@decantr/verifier 3.1.0 → 3.4.1

package/README.md

@@ -85,18 +85,24 @@ function isBlocking(report: ProjectHealthReport) {
 - `@decantr/verifier/schema/project-health-report.v1.json`
 - `@decantr/verifier/schema/decantr-ci-report.v1.json`
 - `@decantr/verifier/schema/evidence-bundle.v1.json`
+- `@decantr/verifier/schema/evidence-bundle.v2.json`
+- `@decantr/verifier/schema/runtime-probe-payload.v2.json`
 - `@decantr/verifier/schema/scan-report.v1.json`
 - `@decantr/verifier/schema/workspace-health-report.v1.json`
 - `@decantr/verifier/schema/file-critique-report.v1.json`
 - `@decantr/verifier/schema/showcase-shortlist-report.v1.json`
 
+The v2 schema assets support the Decantr 3 proof-train dashboard and runtime probe lanes.
+
+v1 schemas remain the active emitted contracts until a command explicitly changes its `$schema` URL. See [Report Schemas](https://decantr.ai/reference/report-schemas.md).
+
 ## Security And Permissions
 
 The verifier is a local library. It reads selected project source, Decantr context, read-only scan files, and built `dist`/`.next` output when callers request project or runtime audits. `scanProject()` returns relative evidence and does not write artifacts, install dependencies, build projects, execute scripts, or open pull requests. `probePublishedSite()` fetches HTML metadata over HTTP(S) only and does not execute JavaScript or capture screenshots. Built-output runtime audit starts a temporary loopback static server and fetches from that local server. The verifier does not write files, spawn processes, emit telemetry, or upload source by itself. See [security permissions](https://decantr.ai/reference/security-permissions.md).
 
 ## Compatibility
 
-`@decantr/verifier` is stable in the `2.x` line for the documented verifier APIs and published report-schema exports.
+`@decantr/verifier` is stable in the Decantr 3 line for the documented verifier APIs and published report-schema assets.
 
 - new checks and additive report fields may appear in compatible releases
 - breaking report-shape or exported API changes require a major version

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { ReviewExecutionPack } from '@decantr/core';
 import { EssenceFile } from '@decantr/essence-spec';
+import * as ts from 'typescript';
 
 interface VerificationRepairAction {
     id: string;
@@ -41,6 +42,16 @@ declare const KNOWN_VERIFICATION_DIAGNOSTICS: readonly [{
     readonly code: "VISUAL003";
     readonly repairId: "fix-route-render";
     readonly family: "VISUAL";
+}, {
+    readonly rule: "browser-runtime-probes-failed";
+    readonly code: "RUNTIME010";
+    readonly repairId: "repair-browser-runtime-probes";
+    readonly family: "RUNTIME";
+}, {
+    readonly rule: "browser-axe-violations";
+    readonly code: "A11Y020";
+    readonly repairId: "fix-rendered-accessibility";
+    readonly family: "A11Y";
 }, {
     readonly rule: "visual-baseline-screenshot-drift";
     readonly code: "VISUAL010";
@@ -593,6 +604,126 @@ declare function probePublishedSite(url: string, options?: {
 }): Promise<PublishedSiteProbeV1>;
 declare function resolveGitHubScanInput(input: string): GitHubScanInputResolution;
 
+type SourceStringLiteralContext = 'import-specifier' | 'export-specifier' | 'require-specifier' | 'dynamic-import-specifier' | 'jsx-attribute' | 'property-name' | 'string-literal' | 'template-literal';
+interface SourceLocation {
+    file: string;
+    line: number;
+    column: number;
+}
+interface SourceStringLiteral {
+    value: string;
+    rawText: string;
+    context: SourceStringLiteralContext;
+    location: SourceLocation;
+    attributeName?: string;
+}
+interface ExtractSourceStringLiteralOptions {
+    includeImportSpecifiers?: boolean;
+    includeObjectPropertyNames?: boolean;
+}
+declare function sourceLocationForNode(sourceFile: ts.SourceFile, node: ts.Node): SourceLocation;
+declare function extractSourceStringLiterals(sourceFile: ts.SourceFile, options?: ExtractSourceStringLiteralOptions): SourceStringLiteral[];
+
+type ProjectSourceLanguage = 'typescript' | 'javascript';
+type ProjectSourceKind = 'ts' | 'tsx' | 'mts' | 'cts' | 'js' | 'jsx' | 'mjs' | 'cjs';
+type SourceInventorySkipReason = 'ignored-directory' | 'ignored-file' | 'oversized' | 'symlink' | 'walk-limit';
+interface SourceInventorySkippedPath {
+    path: string;
+    reason: SourceInventorySkipReason;
+}
+interface ProjectSourceFile {
+    absolutePath: string;
+    relativePath: string;
+    extension: string;
+    kind: ProjectSourceKind;
+    language: ProjectSourceLanguage;
+    scriptKind: ts.ScriptKind;
+    jsx: boolean;
+    sizeBytes: number;
+}
+interface SourceInventoryOptions {
+    roots?: readonly string[];
+    extensions?: readonly string[];
+    includeTests?: boolean;
+    includeFixtures?: boolean;
+    maxFiles?: number;
+    maxFileSizeBytes?: number;
+}
+interface SourceInventory {
+    projectRoot: string;
+    files: ProjectSourceFile[];
+    skipped: SourceInventorySkippedPath[];
+    hasTypeScript: boolean;
+    hasJavaScript: boolean;
+    primaryLanguage: ProjectSourceLanguage | 'mixed' | 'unknown';
+}
+declare function normalizeSourcePath(path: string): string;
+declare function isPathInsideProject(projectRoot: string, absolutePath: string): boolean;
+declare function isSupportedSourceExtension(extension: string, extensions?: readonly string[]): boolean;
+declare function sourceKindFromPath(path: string): ProjectSourceKind | null;
+declare function sourceScriptKindFromPath(path: string): ts.ScriptKind;
+declare function sourceLanguageFromPath(path: string): ProjectSourceLanguage | null;
+declare function createSourceInventory(projectRoot: string, options?: SourceInventoryOptions): SourceInventory;
+
+type SourceImportKind = 'static-import' | 're-export' | 'require' | 'dynamic-import' | 'import-equals';
+type SourceImportResolutionKind = 'project-local' | 'external' | 'unresolved';
+interface SourceImportResolution {
+    source: string;
+    importer: string;
+    kind: SourceImportResolutionKind;
+    resolvedFileName: string | null;
+    relativePath: string | null;
+    extension: string | null;
+    isProjectLocal: boolean;
+    isExternal: boolean;
+    failed: boolean;
+}
+interface SourceImportReference {
+    file: string;
+    source: string;
+    kind: SourceImportKind;
+    line: number;
+    column: number;
+    defaultImport?: string;
+    namespaceImport?: string;
+    imported: string[];
+    localNames: string[];
+    typeOnly: boolean;
+    resolved: SourceImportResolution;
+}
+interface ProjectSourceProgramOptions extends SourceInventoryOptions {
+    tsconfigPath?: string | null;
+    compilerOptions?: ts.CompilerOptions;
+}
+interface ProjectSourceProgram {
+    projectRoot: string;
+    tsconfigPath: string | null;
+    inventory: SourceInventory;
+    program: ts.Program;
+    compilerOptions: ts.CompilerOptions;
+    diagnostics: readonly ts.Diagnostic[];
+}
+interface ResolveSourceSymbolOriginOptions {
+    position?: number;
+    includeExternal?: boolean;
+}
+interface SourceSymbolOrigin {
+    name: string;
+    localName: string;
+    file: string;
+    absolutePath: string;
+    location: SourceLocation;
+    declarationKind: string;
+    importedFrom?: string;
+    importSource?: string;
+    isProjectLocal: boolean;
+}
+declare function createProjectSourceProgram(projectRoot: string, options?: ProjectSourceProgramOptions): ProjectSourceProgram;
+declare function getProjectSourceFile(context: ProjectSourceProgram, pathOrSourceFile: string | ts.SourceFile): ts.SourceFile | undefined;
+declare function resolveSourceImport(context: ProjectSourceProgram, importer: string | ts.SourceFile, source: string): SourceImportResolution;
+declare function collectSourceImports(context: ProjectSourceProgram, pathOrSourceFile: string | ts.SourceFile): SourceImportReference[];
+declare function resolveSourceSymbolOrigin(context: ProjectSourceProgram, pathOrSourceFile: string | ts.SourceFile, localName: string, options?: ResolveSourceSymbolOriginOptions): SourceSymbolOrigin | null;
+
 declare const STYLE_BRIDGE_ARBITRARY_VALUE_RULE_ID = "style-bridge-arbitrary-value";
 interface StyleBridgeDriftFinding {
     id: string;
@@ -603,6 +734,8 @@ interface StyleBridgeDriftFinding {
     source: 'className' | 'inline-style' | 'stylesheet';
     property?: string;
     bridgeMappingIds: string[];
+    bridgeConfidence: number | null;
+    bridgeSources: string[];
     tokenHints: string[];
     classHints: string[];
     evidence: string[];
@@ -1029,4 +1162,4 @@ declare function auditProject(projectRoot: string): Promise<ProjectAuditReport>;
 declare function critiqueSource({ filePath, code, reviewPack, packManifest, treatmentsCss, adoptionMode, }: CritiqueSourceInput): FileCritiqueReport;
 declare function critiqueFile(filePath: string, projectRoot: string): Promise<FileCritiqueReport>;
 
-export { type BuiltDistAuditOptions, COMPONENT_REUSE_RULE_ID, type CodeComponentDeclaration, type CodeImportReference, type ComponentReuseAudit, type ComponentReuseFinding, type ContractAssertion, type ContractAssertionCategory, type CritiqueSourceInput, EVIDENCE_BUNDLE_SCHEMA_URL, type EvidenceBundle, type EvidenceBundleInput, type EvidenceProvenanceEntry, type EvidenceRepairPlan, type EvidenceRepairPlanAction, type FileCritiqueReport, type GitHubScanInputResolution, type GraphAnchorEdge, type GraphAnchorFindingInput, type GraphAnchorNode, type GraphAnchorSnapshot, INTERACTION_SIGNALS, type InteractionMissingFinding, type InteractionRequirement, type InteractionSignal, KNOWN_VERIFICATION_DIAGNOSTICS, type MissingPackManifestFile, type PackManifest, type ProjectAuditReport, type ProjectHealthFinding, type ProjectHealthFindingSource, type ProjectHealthGraphSummary, type ProjectHealthPackSummary, type ProjectHealthRemediation, type ProjectHealthReport, type ProjectHealthRouteSummary, type ProjectHealthStatus, type PublishedSiteProbeV1, RAW_CONTROL_REUSE_RULE_ID, type RawControlReuseFinding, type RuntimeAudit, SCAN_REPORT_SCHEMA_URL, STYLE_BRIDGE_ARBITRARY_VALUE_RULE_ID, type ScanApplicabilityStatus, type ScanConfidence, type ScanFindingSeverity, type ScanFindingV1, type ScanInputKind, type ScanInputV1, type ScanProjectOptions, type ScanReportV1, type ScanRepositoryV1, type ScanRouteV1, type ShowcaseShortlistVerificationEntry, type ShowcaseShortlistVerificationReport, type StyleBridgeDriftAudit, type StyleBridgeDriftFinding, VERIFICATION_SCHEMA_URLS, type VerificationDiagnosticCatalogEntry, type VerificationDiagnosticInput, type VerificationDiagnosticMetadata, type VerificationFinding, type VerificationGraphAnchor, type VerificationGraphAnchorConfidence, type VerificationRepairAction, type VerificationScore, type VerificationSeverity, anchorFindingsToGraph, auditBuiltDist, auditComponentReuse, auditProject, auditStyleBridgeDrift, buildProjectHealthRepairPlan, collectMissingPackManifestFiles, collectProjectSourceFiles, createContractAssertions, createEvidenceBundle, createUnavailableScanReport, critiqueFile, critiqueSource, deriveVerificationDiagnostic, emptyRuntimeAudit, extractRouteHintsFromEssence, listKnownInteractions, probePublishedSite, resolveGitHubScanInput, resolveGraphAnchorForFinding, scanProject, verifyInteractionsInSource };
+export { type BuiltDistAuditOptions, COMPONENT_REUSE_RULE_ID, type CodeComponentDeclaration, type CodeImportReference, type ComponentReuseAudit, type ComponentReuseFinding, type ContractAssertion, type ContractAssertionCategory, type CritiqueSourceInput, EVIDENCE_BUNDLE_SCHEMA_URL, type EvidenceBundle, type EvidenceBundleInput, type EvidenceProvenanceEntry, type EvidenceRepairPlan, type EvidenceRepairPlanAction, type ExtractSourceStringLiteralOptions, type FileCritiqueReport, type GitHubScanInputResolution, type GraphAnchorEdge, type GraphAnchorFindingInput, type GraphAnchorNode, type GraphAnchorSnapshot, INTERACTION_SIGNALS, type InteractionMissingFinding, type InteractionRequirement, type InteractionSignal, KNOWN_VERIFICATION_DIAGNOSTICS, type MissingPackManifestFile, type PackManifest, type ProjectAuditReport, type ProjectHealthFinding, type ProjectHealthFindingSource, type ProjectHealthGraphSummary, type ProjectHealthPackSummary, type ProjectHealthRemediation, type ProjectHealthReport, type ProjectHealthRouteSummary, type ProjectHealthStatus, type ProjectSourceFile, type ProjectSourceKind, type ProjectSourceLanguage, type ProjectSourceProgram, type ProjectSourceProgramOptions, type PublishedSiteProbeV1, RAW_CONTROL_REUSE_RULE_ID, type RawControlReuseFinding, type ResolveSourceSymbolOriginOptions, type RuntimeAudit, SCAN_REPORT_SCHEMA_URL, STYLE_BRIDGE_ARBITRARY_VALUE_RULE_ID, type ScanApplicabilityStatus, type ScanConfidence, type ScanFindingSeverity, type ScanFindingV1, type ScanInputKind, type ScanInputV1, type ScanProjectOptions, type ScanReportV1, type ScanRepositoryV1, type ScanRouteV1, type ShowcaseShortlistVerificationEntry, type ShowcaseShortlistVerificationReport, type SourceImportKind, type SourceImportReference, type SourceImportResolution, type SourceImportResolutionKind, type SourceInventory, type SourceInventoryOptions, type SourceInventorySkipReason, type SourceInventorySkippedPath, type SourceLocation, type SourceStringLiteral, type SourceStringLiteralContext, type SourceSymbolOrigin, type StyleBridgeDriftAudit, type StyleBridgeDriftFinding, VERIFICATION_SCHEMA_URLS, type VerificationDiagnosticCatalogEntry, type VerificationDiagnosticInput, type VerificationDiagnosticMetadata, type VerificationFinding, type VerificationGraphAnchor, type VerificationGraphAnchorConfidence, type VerificationRepairAction, type VerificationScore, type VerificationSeverity, anchorFindingsToGraph, auditBuiltDist, auditComponentReuse, auditProject, auditStyleBridgeDrift, buildProjectHealthRepairPlan, collectMissingPackManifestFiles, collectProjectSourceFiles, collectSourceImports, createContractAssertions, createEvidenceBundle, createProjectSourceProgram, createSourceInventory, createUnavailableScanReport, critiqueFile, critiqueSource, deriveVerificationDiagnostic, emptyRuntimeAudit, extractRouteHintsFromEssence, extractSourceStringLiterals, getProjectSourceFile, isPathInsideProject, isSupportedSourceExtension, listKnownInteractions, normalizeSourcePath, probePublishedSite, resolveGitHubScanInput, resolveGraphAnchorForFinding, resolveSourceImport, resolveSourceSymbolOrigin, scanProject, sourceKindFromPath, sourceLanguageFromPath, sourceLocationForNode, sourceScriptKindFromPath, verifyInteractionsInSource };