@decantr/verifier 1.1.1 → 2.1.0

package/dist/index.js

@@ -1,12 +1,13 @@
 // src/index.ts
-import { existsSync as existsSync2, realpathSync, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { createHash } from "crypto";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync, statSync as statSync2 } from "fs";
 import { readFile } from "fs/promises";
-import { extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
-import { evaluateGuard, isV3, validateEssence } from "@decantr/essence-spec";
+import { basename, dirname, extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
+import { evaluateGuard, isV4, validateEssence } from "@decantr/essence-spec";
 import * as ts from "typescript";
 
 // src/runtime.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { createServer } from "http";
 import { extname, join, normalize } from "path";
 var CONTENT_TYPES = {
@@ -224,6 +225,122 @@ function countSecretLeakSignals(js) {
   ];
   return patterns.reduce((count, pattern) => count + (js.match(pattern)?.length ?? 0), 0);
 }
+function collectFiles(rootDir, predicate) {
+  if (!existsSync(rootDir)) return [];
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (entry.isFile() && predicate(path)) {
+        files.push(path);
+      }
+    }
+  };
+  walk(rootDir);
+  return files.sort();
+}
+function auditNextBuildOutput(projectRoot) {
+  const nextDir = join(projectRoot, ".next");
+  const buildIdPresent = existsSync(join(nextDir, "BUILD_ID"));
+  const buildManifestPresent = existsSync(join(nextDir, "build-manifest.json"));
+  const appServerDir = join(nextDir, "server", "app");
+  const htmlFiles = collectFiles(appServerDir, (filePath) => {
+    const relativePath = filePath.slice(appServerDir.length + 1).replace(/\\/g, "/");
+    return filePath.endsWith(".html") && !relativePath.startsWith("_");
+  });
+  const htmlDocuments = htmlFiles.map((filePath) => readFileSync(filePath, "utf-8"));
+  const staticAssetFiles = collectFiles(
+    join(nextDir, "static"),
+    (filePath) => /\.(?:js|css|json|svg|png|jpe?g|webp)$/i.test(filePath)
+  );
+  let totalAssetBytes = 0;
+  let jsAssetBytes = 0;
+  let cssAssetBytes = 0;
+  let largestAssetPath = null;
+  let largestAssetBytes = 0;
+  let combinedJs = "";
+  for (const assetFile of staticAssetFiles) {
+    const byteLength = statSync(assetFile).size;
+    const assetPath = `/_next/static/${assetFile.slice(join(nextDir, "static").length + 1).replace(/\\/g, "/")}`;
+    totalAssetBytes += byteLength;
+    if (assetFile.endsWith(".js")) {
+      jsAssetBytes += byteLength;
+      combinedJs += readFileSync(assetFile, "utf-8");
+    }
+    if (assetFile.endsWith(".css")) {
+      cssAssetBytes += byteLength;
+    }
+    if (byteLength > largestAssetBytes) {
+      largestAssetBytes = byteLength;
+      largestAssetPath = assetPath;
+    }
+  }
+  const hasHtmlDocuments = htmlDocuments.length > 0;
+  const titleOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<title>[^<]+<\/title>/i.test(html));
+  const langOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<html[^>]*\slang=(["'])[^"']+\1/i.test(html));
+  const viewportOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<meta[^>]+name=(["'])viewport\1[^>]*>/i.test(html));
+  const charsetOk = !hasHtmlDocuments || htmlDocuments.every((html) => /<meta[^>]+charset=/i.test(html));
+  const failures = ["next-build-output"];
+  if (!buildIdPresent) {
+    failures.push("next-build-id-missing");
+  }
+  if (!buildManifestPresent) {
+    failures.push("next-build-manifest-missing");
+  }
+  if (staticAssetFiles.length === 0) {
+    failures.push("next-assets-missing");
+  }
+  const passed = buildIdPresent && buildManifestPresent && staticAssetFiles.length > 0;
+  return {
+    distPresent: true,
+    indexPresent: true,
+    checked: true,
+    passed,
+    rootDocumentOk: hasHtmlDocuments || passed,
+    titleOk,
+    langOk,
+    viewportOk,
+    charsetOk,
+    cspSignalOk: true,
+    inlineScriptCount: 0,
+    inlineEventHandlerCount: 0,
+    externalScriptsWithoutIntegrityCount: 0,
+    externalScriptsWithIntegrityMissingCrossoriginCount: 0,
+    externalStylesheetsWithoutIntegrityCount: 0,
+    externalStylesheetsWithIntegrityMissingCrossoriginCount: 0,
+    externalScriptsWithInsecureTransportCount: 0,
+    externalStylesheetsWithInsecureTransportCount: 0,
+    externalMediaSourcesWithInsecureTransportCount: 0,
+    externalBlankLinksWithoutRelCount: 0,
+    externalIframesWithoutSandboxCount: 0,
+    externalIframesWithInsecureTransportCount: 0,
+    jsEvalSignalCount: countDynamicCodeSignals(combinedJs),
+    jsHtmlInjectionSignalCount: countHtmlInjectionSignals(combinedJs),
+    jsInsecureTransportSignalCount: countInsecureTransportSignals(combinedJs),
+    jsSecretSignalCount: countSecretLeakSignals(combinedJs),
+    assetCount: staticAssetFiles.length,
+    assetsPassed: staticAssetFiles.length,
+    routeHintsChecked: [],
+    routeHintsMatched: 0,
+    routeHintsCoverageOk: true,
+    routeDocumentsChecked: 0,
+    routeDocumentsPassed: 0,
+    routeDocumentsHardenedCount: 0,
+    routeDocumentsCoverageOk: true,
+    routeDocumentsHardeningOk: true,
+    fullRouteCoverageOk: true,
+    totalAssetBytes,
+    jsAssetBytes,
+    cssAssetBytes,
+    largestAssetPath,
+    largestAssetBytes,
+    failures
+  };
+}
 function normalizeRouteHint(route) {
   if (!route || route === "/") return "/";
   const dynamicIndex = route.indexOf("/:");
@@ -280,6 +397,9 @@ async function startStaticServer(rootDir) {
 async function auditBuiltDist(projectRoot, options = {}) {
   const distDir = options.distDir ?? join(projectRoot, "dist");
   if (!existsSync(distDir)) {
+    if (!options.distDir && existsSync(join(projectRoot, ".next"))) {
+      return auditNextBuildOutput(projectRoot);
+    }
     return emptyRuntimeAudit(["dist-missing"]);
   }
   const indexPath = join(distDir, "index.html");
@@ -611,9 +731,249 @@ var VERIFICATION_SCHEMA_URLS = {
   common: "https://decantr.ai/schemas/verification-report.common.v1.json",
   projectAudit: "https://decantr.ai/schemas/project-audit-report.v1.json",
   projectHealth: "https://decantr.ai/schemas/project-health-report.v1.json",
+  evidenceBundle: "https://decantr.ai/schemas/evidence-bundle.v1.json",
+  workspaceHealth: "https://decantr.ai/schemas/workspace-health-report.v1.json",
   fileCritique: "https://decantr.ai/schemas/file-critique-report.v1.json",
   showcaseShortlist: "https://decantr.ai/schemas/showcase-shortlist-report.v1.json"
 };
+var EVIDENCE_BUNDLE_SCHEMA_URL = "https://decantr.ai/schemas/evidence-bundle.v1.json";
+function hashString(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+function hashFile(path) {
+  if (!existsSync2(path)) return null;
+  try {
+    return createHash("sha256").update(readFileSync2(path)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function provenanceEntry(projectRoot, relativePath) {
+  const path = join2(projectRoot, relativePath);
+  if (!existsSync2(path)) {
+    return {
+      path: relativePath,
+      present: false,
+      hash: null,
+      generatedAt: null
+    };
+  }
+  let generatedAt = null;
+  try {
+    generatedAt = statSync2(path).mtime.toISOString();
+  } catch {
+    generatedAt = null;
+  }
+  return {
+    path: relativePath,
+    present: true,
+    hash: hashFile(path),
+    generatedAt
+  };
+}
+function provenanceForPath(projectRoot, path) {
+  const rel = isAbsolute(path) ? relative(projectRoot, path).replace(/\\/g, "/") : path;
+  return provenanceEntry(projectRoot, rel && !rel.startsWith("..") ? rel : basename(path));
+}
+function redactEvidenceText(projectRoot, value) {
+  const normalizedRoot = projectRoot.replace(/\\/g, "/");
+  const normalized = value.replace(/\\/g, "/");
+  if (normalized.includes(normalizedRoot)) {
+    return normalized.split(normalizedRoot).join("<project>");
+  }
+  return normalized.replace(/\/Users\/[^/\s]+/g, "~").replace(/\/home\/[^/\s]+/g, "~");
+}
+function redactEvidenceList(projectRoot, evidence) {
+  return evidence.map((entry) => redactEvidenceText(projectRoot, entry));
+}
+function assertion(input) {
+  return {
+    status: "passed",
+    ...input
+  };
+}
+function createContractAssertions(projectRoot, audit) {
+  const assertions = [];
+  const essence = audit?.essence;
+  const v4 = essence && isV4(essence) ? essence : null;
+  const contextDir = join2(projectRoot, ".decantr", "context");
+  const packManifest = audit?.packManifest ?? null;
+  assertions.push(
+    assertion({
+      id: "contract.essence.present",
+      category: "context",
+      severity: "error",
+      rule: "essence-present",
+      status: essence ? "passed" : "failed",
+      message: essence ? "Decantr Essence contract is present." : "No Decantr Essence contract was found.",
+      evidence: [redactEvidenceText(projectRoot, join2(projectRoot, "decantr.essence.json"))],
+      suggestedFix: essence ? void 0 : "Run `decantr init` or restore decantr.essence.json."
+    })
+  );
+  assertions.push(
+    assertion({
+      id: "contract.essence.v4",
+      category: "context",
+      severity: "error",
+      rule: "essence-v4",
+      status: v4 ? "passed" : essence ? "failed" : "not_applicable",
+      message: v4 ? "Essence uses the active v4.0.0 contract." : essence ? "Essence is not the active v4.0.0 contract." : "Essence version could not be checked.",
+      evidence: [essence ? `version=${String(essence.version)}` : "essence missing"],
+      suggestedFix: v4 ? void 0 : "Run `decantr migrate --to v4` before reliability checks."
+    })
+  );
+  if (v4) {
+    const declaredRoutes = Object.keys(v4.blueprint.routes ?? {}).sort();
+    for (const route of declaredRoutes) {
+      const routeTarget = (v4.blueprint.routes ?? {})[route];
+      const section = v4.blueprint.sections.find((entry) => entry.id === routeTarget.section);
+      const page = section?.pages.find((entry) => entry.id === routeTarget.page);
+      assertions.push(
+        assertion({
+          id: `contract.route.${hashString(route)}`,
+          category: "route",
+          severity: page ? "info" : "warn",
+          rule: "declared-route-resolves",
+          status: page ? "passed" : "failed",
+          target: route,
+          message: page ? `Declared route ${route} resolves to a section page.` : `Declared route ${route} does not resolve to an existing section page.`,
+          evidence: [`section=${routeTarget.section}`, `page=${routeTarget.page}`],
+          suggestedFix: page ? void 0 : "Update blueprint.routes or add the missing section/page before running AI repair."
+        })
+      );
+    }
+    for (const section of v4.blueprint.sections) {
+      assertions.push(
+        assertion({
+          id: `contract.shell.${section.id}`,
+          category: "shell",
+          severity: section.shell && section.shell !== "inherit" ? "info" : "warn",
+          rule: "section-shell-concrete",
+          status: section.shell && section.shell !== "inherit" ? "passed" : "failed",
+          target: section.id,
+          message: section.shell && section.shell !== "inherit" ? `Section ${section.id} uses concrete shell ${section.shell}.` : `Section ${section.id} does not declare a concrete shell.`,
+          evidence: [`shell=${section.shell || "missing"}`],
+          suggestedFix: section.shell && section.shell !== "inherit" ? void 0 : "Resolve inherited shells during composition so AI agents get concrete layout intent."
+        })
+      );
+    }
+    assertions.push(
+      assertion({
+        id: "contract.accessibility.focus-visible",
+        category: "accessibility",
+        severity: v4.dna.accessibility.focus_visible ? "info" : "warn",
+        rule: "focus-visible-enabled",
+        status: v4.dna.accessibility.focus_visible ? "passed" : "failed",
+        message: v4.dna.accessibility.focus_visible ? "DNA requires visible focus states." : "DNA does not require visible focus states.",
+        evidence: [`focus_visible=${String(v4.dna.accessibility.focus_visible)}`],
+        suggestedFix: v4.dna.accessibility.focus_visible ? void 0 : "Set dna.accessibility.focus_visible=true for stronger UI reliability gates."
+      })
+    );
+  }
+  assertions.push(
+    assertion({
+      id: "contract.context.pack-manifest",
+      category: "context",
+      severity: packManifest ? "info" : "warn",
+      rule: "pack-manifest-present",
+      status: packManifest ? "passed" : "failed",
+      message: packManifest ? "Compiled execution pack manifest is present." : "Compiled execution pack manifest is missing.",
+      evidence: [redactEvidenceText(projectRoot, join2(contextDir, "pack-manifest.json"))],
+      suggestedFix: packManifest ? void 0 : "Run `decantr refresh` to regenerate context packs."
+    })
+  );
+  assertions.push(
+    assertion({
+      id: "contract.context.review-pack",
+      category: "context",
+      severity: audit?.reviewPack ? "info" : "warn",
+      rule: "review-pack-present",
+      status: audit?.reviewPack ? "passed" : "failed",
+      message: audit?.reviewPack ? "Compiled review pack is present." : "Compiled review pack is missing.",
+      evidence: [redactEvidenceText(projectRoot, join2(contextDir, "review-pack.json"))],
+      suggestedFix: audit?.reviewPack ? void 0 : "Run `decantr refresh` or hydrate the review pack from the registry."
+    })
+  );
+  const tokensPath = join2(projectRoot, "src", "styles", "tokens.css");
+  assertions.push(
+    assertion({
+      id: "contract.design-token.tokens-file",
+      category: "design-token",
+      severity: existsSync2(tokensPath) ? "info" : "warn",
+      rule: "tokens-file-present",
+      status: existsSync2(tokensPath) ? "passed" : "failed",
+      message: existsSync2(tokensPath) ? "Decantr token CSS file is present." : "Decantr token CSS file was not found.",
+      evidence: [redactEvidenceText(projectRoot, tokensPath)],
+      suggestedFix: existsSync2(tokensPath) ? void 0 : "Run `decantr refresh` or map Decantr tokens into the existing styling system."
+    })
+  );
+  return assertions;
+}
+function createEvidenceBundle(input) {
+  const assertions = input.assertions ?? createContractAssertions(input.projectRoot, input.audit);
+  let resolvedProjectRoot = input.projectRoot;
+  try {
+    resolvedProjectRoot = realpathSync(input.projectRoot);
+  } catch {
+    resolvedProjectRoot = resolve(input.projectRoot);
+  }
+  const projectId = `project_${hashString(resolvedProjectRoot)}`;
+  return {
+    $schema: EVIDENCE_BUNDLE_SCHEMA_URL,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    project: {
+      id: projectId,
+      rootLabel: basename(input.projectRoot) || "project"
+    },
+    toolchain: {
+      verifierVersion: input.verifierVersion ?? null
+    },
+    privacy: {
+      localOnly: true,
+      redactedFields: [
+        "source",
+        "prompt",
+        "secret",
+        "environment",
+        "absolute_path",
+        "repository_name"
+      ],
+      screenshotsLocalOnly: true
+    },
+    health: {
+      status: input.report.status,
+      score: input.report.score,
+      errorCount: input.report.summary.errorCount,
+      warnCount: input.report.summary.warnCount,
+      infoCount: input.report.summary.infoCount,
+      findingCount: input.report.summary.findingCount
+    },
+    provenance: {
+      essence: provenanceEntry(input.projectRoot, "decantr.essence.json"),
+      packManifest: provenanceEntry(input.projectRoot, ".decantr/context/pack-manifest.json"),
+      reviewPack: provenanceEntry(input.projectRoot, ".decantr/context/review-pack.json"),
+      ...input.workspaceConfigPath ? { workspaceConfig: provenanceForPath(input.projectRoot, input.workspaceConfigPath) } : {},
+      ...input.designTokensPath ? { designTokens: provenanceForPath(input.projectRoot, input.designTokensPath) } : {}
+    },
+    assertions,
+    findings: input.report.findings.map((finding) => ({
+      id: finding.id,
+      source: finding.source,
+      category: finding.category,
+      severity: finding.severity,
+      message: redactEvidenceText(input.projectRoot, finding.message),
+      evidence: redactEvidenceList(input.projectRoot, finding.evidence),
+      target: finding.target ? redactEvidenceText(input.projectRoot, finding.target) : void 0,
+      rule: finding.rule,
+      suggestedFix: finding.suggestedFix,
+      remediationSummary: finding.remediation.summary,
+      commands: finding.remediation.commands,
+      promptCommand: `decantr health --prompt ${finding.id}`
+    })),
+    ...input.browser ? { browser: input.browser } : {},
+    ...input.designTokens ? { designTokens: input.designTokens } : {}
+  };
+}
 var DEFAULT_FOCUS_AREAS = [
   "route-topology",
   "theme-consistency",
@@ -686,6 +1046,54 @@ function recordSourceAudit(bucket, filePath, count) {
 function sourceAuditBucketsOverlap(a, b) {
   return a.files.some((file) => b.files.includes(file));
 }
+function normalizeSourceAuditPath(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+function getNextAppLayoutGuardRoot(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  const match = normalized.match(
+    /^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)\/layout\.[cm]?[jt]sx?$/i
+  );
+  return match?.[1] ?? null;
+}
+function getNextAppRouteRoot(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  const match = normalized.match(/^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)(?:\/|$)/i);
+  return match?.[1] ?? null;
+}
+function getRouteRoot(route) {
+  const firstSegment = route.replace(/^\/+/, "").split("/")[0];
+  if (!firstSegment || firstSegment.startsWith(":") || firstSegment.startsWith("[")) {
+    return null;
+  }
+  return firstSegment;
+}
+function isNextAppPublicChromeFile(filePath) {
+  const normalized = normalizeSourceAuditPath(filePath);
+  return /^(?:src\/)?app\/(?:\([^/]+\)\/)*(?:layout|nav|nav-header|navigation|header|footer|sidebar)\.[cm]?[jt]sx?$/i.test(
+    normalized
+  );
+}
+function sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(protectedSurfaces, authGuards, topology) {
+  const guardedRoots = /* @__PURE__ */ new Set();
+  for (const file of authGuards.files) {
+    const root = getNextAppLayoutGuardRoot(file);
+    if (root) {
+      guardedRoots.add(root);
+    }
+  }
+  if (guardedRoots.size === 0 || protectedSurfaces.files.length === 0) {
+    return false;
+  }
+  const guardedPrimaryRouteRoots = topology.primaryRoutes.map(getRouteRoot).filter((root) => Boolean(root)).filter((root) => guardedRoots.has(root));
+  return protectedSurfaces.files.every((file) => {
+    const appRoot = getNextAppRouteRoot(file);
+    if (appRoot && guardedRoots.has(appRoot)) {
+      return true;
+    }
+    return isNextAppPublicChromeFile(file) && guardedPrimaryRouteRoots.length > 0;
+  });
+}
 function isAuditableSourceFile(filePath) {
   if (/\.d\.ts$/i.test(filePath)) return false;
   return /\.(?:[cm]?[jt]sx?)$/i.test(filePath);
@@ -726,7 +1134,7 @@ function collectProjectSourceFiles(projectRoot) {
     "coverage"
   ]);
   const walk = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (ignoredDirNames.has(entry.name)) continue;
       const absolutePath = join2(dir, entry.name);
       if (entry.isDirectory()) {
@@ -770,7 +1178,7 @@ function collectProjectStyleFiles(projectRoot) {
     "coverage"
   ]);
   const walk = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (ignoredDirNames.has(entry.name)) continue;
       const absolutePath = join2(dir, entry.name);
       if (entry.isDirectory()) {
@@ -799,8 +1207,126 @@ function countReducedMotionSignals(code) {
   ];
   return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
 }
+function hasModuleDirective(filePath, code, directive) {
+  const sourceFile = ts.createSourceFile(
+    filePath,
+    code,
+    ts.ScriptTarget.Latest,
+    true,
+    getScriptKind(filePath)
+  );
+  for (const statement of sourceFile.statements) {
+    if (ts.isExpressionStatement(statement) && ts.isStringLiteralLike(statement.expression)) {
+      if (statement.expression.text === directive) {
+        return true;
+      }
+      continue;
+    }
+    break;
+  }
+  return false;
+}
+function importDeclarationHasRuntimeBinding(statement) {
+  const clause = statement.importClause;
+  if (!clause) return true;
+  if (clause.isTypeOnly) return false;
+  if (clause.name) return true;
+  if (!clause.namedBindings) return true;
+  if (ts.isNamespaceImport(clause.namedBindings)) return true;
+  return clause.namedBindings.elements.some((element) => !element.isTypeOnly);
+}
+function collectRuntimeImportSpecifiers(entry) {
+  const sourceFile = ts.createSourceFile(
+    entry.relativePath,
+    entry.code,
+    ts.ScriptTarget.Latest,
+    true,
+    getScriptKind(entry.relativePath)
+  );
+  const specifiers = [];
+  for (const statement of sourceFile.statements) {
+    if (ts.isImportDeclaration(statement) && ts.isStringLiteralLike(statement.moduleSpecifier) && importDeclarationHasRuntimeBinding(statement)) {
+      specifiers.push(statement.moduleSpecifier.text);
+    }
+  }
+  return specifiers;
+}
+function resolveSourceImportTarget(projectRoot, sourceAbsolutePath, specifier) {
+  let basePath = null;
+  if (specifier.startsWith("@/")) {
+    basePath = join2(projectRoot, "src", specifier.slice(2));
+  } else if (specifier.startsWith("./") || specifier.startsWith("../")) {
+    basePath = resolve(dirname(sourceAbsolutePath), specifier);
+  }
+  if (!basePath) return null;
+  const candidates = [
+    basePath,
+    `${basePath}.ts`,
+    `${basePath}.tsx`,
+    `${basePath}.js`,
+    `${basePath}.jsx`,
+    `${basePath}.mts`,
+    `${basePath}.cts`,
+    join2(basePath, "index.ts"),
+    join2(basePath, "index.tsx"),
+    join2(basePath, "index.js"),
+    join2(basePath, "index.jsx")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync2(candidate) && isAuditableSourceFile(candidate)) {
+      return relative(projectRoot, candidate) || candidate;
+    }
+  }
+  return null;
+}
+function collectClientReachableSourceFiles(projectRoot, entries) {
+  const entriesByRelativePath = new Map(entries.map((entry) => [entry.relativePath, entry]));
+  const runtimeImportGraph = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const targets = collectRuntimeImportSpecifiers(entry).map((specifier) => resolveSourceImportTarget(projectRoot, entry.absolutePath, specifier)).filter((target) => Boolean(target));
+    runtimeImportGraph.set(entry.relativePath, targets);
+  }
+  const reachable = /* @__PURE__ */ new Set();
+  const queue = entries.filter((entry) => hasModuleDirective(entry.relativePath, entry.code, "use client")).map((entry) => entry.relativePath);
+  for (const root of queue) {
+    reachable.add(root);
+  }
+  while (queue.length > 0) {
+    const current = queue.shift();
+    for (const target of runtimeImportGraph.get(current) ?? []) {
+      const targetEntry = entriesByRelativePath.get(target);
+      if (targetEntry && hasModuleDirective(target, targetEntry.code, "use server")) {
+        continue;
+      }
+      if (!reachable.has(target)) {
+        reachable.add(target);
+        queue.push(target);
+      }
+    }
+  }
+  return reachable;
+}
+function isClientAuthHeaderSource(relativePath, code, clientReachableFiles) {
+  if (hasModuleDirective(relativePath, code, "use server")) {
+    return false;
+  }
+  if (clientReachableFiles.has(relativePath)) {
+    return true;
+  }
+  const normalized = normalizeSourceAuditPath(relativePath);
+  if (/^(?:src\/)?app\//i.test(normalized)) {
+    return false;
+  }
+  return /(?:^|\/)(?:components|routes|pages|hooks|providers)\//i.test(normalized);
+}
 function auditProjectSourceTree(projectRoot) {
   const sourceFiles = collectProjectSourceFiles(projectRoot);
+  const sourceEntries = sourceFiles.map((sourceFile) => ({
+    absolutePath: sourceFile,
+    relativePath: relative(projectRoot, sourceFile) || sourceFile,
+    code: readFileSync2(sourceFile, "utf-8")
+  }));
+  const clientReachableFiles = collectClientReachableSourceFiles(projectRoot, sourceEntries);
   const summary = {
     filesChecked: sourceFiles.length,
     inlineStyles: createSourceAuditBucket(),
@@ -869,10 +1395,13 @@ function auditProjectSourceTree(projectRoot) {
     interactionSafetyIssues: createSourceAuditBucket(),
     authInputHintIssues: createSourceAuditBucket()
   };
-  for (const sourceFile of sourceFiles) {
-    const relativePath = relative(projectRoot, sourceFile) || sourceFile;
-    const code = readFileSync2(sourceFile, "utf-8");
+  for (const { relativePath, code } of sourceEntries) {
     const signals = analyzeAstSignals(relativePath, code);
+    const isClientAuthHeaderSourceFile = isClientAuthHeaderSource(
+      relativePath,
+      code,
+      clientReachableFiles
+    );
     const accessibilityIssueCount = signals.iconOnlyButtonWithoutLabelCount + signals.iconOnlyLinkWithoutLabelCount + signals.clickableNonSemanticCount + signals.unlabeledNavigationLandmarkCount + signals.imageWithoutAltCount + signals.iframeWithoutTitleCount + signals.dialogWithoutLabelCount + signals.dialogWithoutModalHintCount + signals.tableWithoutHeaderCount + signals.tableWithoutCaptionCount + signals.formControlWithoutLabelCount;
     const securityRiskPatternCount = signals.dangerousHtmlCount + signals.rawHtmlInjectionCount + signals.dynamicEvalCount + signals.hardcodedSecretSignalCount + signals.clientSecretEnvReferenceCount + signals.localhostEndpointCount + signals.wildcardPostMessageCount + signals.windowOpenWithoutNoopenerCount + signals.externalIframeWithoutSandboxCount + signals.insecureExternalIframeCount + signals.insecureFormActionCount + signals.insecureAuthFormMethodCount + signals.insecureTransportEndpointCount + signals.insecureExternalImageCount + signals.authCookieMissingHardeningCount + signals.authOpenRedirectSignalCount + signals.authExternalRedirectSignalCount + signals.authProviderStateMissingCount + signals.authProviderPkceMissingCount + signals.authProviderNonceMissingCount + signals.externalBlankLinkWithoutRelCount;
     const authInputHintIssueCount = signals.emailAutocompleteMissingCount + signals.passwordAutocompleteMissingCount + signals.otpAutocompleteMissingCount + signals.authAutocompleteDisabledCount + signals.authAutocompleteSemanticMismatchCount + signals.authInputTypeMismatchCount;
@@ -1042,8 +1571,16 @@ function auditProjectSourceTree(projectRoot) {
     recordSourceAudit(summary.authStorageClears, relativePath, signals.authStorageClearCount);
     recordSourceAudit(summary.authCookieWrites, relativePath, signals.authCookieWriteCount);
     recordSourceAudit(summary.authCookieClears, relativePath, signals.authCookieClearCount);
-    recordSourceAudit(summary.authHeaderWrites, relativePath, signals.authHeaderWriteCount);
-    recordSourceAudit(summary.authHeaderClears, relativePath, signals.authHeaderClearCount);
+    recordSourceAudit(
+      summary.authHeaderWrites,
+      relativePath,
+      isClientAuthHeaderSourceFile ? signals.authHeaderWriteCount : 0
+    );
+    recordSourceAudit(
+      summary.authHeaderClears,
+      relativePath,
+      isClientAuthHeaderSourceFile ? signals.authHeaderClearCount : 0
+    );
     recordSourceAudit(summary.authCacheClients, relativePath, signals.authCacheClientCount);
     recordSourceAudit(summary.authCacheClears, relativePath, signals.authCacheClearCount);
     recordSourceAudit(summary.authRefreshSignals, relativePath, signals.authRefreshSignalCount);
@@ -1115,7 +1652,7 @@ function buildRegistryContext(projectRoot) {
   const cachedThemesDir = join2(cacheDir, "@official", "themes");
   try {
     if (existsSync2(cachedThemesDir)) {
-      for (const file of readdirSync(cachedThemesDir).filter(
+      for (const file of readdirSync2(cachedThemesDir).filter(
         (name) => name.endsWith(".json") && name !== "index.json"
       )) {
         const data = JSON.parse(readFileSync2(join2(cachedThemesDir, file), "utf-8"));
@@ -1129,7 +1666,7 @@ function buildRegistryContext(projectRoot) {
   const customThemesDir = join2(customDir, "themes");
   try {
     if (existsSync2(customThemesDir)) {
-      for (const file of readdirSync(customThemesDir).filter((name) => name.endsWith(".json"))) {
+      for (const file of readdirSync2(customThemesDir).filter((name) => name.endsWith(".json"))) {
         const data = JSON.parse(readFileSync2(join2(customThemesDir, file), "utf-8"));
         if (data.id) {
           themeRegistry.set(`custom:${data.id}`, { modes: data.modes || ["light", "dark"] });
@@ -1141,7 +1678,7 @@ function buildRegistryContext(projectRoot) {
   const cachedPatternsDir = join2(cacheDir, "@official", "patterns");
   try {
     if (existsSync2(cachedPatternsDir)) {
-      for (const file of readdirSync(cachedPatternsDir).filter(
+      for (const file of readdirSync2(cachedPatternsDir).filter(
         (name) => name.endsWith(".json") && name !== "index.json"
       )) {
         const data = JSON.parse(readFileSync2(join2(cachedPatternsDir, file), "utf-8"));
@@ -1167,17 +1704,13 @@ function guardViolationToFinding(violation) {
 }
 function countPages(essence) {
   if (!essence) return 0;
-  if (isV3(essence)) {
-    const v3 = essence;
-    if (v3.blueprint.sections?.length) {
-      return v3.blueprint.sections.reduce((sum, section) => sum + section.pages.length, 0);
-    }
-    return v3.blueprint.pages?.length ?? 0;
-  }
-  if ("structure" in essence && Array.isArray(essence.structure)) {
-    return essence.structure.length;
-  }
-  return 0;
+  const blueprint = essence.blueprint;
+  const sectionPages = Array.isArray(blueprint.sections) ? blueprint.sections.reduce(
+    (sum, section) => sum + (Array.isArray(section.pages) ? section.pages.length : 0),
+    0
+  ) : 0;
+  const flatPages = Array.isArray(blueprint.pages) ? blueprint.pages.length : 0;
+  return sectionPages + flatPages;
 }
 function makeFinding(input) {
   return input;
@@ -1252,31 +1785,19 @@ function extractRouteHintsFromEssence(essence) {
     return ["/"];
   }
   const routes = /* @__PURE__ */ new Set(["/"]);
-  if (isV3(essence)) {
-    const v3 = essence;
-    for (const section of v3.blueprint.sections ?? []) {
-      for (const page of section.pages ?? []) {
+  if (isV4(essence)) {
+    for (const section of essence.blueprint.sections) {
+      for (const page of section.pages) {
         if (typeof page.route === "string" && page.route.length > 0) {
           routes.add(normalizeRouteHint2(page.route));
         }
       }
     }
-    for (const page of v3.blueprint.pages ?? []) {
-      if (typeof page.route === "string" && page.route.length > 0) {
-        routes.add(normalizeRouteHint2(page.route));
-      }
-    }
-    if (v3.blueprint.routes && typeof v3.blueprint.routes === "object") {
-      for (const route of Object.keys(v3.blueprint.routes)) {
+    if (essence.blueprint.routes && typeof essence.blueprint.routes === "object") {
+      for (const route of Object.keys(essence.blueprint.routes)) {
         routes.add(normalizeRouteHint2(route));
       }
     }
-  } else if ("structure" in essence && Array.isArray(essence.structure)) {
-    for (const page of essence.structure) {
-      if (page && typeof page === "object" && "route" in page && typeof page.route === "string" && page.route.length > 0) {
-        routes.add(normalizeRouteHint2(page.route));
-      }
-    }
   }
   return [...routes].filter(Boolean).slice(0, 8);
 }
@@ -1288,14 +1809,13 @@ function summarizeTopology(essence, reviewPack) {
   let gatewayRouteCount = 0;
   let primaryRouteCount = 0;
   let hasAnonymousEntryRoute = false;
-  if (essence && isV3(essence)) {
-    const v3 = essence;
-    for (const feature of v3.blueprint.features ?? []) {
+  if (essence && isV4(essence)) {
+    for (const feature of essence.blueprint.features ?? []) {
       if (typeof feature === "string" && feature.length > 0) {
         features.add(feature);
       }
     }
-    for (const section of v3.blueprint.sections ?? []) {
+    for (const section of essence.blueprint.sections ?? []) {
       const role = typeof section.role === "string" && section.role.length > 0 ? section.role : "unknown";
       sectionRoles.add(role);
       for (const page of section.pages ?? []) {
@@ -1472,6 +1992,7 @@ function extractFailedRouteDocumentHardening(runtimeAudit) {
 function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topology, sourceAudit) {
   const distPath = join2(projectRoot, "dist");
   const indexPath = join2(distPath, "index.html");
+  const isFrameworkBuildOutput = runtimeAudit.failures.includes("next-build-output");
   if (!runtimeAudit.distPresent) {
     findings.push(
       makeFinding({
@@ -1966,7 +2487,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
     }
   }
   const largestIsJs = typeof runtimeAudit.largestAssetPath === "string" && runtimeAudit.largestAssetPath.endsWith(".js");
-  if (largestIsJs && runtimeAudit.largestAssetBytes > PERFORMANCE_BUDGETS.largestJsAssetWarnBytes || runtimeAudit.jsAssetBytes > PERFORMANCE_BUDGETS.totalJsWarnBytes) {
+  if (!isFrameworkBuildOutput && (largestIsJs && runtimeAudit.largestAssetBytes > PERFORMANCE_BUDGETS.largestJsAssetWarnBytes || runtimeAudit.jsAssetBytes > PERFORMANCE_BUDGETS.totalJsWarnBytes)) {
     findings.push(
       makeFinding({
         id: "runtime-js-bundle-large",
@@ -1981,7 +2502,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
       })
     );
   }
-  if (runtimeAudit.cssAssetBytes > PERFORMANCE_BUDGETS.totalCssWarnBytes) {
+  if (!isFrameworkBuildOutput && runtimeAudit.cssAssetBytes > PERFORMANCE_BUDGETS.totalCssWarnBytes) {
     findings.push(
       makeFinding({
         id: "runtime-css-bundle-large",
@@ -1996,7 +2517,7 @@ function appendRuntimeAuditFindings(findings, runtimeAudit, projectRoot, topolog
       })
     );
   }
-  if (runtimeAudit.totalAssetBytes > PERFORMANCE_BUDGETS.totalAssetsWarnBytes) {
+  if (!isFrameworkBuildOutput && runtimeAudit.totalAssetBytes > PERFORMANCE_BUDGETS.totalAssetsWarnBytes) {
     findings.push(
       makeFinding({
         id: "runtime-total-assets-large",
@@ -2113,7 +2634,7 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       })
     );
   }
-  const navigation = essence && isV3(essence) ? essence.meta.navigation : null;
+  const navigation = essence && isV4(essence) ? essence.meta.navigation : null;
   if (navigation?.command_palette && sourceAudit.commandPaletteSignals.count === 0) {
     findings.push(
       makeFinding({
@@ -2341,7 +2862,11 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack) {
       })
     );
   }
-  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && sourceAudit.protectedSurfaceSignals.count > 0 && sourceAudit.authGuardSignals.count > 0 && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authGuardSignals) && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authSessionSignals)) {
+  if (topology.hasAuthFeature && topology.primaryRoutes.length > 0 && sourceAudit.protectedSurfaceSignals.count > 0 && sourceAudit.authGuardSignals.count > 0 && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authGuardSignals) && !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authSessionSignals) && !sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(
+    sourceAudit.protectedSurfaceSignals,
+    sourceAudit.authGuardSignals,
+    topology
+  )) {
     findings.push(
       makeFinding({
         id: "source-protected-surface-auth-checks-missing",
@@ -3209,10 +3734,11 @@ async function auditProject(projectRoot) {
           })
         );
       }
-    }
-    const { themeRegistry, patternRegistry } = buildRegistryContext(projectRoot);
-    for (const violation of evaluateGuard(essence, { themeRegistry, patternRegistry })) {
-      findings.push(guardViolationToFinding(violation));
+    } else {
+      const { themeRegistry, patternRegistry } = buildRegistryContext(projectRoot);
+      for (const violation of evaluateGuard(essence, { themeRegistry, patternRegistry })) {
+        findings.push(guardViolationToFinding(violation));
+      }
     }
   }
   appendTopologyFindings(findings, essence, reviewPack);
@@ -3329,7 +3855,9 @@ function buildDecoratorInventory(treatmentsCss) {
       decoratorNames.add(name);
     }
   }
-  return [...decoratorNames].filter((name) => !name.startsWith("d-") && !PERSONALITY_UTILS.includes(name));
+  return [...decoratorNames].filter(
+    (name) => !name.startsWith("d-") && !PERSONALITY_UTILS.includes(name)
+  );
 }
 function isCssClassNameChar(char) {
   const codePoint = char.charCodeAt(0);
@@ -3603,6 +4131,23 @@ function isNavigationLandmark(tagName, attributes) {
 function hasNavigationLabel(attributes) {
   return Boolean(getJsxAttribute(attributes, "aria-label", "aria-labelledby", "title"));
 }
+function getJsxAttributeOwner(attribute) {
+  const attributes = attribute.parent;
+  if (!attributes || !ts.isJsxAttributes(attributes)) return null;
+  const owner = attributes.parent;
+  if (ts.isJsxOpeningElement(owner) || ts.isJsxSelfClosingElement(owner)) {
+    return owner;
+  }
+  return null;
+}
+function isSafeJsonLdDangerouslySetInnerHtml(attribute) {
+  const owner = getJsxAttributeOwner(attribute);
+  if (!owner || getJsxTagName(owner) !== "script") return false;
+  const typeValue = getJsxAttributeLiteralValue(getJsxAttribute(owner.attributes, "type"))?.trim().toLowerCase();
+  if (typeValue !== "application/ld+json") return false;
+  const sourceText = attribute.getText();
+  return /\bJSON\.stringify\s*\(/.test(sourceText) && /\\u003c/i.test(sourceText);
+}
 function hasInsecureFormAction(attributes) {
   const actionValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, "action"));
   const normalized = actionValue?.trim().toLowerCase() ?? "";
@@ -4485,7 +5030,7 @@ function isHeaderClearValue(node) {
 }
 function countAuthGuardSignals(code) {
   const patterns = [
-    /\b(?:ProtectedRoute|AuthGuard|RequireAuth|withAuth|requireAuth|ensureAuth|useRequireAuth)\b/,
+    /\b(?:ProtectedRoute|AuthGuard|RequireAuth|withAuth|requireAuth|requireAdmin|ensureAuth|ensureAdmin|useRequireAuth)\b/,
     /\b(?:useAuth|useSession|getServerSession|authGuard|isAuthenticated|isSignedIn)\b/,
     /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)[^'"`]*['"`]/i,
     /\bNextResponse\.redirect\s*\(/,
@@ -9125,7 +9670,7 @@ function analyzeAstSignals(filePath, code) {
           signals.inlineStyleAttributeCount += 1;
         }
       }
-      if (isPropertyNamed(node.name, "dangerouslySetInnerHTML")) {
+      if (isPropertyNamed(node.name, "dangerouslySetInnerHTML") && !isSafeJsonLdDangerouslySetInnerHtml(node)) {
         signals.dangerousHtmlCount += 1;
       }
       if (isPropertyNamed(node.name, "href", "to") && node.initializer && ts.isJsxExpression(node.initializer) && expressionContainsOpenRedirectSource(
@@ -10755,10 +11300,7 @@ function critiqueSource({
       })
     );
   }
-  const dangerousHtmlCount = Math.max(
-    astSignals.dangerousHtmlCount,
-    /dangerouslySetInnerHTML\s*=/.test(code) ? 1 : 0
-  );
+  const dangerousHtmlCount = astSignals.dangerousHtmlCount;
   const rawHtmlInjectionCount = Math.max(
     astSignals.rawHtmlInjectionCount,
     /\binnerHTML\s*=|\binsertAdjacentHTML\s*\(|\bdocument\.write\s*\(/.test(code) ? 1 : 0
@@ -11385,10 +11927,13 @@ async function critiqueFile(filePath, projectRoot) {
   });
 }
 export {
+  EVIDENCE_BUNDLE_SCHEMA_URL,
   INTERACTION_SIGNALS,
   VERIFICATION_SCHEMA_URLS,
   auditBuiltDist,
   auditProject,
+  createContractAssertions,
+  createEvidenceBundle,
   critiqueFile,
   critiqueSource,
   emptyRuntimeAudit,