@decantr/verifier 2.3.3 → 2.5.0

package/README.md

@@ -21,7 +21,8 @@ npm install @decantr/verifier
 - schema-backed report types for project audits, Project Health, Decantr CI reports, Evidence Bundles, Workspace Health, file critiques, and showcase verification
 - `ProjectHealthReport`, `ProjectHealthFinding`, and `ProjectHealthRemediation` types for the CLI's end-user health surface
 - interaction findings now include scanned file counts, file line ranges, and expected signal evidence where available, so CLI health/check output can point agents at source-grounded remediation
-- contract-only Brownfield critique avoids requiring Decantr treatments/decorators when the project keeps its own styling authority
+- contract-only and style-bridge Brownfield critique avoids requiring Decantr treatments/decorators when the project keeps its own styling authority
+- Decantr CI report schemas include accepted style bridge status, mapping count, styling approach, and theme modes alongside local-law findings
 - project audits check that `pack-manifest.json` references real pack markdown/JSON files on disk
 - project audits tolerate partial or malformed generated review packs without crashing Project Health, so half-attached Brownfield projects still receive actionable findings
 - Next.js static/document outputs are treated as framework-rendered documents instead of requiring a Vite-style `id="root"` mount element
@@ -67,6 +68,10 @@ function isBlocking(report: ProjectHealthReport) {
 - `@decantr/verifier/schema/file-critique-report.v1.json`
 - `@decantr/verifier/schema/showcase-shortlist-report.v1.json`
 
+## Security And Permissions
+
+The verifier is a local library. It reads selected project source, Decantr context, and built `dist`/`.next` output when callers request project or runtime audits. Built-output runtime audit starts a temporary loopback static server and fetches from that local server only; it does not contact external hosts. The verifier does not write files, spawn processes, emit telemetry, or upload source by itself. See [security permissions](https://decantr.ai/reference/security-permissions.md).
+
 ## Compatibility
 
 `@decantr/verifier` is stable in the `2.x` line for the documented verifier APIs and published report-schema exports.

package/dist/index.js

@@ -2648,20 +2648,20 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack, a
   if (sourceAudit.filesChecked === 0) {
     return;
   }
-  const isContractOnly = adoptionMode === "contract-only";
+  const isProjectOwnedStyling = adoptionMode === "contract-only" || adoptionMode === "style-bridge";
   if (sourceAudit.inlineStyles.count > 0) {
     findings.push(
       makeFinding({
         id: "source-inline-styles-present",
         category: "Source Audit",
         severity: "warn",
-        message: isContractOnly ? "Source files contain inline style attributes; contract-only projects should route static visual decisions through project-owned styling law." : "Source files still contain disallowed inline style attributes, which undermines the compiled treatment contract.",
+        message: isProjectOwnedStyling ? "Source files contain inline style attributes; project-owned styling projects should route static visual decisions through local law or the style bridge." : "Source files still contain disallowed inline style attributes, which undermines the compiled treatment contract.",
         evidence: buildSourceAuditEvidence(
           sourceAudit,
           sourceAudit.inlineStyles,
           "Disallowed inline style attributes"
         ),
-        suggestedFix: isContractOnly ? "Move static visual styling into the app design system, Tailwind/theme tokens, component variants, or accepted local rules. Keep inline style only for truly dynamic geometry." : "Move static visual styling into treatments, atoms, or design-token-backed classes. Inline style remains acceptable for Decantr CSS-variable writes and truly dynamic geometry."
+        suggestedFix: isProjectOwnedStyling ? "Move static visual styling into the app design system, Tailwind/theme tokens, component variants, or accepted local rules. Keep inline style only for truly dynamic geometry." : "Move static visual styling into treatments, atoms, or design-token-backed classes. Inline style remains acceptable for Decantr CSS-variable writes and truly dynamic geometry."
       })
     );
   }
@@ -2671,17 +2671,17 @@ function appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack, a
         id: "source-component-style-tags-present",
         category: "Source Audit",
         severity: "warn",
-        message: isContractOnly ? "Source files inject component-scoped style tags or dynamic style elements, which makes project-owned styling rules harder to enforce." : "Source files inject component-scoped style tags or dynamic style elements, which bypass the compiled Decantr layer contract.",
+        message: isProjectOwnedStyling ? "Source files inject component-scoped style tags or dynamic style elements, which makes project-owned styling rules harder to enforce." : "Source files inject component-scoped style tags or dynamic style elements, which bypass the compiled Decantr layer contract.",
         evidence: buildSourceAuditEvidence(
           sourceAudit,
           sourceAudit.componentStyleTags,
           "Component-level style tag signals"
         ),
-        suggestedFix: isContractOnly ? "Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest." : "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so styling stays inside the reviewed Decantr layer stack."
+        suggestedFix: isProjectOwnedStyling ? "Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest." : "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so styling stays inside the reviewed Decantr layer stack."
       })
     );
   }
-  if (!isContractOnly && sourceAudit.localCssRuntimeSignals.count > 0) {
+  if (!isProjectOwnedStyling && sourceAudit.localCssRuntimeSignals.count > 0) {
     findings.push(
       makeFinding({
         id: "source-local-css-runtime-stub-present",
@@ -3785,7 +3785,7 @@ async function auditProject(projectRoot) {
   const reviewPack = loadReviewPack(projectRoot);
   const packManifest = loadPackManifest(projectRoot);
   const adoptionMode = readProjectAdoptionMode(projectRoot);
-  const packHydrationOptional = adoptionMode === "contract-only";
+  const packHydrationOptional = adoptionMode === "contract-only" || adoptionMode === "style-bridge";
   const packHydrationSeverity = packHydrationOptional ? "info" : "warn";
   const runtimeAudit = emptyRuntimeAudit();
   if (!existsSync2(essencePath)) {
@@ -3865,7 +3865,7 @@ async function auditProject(projectRoot) {
         id: "pack-manifest-missing",
         category: "Execution Packs",
         severity: packHydrationSeverity,
-        message: packHydrationOptional ? "Compiled execution pack manifest is not hydrated yet; this is optional for contract-only Brownfield adoption." : "Compiled execution pack manifest is missing.",
+        message: packHydrationOptional ? "Compiled execution pack manifest is not hydrated yet; this is optional for contract-only/style-bridge Brownfield adoption." : "Compiled execution pack manifest is missing.",
         evidence: [join2(projectRoot, ".decantr", "context", "pack-manifest.json")],
         suggestedFix: packHydrationOptional ? "Optional: run `decantr registry compile-packs decantr.essence.json --write-context` when you want hosted page packs and review packs for richer assistant context." : "Run `decantr registry compile-packs decantr.essence.json --write-context` to hydrate scaffold, review, mutation, section, and page packs."
       })
@@ -3929,7 +3929,7 @@ async function auditProject(projectRoot) {
         id: "review-pack-file-missing",
         category: "Review Contract",
         severity: packHydrationSeverity,
-        message: packHydrationOptional ? "The compiled review pack file is not hydrated yet; contract-only Brownfield projects can continue without it." : "The compiled review pack file is missing.",
+        message: packHydrationOptional ? "The compiled review pack file is not hydrated yet; contract-only/style-bridge Brownfield projects can continue without it." : "The compiled review pack file is missing.",
         evidence: [join2(projectRoot, ".decantr", "context", "review-pack.json")],
         suggestedFix: packHydrationOptional ? "Optional: hydrate hosted packs later if you want critique consumers to anchor findings to the compiled review contract." : "Hydrate the full hosted context bundle with `decantr registry compile-packs decantr.essence.json --write-context` so critique consumers can anchor findings to the compiled review contract."
       })
@@ -10358,16 +10358,16 @@ function critiqueSource({
   const findings = [];
   const scores = [];
   const antiPatternIds = new Set(reviewPack?.antiPatterns.map((entry) => entry.id) ?? []);
-  const isContractOnly = adoptionMode === "contract-only";
+  const isProjectOwnedStyling = adoptionMode === "contract-only" || adoptionMode === "style-bridge";
   const usedTreatments = TREATMENT_CLASSES.filter((token) => code.includes(token));
-  if (isContractOnly) {
+  if (isProjectOwnedStyling) {
     scores.push({
       category: "Styling Authority",
       focusArea: "treatment-usage",
       score: 3,
-      details: "Contract-only adoption does not require Decantr d-* treatment classes in source files.",
+      details: "Contract-only/style-bridge adoption does not require Decantr d-* treatment classes in source files.",
       suggestions: [
-        "Codify project-owned component variants and local rules when button/card/surface drift needs mechanical enforcement."
+        "Codify project-owned component variants, local rules, or a style bridge when button/card/surface drift needs stronger enforcement."
       ]
     });
   } else {
@@ -10404,12 +10404,12 @@ function critiqueSource({
   const decoratorNames = buildDecoratorInventory(treatmentsCss);
   const usedDecorators = decoratorNames.filter((name) => code.includes(name));
   const usesCssVars = code.includes("var(--");
-  if (isContractOnly) {
+  if (isProjectOwnedStyling) {
     scores.push({
       category: "Theme Consistency",
       focusArea: "theme-consistency",
       score: usesCssVars ? 4 : 3,
-      details: `Contract-only mode: Decantr decorators are not required; CSS vars: ${usesCssVars ? "yes" : "no"}.`,
+      details: `Contract-only/style-bridge mode: Decantr decorators are not required; CSS vars: ${usesCssVars ? "yes" : "no"}.`,
       suggestions: [
         "Use the app design system, Tailwind theme, Sass variables, component variants, or accepted local rules as the styling authority."
       ]
@@ -11436,7 +11436,7 @@ function critiqueSource({
           `Disallowed inline style attributes: ${astSignals.inlineStyleAttributeCount}`
         ],
         file: filePath,
-        suggestedFix: isContractOnly ? "Replace static inline visual values with the project design system, accepted component variants, or local style rules. Keep inline style only for truly dynamic geometry." : "Replace static inline visual values with treatments, decorators, and CSS variables from the compiled contract. Keep inline style only for Decantr CSS-variable writes and truly dynamic geometry."
+        suggestedFix: isProjectOwnedStyling ? "Replace static inline visual values with the project design system, accepted component variants, or local style rules. Keep inline style only for truly dynamic geometry." : "Replace static inline visual values with treatments, decorators, and CSS variables from the compiled contract. Keep inline style only for Decantr CSS-variable writes and truly dynamic geometry."
       })
     );
   }
@@ -11453,7 +11453,7 @@ function critiqueSource({
         message: "Component-scoped style tags or dynamic style elements were detected in the reviewed file.",
         evidence: [filePath, `Component style tag signals: ${componentStyleTagSignals}`],
         file: filePath,
-        suggestedFix: isContractOnly ? "Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest." : "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so the file stays aligned with the Decantr layer contract."
+        suggestedFix: isProjectOwnedStyling ? "Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest." : "Move shared keyframes, media queries, and visual rules into global.css or treatments.css so the file stays aligned with the Decantr layer contract."
       })
     );
   }