@@ -1129,7 +1425,7 @@ function buildRegistryContext(projectRoot) {
   const customThemesDir = join2(customDir, "themes");
   try {
     if (existsSync2(customThemesDir)) {
-      for (const file of readdirSync(customThemesDir).filter((name) => name.endsWith(".json"))) {
+      for (const file of readdirSync2(customThemesDir).filter((name) => name.endsWith(".json"))) {
         const data = JSON.parse(readFileSync2(join2(customThemesDir, file), "utf-8"));
         if (data.id) {
           themeRegistry.set(`custom:${data.id}`, { modes: data.modes || ["light", "dark"] });
@@ -1141,7 +1437,7 @@ function buildRegistryContext(projectRoot) {
   const cachedPatternsDir = join2(cacheDir, "@official", "patterns");
   try {
     if (existsSync2(cachedPatternsDir)) {
-      for (const file of readdirSync(cachedPatternsDir).filter(
+      for (const file of readdirSync2(cachedPatternsDir).filter(
         (name) => name.endsWith(".json") && name !== "index.json"
       )) {
         const data = JSON.parse(readFileSync2(join2(cachedPatternsDir, file), "utf-8"));
@@ -1167,17 +1463,7 @@ function guardViolationToFinding(violation) {
 }
 function countPages(essence) {
   if (!essence) return 0;
-  if (isV3(essence)) {
-    const v3 = essence;
-    if (v3.blueprint.sections?.length) {
-      return v3.blueprint.sections.reduce((sum, section) => sum + section.pages.length, 0);
-    }
-    return v3.blueprint.pages?.length ?? 0;
-  }
-  if ("structure" in essence && Array.isArray(essence.structure)) {
-    return essence.structure.length;
-  }
-  return 0;
+  return essence.blueprint.sections.reduce((sum, section) => sum + section.pages.length, 0);
 }
 function makeFinding(input) {
   return input;
@@ -1252,31 +1538,19 @@ function extractRouteHintsFromEssence(essence) {
     return ["/"];
   }
   const routes = /* @__PURE__ */ new Set(["/"]);
-  if (isV3(essence)) {
-    const v3 = essence;
-    for (const section of v3.blueprint.sections ?? []) {
-      for (const page of section.pages ?? []) {
+  if (isV4(essence)) {
+    for (const section of essence.blueprint.sections) {
+      for (const page of section.pages) {
         if (typeof page.route === "string" && page.route.length > 0) {
           routes.add(normalizeRouteHint2(page.route));
         }
       }
     }
-    for (const page of v3.blueprint.pages ?? []) {
-      if (typeof page.route === "string" && page.route.length > 0) {
-        routes.add(normalizeRouteHint2(page.route));
-      }
-    }
-    if (v3.blueprint.routes && typeof v3.blueprint.routes === "object") {
-      for (const route of Object.keys(v3.blueprint.routes)) {
+    if (essence.blueprint.routes && typeof essence.blueprint.routes === "object") {
+      for (const route of Object.keys(essence.blueprint.routes)) {
         routes.add(normalizeRouteHint2(route));
       }
     }
-  } else if ("structure" in essence && Array.isArray(essence.structure)) {
-    for (const page of essence.structure) {
-      if (page && typeof page === "object" && "route" in page && typeof page.route === "string" && page.route.length > 0) {
-        routes.add(normalizeRouteHint2(page.route));
-      }
-    }
   }
   return [...routes].filter(Boolean).slice(0, 8);
 }
@@ -1288,14 +1562,13 @@ function summarizeTopology(essence, reviewPack) {
   let gatewayRouteCount = 0;
   let primaryRouteCount = 0;
   let hasAnonymousEntryRoute = false;
-  if (essence && isV3(essence)) {
-    const v3 = essence;
-    for (const feature of v3.blueprint.features ?? []) {
+  if (essence && isV4(essence)) {
+    for (const feature of essence.blueprint.features ?? []) {
       if (typeof feature === "string" && feature.length > 0) {
         features.add(feature);
       }
     }
-    for (const section of v3.blueprint.sections ?? []) {
+    for (const section of essence.blueprint.sections ?? []) {
       const role = typeof section.role === "string" && section.role.length > 0 ? section.role : "unknown";
       sectionRoles.add(role);
       for (const page of section.pages ?? []) {
@@ -1472,6 +1745,7 @@ function extractFailedRouteDocumentHardening(runtimeAudit) {
 function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topology, sourceAudit) {
   const distPath = join2(projectRoot, "dist");
   const indexPath = join2(distPath, "index.html");
+  const isFrameworkBuildOutput = runtimeAudit.failures.includes("next-build-output");
   if (!runtimeAudit.distPresent) {
     findings.push(
       makeFinding({
@@ -1966,7 +2240,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
     }
   }
   const largestIsJs = typeof runtimeAudit.largestAssetPath === "string" && runtimeAudit.largestAssetPath.endsWith(".js");
-  if (largestIsJs && runtimeAudit.largestAssetBytes > PERFORMANCE_BUDGETS.largestJsAssetWarnBytes || runtimeAudit.jsAssetBytes > PERFORMANCE_BUDGETS.totalJsWarnBytes) {
+  if (!isFrameworkBuildOutput && (largestIsJs && runtimeAudit.largestAssetBytes > PERFORMANCE_BUDGETS.largestJsAssetWarnBytes || runtimeAudit.jsAssetBytes > PERFORMANCE_BUDGETS.totalJsWarnBytes)) {
     findings.push(
       makeFinding({
         id: "runtime-js-bundle-large",
@@ -1981,7 +2255,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
       })
     );
   }
-  if (runtimeAudit.cssAssetBytes > PERFORMANCE_BUDGETS.totalCssWarnBytes) {
+  if (!isFrameworkBuildOutput && runtimeAudit.cssAssetBytes > PERFORMANCE_BUDGETS.totalCssWarnBytes) {
     findings.push(
       makeFinding({
         id: "runtime-css-bundle-large",
@@ -1996,7 +2270,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
       })
     );
   }
-  if (runtimeAudit.totalAssetBytes > PERFORMANCE_BUDGETS.totalAssetsWarnBytes) {
+  if (!isFrameworkBuildOutput && runtimeAudit.totalAssetBytes > PERFORMANCE_BUDGETS.totalAssetsWarnBytes) {
     findings.push(
       makeFinding({
         id: "runtime-total-assets-large",
@@ -2113,7 +2387,7 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       })
     );
   }
-  const navigation = essence && isV3(essence) ? essence.meta.navigation : null;
+  const navigation = essence && isV4(essence) ? essence.meta.navigation : null;
   if (navigation?.command_palette && sourceAudit.commandPaletteSignals.count === 0) {
     findings.push(
       makeFinding({
@@ -2341,7 +2615,11 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       })
     );
   }
-  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && sourceAudit.protectedSurfaceSignals.count > 0 && sourceAudit.authGuardSignals.count > 0 && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authGuardSignals) && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authSessionSignals)) {
+  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && sourceAudit.protectedSurfaceSignals.count > 0 && sourceAudit.authGuardSignals.count > 0 && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authGuardSignals) && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authSessionSignals) && !sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(
+    sourceAudit.protectedSurfaceSignals,
+    sourceAudit.authGuardSignals,
+    topology
+  )) {
     findings.push(
       makeFinding({
         id: "source-protected-surface-auth-checks-missing",
@@ -3209,10 +3487,11 @@ async function auditProject(projectRoot) {
           })
         );
       }
-    }
-    const { themeRegistry, patternRegistry } = buildRegistryContext(projectRoot);
-    for (const violation of evaluateGuard(essence, { themeRegistry, patternRegistry })) {
-      findings.push(guardViolationToFinding(violation));
+    } else {
+      const { themeRegistry, patternRegistry } = buildRegistryContext(projectRoot);
+      for (const violation of evaluateGuard(essence, { themeRegistry, patternRegistry })) {
+        findings.push(guardViolationToFinding(violation));
+      }
     }
   }
   appendTopologyFindings(findings, essence, reviewPack);
@@ -3329,7 +3608,9 @@ function buildDecoratorInventory(treatmentsCss) {
       decoratorNames.add(name);
     }
   }
-  return [...decoratorNames].filter((name) => !name.startsWith("d-") && !PERSONALITY_UTILS.includes(name));
+  return [...decoratorNames].filter(
+    (name) => !name.startsWith("d-") && !PERSONALITY_UTILS.includes(name)
+  );
 }
 function isCssClassNameChar(char) {
   const codePoint = char.charCodeAt(0);
@@ -4485,7 +4766,7 @@ function isHeaderClearValue(node) {
 }
 function countAuthGuardSignals(code) {
   const patterns = [
-    /\b(?:ProtectedRoute|AuthGuard|RequireAuth|withAuth|requireAuth|ensureAuth|useRequireAuth)\b/,
+    /\b(?:ProtectedRoute|AuthGuard|RequireAuth|withAuth|requireAuth|requireAdmin|ensureAuth|ensureAdmin|useRequireAuth)\b/,
     /\b(?:useAuth|useSession|getServerSession|authGuard|isAuthenticated|isSignedIn)\b/,
     /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)[^'"`]*['"`]/i,
     /\bNextResponse\.redirect\s*\(/,