@decantr/verifier 3.4.0 → 3.5.0

package/dist/index.js

@@ -344,6 +344,300 @@ function auditComponentReuse(projectRoot, sourceFiles) {
   };
 }
 
+// src/contracts-v2.ts
+var VERIFICATION_COMMON_V2_SCHEMA_URL = "https://decantr.ai/schemas/verification-report.common.v2.json";
+var PROJECT_HEALTH_REPORT_V2_SCHEMA_URL = "https://decantr.ai/schemas/project-health-report.v2.json";
+var DECANTR_CI_REPORT_V2_SCHEMA_URL = "https://decantr.ai/schemas/decantr-ci-report.v2.json";
+var WORKSPACE_HEALTH_REPORT_V2_SCHEMA_URL = "https://decantr.ai/schemas/workspace-health-report.v2.json";
+var EVIDENCE_BUNDLE_V2_SCHEMA_URL = "https://decantr.ai/schemas/evidence-bundle.v2.json";
+var RUNTIME_PROBE_PAYLOAD_V2_SCHEMA_URL = "https://decantr.ai/schemas/runtime-probe-payload.v2.json";
+var LOOP_READINESS_V2_SCHEMA_URL = "https://decantr.ai/schemas/loop-readiness.v2.json";
+var AUTHORITY_RESOLUTION_V2_SCHEMA_URL = "https://decantr.ai/schemas/authority-resolution.v2.json";
+var PROOF_FIELD_REPORT_V2_SCHEMA_URL = "https://decantr.ai/schemas/proof-field-report.v2.json";
+function unique(values) {
+  return [...new Set(values)];
+}
+function rounded(value) {
+  return Number(Math.max(0, Math.min(1, value)).toFixed(2));
+}
+function createEvidenceTier(report, options = {}) {
+  const runtimeProbeCount = options.runtimeProbeCount ?? (report.summary.runtimeAuditChecked ? 1 : 0);
+  const visualArtifactCount = options.visualArtifactCount ?? 0;
+  const findingsAnchored = report.findings.filter((finding) => finding.graph).length;
+  const findingsWithRepairPlan = report.findings.filter((finding) => finding.repairPlan).length;
+  const capabilities = ["static-audit", "project-health"];
+  if (report.graph.ready) capabilities.push("typed-graph");
+  if (runtimeProbeCount > 0) capabilities.push("runtime-probe");
+  if (report.summary.runtimeAuditChecked || visualArtifactCount > 0)
+    capabilities.push("browser-evidence");
+  if (visualArtifactCount > 0) capabilities.push("visual-baseline");
+  if (findingsWithRepairPlan > 0) capabilities.push("repair-plan");
+  if (options.benchmarkReplay) capabilities.push("benchmark-replay");
+  let stage = "static";
+  if (options.benchmarkReplay) stage = "proof";
+  else if (findingsWithRepairPlan > 0) stage = "repair";
+  else if (visualArtifactCount > 0) stage = "visual";
+  else if (runtimeProbeCount > 0 || report.summary.runtimeAuditChecked) stage = "runtime";
+  else if (report.graph.ready) stage = "graph";
+  const routeCoverage = report.routes.declared.length > 0 ? Math.min(1, report.routes.runtimeChecked.length / report.routes.declared.length) : report.summary.runtimeAuditChecked ? 1 : 0;
+  const graphCoverage = report.findings.length > 0 ? findingsAnchored / report.findings.length : report.graph.ready ? 1 : 0;
+  const repairCoverage = report.findings.length > 0 ? findingsWithRepairPlan / report.findings.length : 1;
+  const runtimeCoverage = runtimeProbeCount > 0 || report.summary.runtimeAuditChecked ? 1 : 0;
+  const score = rounded(
+    0.22 + (report.graph.ready ? 0.22 : 0) + routeCoverage * 0.16 + graphCoverage * 0.16 + repairCoverage * 0.14 + runtimeCoverage * 0.1
+  );
+  const level = score >= 0.78 ? "high" : score >= 0.48 ? "moderate" : "low";
+  const reasons = [];
+  reasons.push(report.graph.ready ? "typed graph is ready" : "typed graph is missing or stale");
+  reasons.push(
+    runtimeProbeCount > 0 || report.summary.runtimeAuditChecked ? "runtime evidence is present" : "runtime evidence has not run"
+  );
+  reasons.push(
+    report.findings.length === 0 ? "no open findings" : `${findingsAnchored}/${report.findings.length} finding(s) have graph anchors`
+  );
+  reasons.push(
+    report.findings.length === 0 ? "repair context is not needed" : `${findingsWithRepairPlan}/${report.findings.length} finding(s) include repair plans`
+  );
+  return {
+    schemaVersion: 2,
+    stage,
+    status: report.status === "healthy" ? "healthy" : report.status,
+    capabilities: unique(capabilities),
+    coverage: {
+      declaredRoutes: report.routes.declared.length,
+      runtimeRoutesChecked: report.routes.runtimeChecked.length,
+      findingsAnchored,
+      findingsWithRepairPlan,
+      runtimeProbeCount,
+      visualArtifactCount
+    },
+    confidence: {
+      level,
+      score,
+      reasons
+    }
+  };
+}
+function createAuthorityOrder() {
+  return [
+    {
+      id: "production-source",
+      label: "Production source",
+      role: "Existing runtime/source wins first in Brownfield unless a human explicitly accepts a contract change.",
+      rank: 1
+    },
+    {
+      id: "local-law",
+      label: "Accepted local law",
+      role: "Project-owned rules and codified patterns constrain edits after they are accepted locally.",
+      rank: 2
+    },
+    {
+      id: "style-bridge",
+      label: "Accepted style bridge",
+      role: "Mapped native style tokens/components govern Hybrid styling once accepted locally.",
+      rank: 3
+    },
+    {
+      id: "essence-contract",
+      label: "Essence V4 contract",
+      role: "Structural route, section, page, guard, and DNA contract for Decantr context.",
+      rank: 4
+    },
+    {
+      id: "registry-guidance",
+      label: "Hosted packs and registry",
+      role: "Advisory guidance unless mapped into accepted local law or the local style bridge.",
+      rank: 5
+    }
+  ];
+}
+function laneForFinding(finding) {
+  if (finding.source === "style-bridge") return "style-bridge";
+  if (finding.source === "brownfield" || finding.category.toLowerCase().includes("drift")) {
+    return "production-source";
+  }
+  if (finding.source === "check" || finding.source === "assertion") return "essence-contract";
+  if (finding.source === "pack") return "registry-guidance";
+  return "local-law";
+}
+function actionsForFinding(finding) {
+  const commands = finding.repairPlan?.commands ?? finding.remediation?.commands ?? [];
+  const repairCommand = commands[0] ?? null;
+  const source = finding.source;
+  const actions = [];
+  if (source === "graph") {
+    actions.push({
+      kind: "regenerate_graph",
+      label: "Regenerate graph/context evidence",
+      command: "decantr graph --check || decantr graph",
+      writes: true,
+      rationale: "Graph drift should be resolved by regenerating derived graph artifacts from current source."
+    });
+  } else if (source === "style-bridge") {
+    actions.push({
+      kind: "update_style_bridge",
+      label: "Update accepted style bridge",
+      command: "decantr codify --style-bridge",
+      writes: true,
+      rationale: "Style conflicts should be accepted through the explicit Hybrid style bridge workflow."
+    });
+  } else if (source === "brownfield") {
+    actions.push({
+      kind: "accept_observed_source",
+      label: "Accept observed source into contract",
+      command: "decantr init --existing --merge-proposal",
+      writes: true,
+      rationale: "Brownfield source is first authority; accept it explicitly before treating contract drift as repaired."
+    });
+  } else if (source === "pack") {
+    actions.push({
+      kind: "regenerate_context",
+      label: "Regenerate Decantr context",
+      command: "decantr refresh",
+      writes: true,
+      rationale: "Generated context and pack artifacts are derived from the local contract."
+    });
+  } else {
+    actions.push({
+      kind: "repair_source",
+      label: "Repair source to satisfy accepted authority",
+      command: repairCommand,
+      writes: false,
+      rationale: "The finding can be repaired by editing the relevant application source under human/agent control."
+    });
+  }
+  actions.push({
+    kind: "defer_to_drift_log",
+    label: "Defer to drift log",
+    command: `decantr resolve --defer ${finding.id}`,
+    writes: true,
+    rationale: "Record an explicit human deferral when this conflict should not block the current task."
+  });
+  if (finding.severity !== "error") {
+    actions.push({
+      kind: "mark_advisory",
+      label: "Mark advisory",
+      command: `decantr resolve --mark-advisory ${finding.id}`,
+      writes: true,
+      rationale: "Warnings can be documented as advisory when the observed source is intentionally different."
+    });
+  }
+  return actions;
+}
+function createAuthorityResolution(report) {
+  const conflicts = report.findings.filter((finding) => finding.severity !== "info").map((finding) => ({
+    id: finding.id,
+    source: finding.source,
+    category: finding.category,
+    severity: finding.severity,
+    message: finding.message,
+    ...finding.graph ? { graphAnchor: finding.graph } : {},
+    lane: laneForFinding(finding),
+    status: finding.severity === "error" ? "blocking" : finding.source === "brownfield" || finding.source === "style-bridge" ? "repairable" : "advisory",
+    recommendedActions: actionsForFinding(finding)
+  }));
+  const activeLane = report.summary.workflowMode === "brownfield-attach" ? "production-source" : "essence-contract";
+  return {
+    schemaVersion: 2,
+    order: createAuthorityOrder(),
+    activeLane,
+    summary: activeLane === "production-source" ? "Brownfield authority: preserve observed production source first, then accepted local law/style bridge, then Essence V4 structure, with hosted packs advisory." : "Contract authority: Essence V4 and accepted local project law guide source changes; hosted packs remain advisory until accepted locally.",
+    conflicts,
+    stopRule: "If runtime source and Decantr context disagree, stop and report drift instead of guessing which truth to overwrite."
+  };
+}
+function readTargetsForFindings(report) {
+  const targets = /* @__PURE__ */ new Set(["DECANTR.md", "decantr.essence.json"]);
+  for (const finding of report.findings) {
+    for (const target of finding.repairPlan?.readTargets ?? []) targets.add(target);
+    if (finding.file) targets.add(finding.file);
+    if (finding.source === "graph") targets.add(".decantr/graph/graph.manifest.json");
+    if (finding.source === "style-bridge") targets.add(".decantr/style-bridge.json");
+  }
+  return [...targets].sort();
+}
+function createLoopReadiness(report, authority = createAuthorityResolution(report), evidenceTier = createEvidenceTier(report)) {
+  const hasEssence = Boolean(report.summary.essenceVersion);
+  const graphMissing = !report.graph.ready;
+  const blockingConflicts = authority.conflicts.filter(
+    (conflict) => conflict.status === "blocking"
+  );
+  const repairableConflicts = authority.conflicts.filter(
+    (conflict) => conflict.status === "repairable"
+  );
+  let state = "verified";
+  const blockingReasons = [];
+  if (!hasEssence) {
+    state = "blocked_missing_context";
+    blockingReasons.push("Essence V4 context is missing.");
+  } else if (graphMissing) {
+    state = "blocked_missing_graph";
+    blockingReasons.push("Typed Contract graph is missing, stale, or incomplete.");
+  } else if (blockingConflicts.length > 0 && repairableConflicts.length > 0) {
+    state = "human_resolution_required";
+    blockingReasons.push("Blocking findings conflict with Brownfield or Hybrid authority.");
+  } else if (blockingConflicts.length > 0 || report.summary.errorCount > 0) {
+    state = "repair_required";
+    blockingReasons.push("Project Health has blocking errors.");
+  } else if (repairableConflicts.length > 0 || report.summary.warnCount > 0) {
+    state = "repair_required";
+    blockingReasons.push("Project Health has repairable warnings or drift.");
+  } else if (report.status === "healthy") {
+    state = "verified";
+  } else {
+    state = "verify_required";
+    blockingReasons.push("Verification needs to be rerun before the loop is complete.");
+  }
+  const nextActions = state === "verified" ? ["Continue normal route/task workflow."] : state === "blocked_missing_context" ? ["Run `decantr scan` for a read-only preview, then `decantr adopt` when ready."] : state === "blocked_missing_graph" ? ["Run `decantr graph` to regenerate typed graph artifacts, then rerun verification."] : state === "human_resolution_required" ? ["Run `decantr resolve` and choose an explicit resolution action before editing."] : state === "repair_required" ? ["Repair the highest-severity finding, then rerun the verify command."] : ["Run the verify command before treating the task as complete."];
+  const status = state.startsWith("blocked") || state === "human_resolution_required" ? "blocked" : report.status;
+  return {
+    schemaVersion: 2,
+    state,
+    status,
+    verdict: state === "verified" ? "Loop verified." : "Loop needs attention before it should be considered complete.",
+    summary: `${report.status} Project Health, ${evidenceTier.confidence.level} evidence confidence, ${authority.conflicts.length} authority conflict(s).`,
+    authority: {
+      activeLane: authority.activeLane,
+      summary: authority.summary,
+      stopRule: authority.stopRule
+    },
+    evidenceTier,
+    blockingReasons,
+    nextActions,
+    maker: {
+      title: "Maker instructions",
+      instructions: [
+        "Read the route/task context before editing source.",
+        "Preserve production source behavior and accepted local law unless a human chooses a resolution action.",
+        "Stop and report drift when runtime source and Decantr context disagree."
+      ]
+    },
+    checker: {
+      title: "Checker instructions",
+      instructions: [
+        "Rerun the verify command after edits.",
+        "Check graph anchors and repair plans before accepting a fix.",
+        "Treat critique-only or advisory evidence as warning-level unless runtime evidence proves a failure."
+      ]
+    },
+    readTargets: readTargetsForFindings(report),
+    graphImpact: {
+      status: !report.graph.present ? "missing" : report.graph.ready && report.graph.current !== false ? "ready" : "stale",
+      snapshotId: report.graph.snapshotId,
+      sourceHash: report.graph.sourceHash,
+      sourceArtifactCount: report.graph.sourceArtifactCount,
+      staleArtifacts: report.graph.staleArtifacts
+    },
+    stopConditions: [
+      "Runtime source and Decantr context disagree.",
+      "Typed graph is missing for the route or changed file.",
+      "A finding requires contract/source/local-law mutation outside the current explicit workflow."
+    ],
+    verifyCommand: report.ci.recommendedCommand
+  };
+}
+
 // src/runtime.ts
 import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";
 import { createServer } from "http";
@@ -1160,13 +1454,16 @@ function isAcceptedTokenValue(value, tokenHints) {
     return value.includes(normalizedHint) || value.includes(`var(${normalizedHint})`);
   });
 }
-function arbitraryInlineStyleValue(property, value, tokenHints) {
+function arbitraryInlineStyleValue(property, value, tokenHints, options = {}) {
   const normalizedProperty = property.trim();
   const normalizedValue = value.trim();
   if (!normalizedProperty || !normalizedValue) return null;
   const isVisualProperty = INLINE_STYLE_PROPERTIES.has(normalizedProperty) || STYLESHEET_VISUAL_PROPERTIES.has(normalizedProperty) || normalizedProperty.startsWith("--");
   if (!isVisualProperty) return null;
   if (isAcceptedTokenValue(normalizedValue, tokenHints)) return null;
+  if (options.allowCssVariableValues && /\bvar\(\s*--[A-Za-z0-9_-]+/i.test(normalizedValue)) {
+    return null;
+  }
   if (/(?:^|[\s,(])#[0-9a-f]{3,8}\b|(?:rgba?|hsla?|oklch|oklab|lch|lab|color-mix)\(/i.test(
     normalizedValue
   )) {
@@ -1286,7 +1583,9 @@ function collectStylesheetBridgeDriftFindings(input) {
       const property = match.groups?.property;
       const rawValue = match.groups?.value;
       if (!property || !rawValue) continue;
-      const value = arbitraryInlineStyleValue(property, rawValue, input.bridge.tokenHints);
+      const value = arbitraryInlineStyleValue(property, rawValue, input.bridge.tokenHints, {
+        allowCssVariableValues: true
+      });
       if (!value) continue;
       const lineNumber = lineIndex + 1;
       const key = `${file}:${lineNumber}:${value}`;
@@ -2005,9 +2304,9 @@ function sourceLineCount(source) {
 }
 function verifyInteractionsInSource(interactions, sources) {
   if (interactions.length === 0 || sources.size === 0) return [];
-  const unique = Array.from(new Set(interactions));
+  const unique2 = Array.from(new Set(interactions));
   const missing = [];
-  for (const interaction of unique) {
+  for (const interaction of unique2) {
     const requirement = INTERACTION_SIGNALS[interaction];
     if (!requirement) {
       continue;
@@ -3729,17 +4028,17 @@ function resolveSourceSymbolOrigin(context, pathOrSourceFile, localName, options
 
 // src/index.ts
 var VERIFICATION_SCHEMA_URLS = {
-  common: "https://decantr.ai/schemas/verification-report.common.v1.json",
+  common: VERIFICATION_COMMON_V2_SCHEMA_URL,
   projectAudit: "https://decantr.ai/schemas/project-audit-report.v1.json",
-  projectHealth: "https://decantr.ai/schemas/project-health-report.v1.json",
-  decantrCi: "https://decantr.ai/schemas/decantr-ci-report.v1.json",
-  evidenceBundle: "https://decantr.ai/schemas/evidence-bundle.v1.json",
+  projectHealth: PROJECT_HEALTH_REPORT_V2_SCHEMA_URL,
+  decantrCi: DECANTR_CI_REPORT_V2_SCHEMA_URL,
+  evidenceBundle: EVIDENCE_BUNDLE_V2_SCHEMA_URL,
   scanReport: "https://decantr.ai/schemas/scan-report.v1.json",
-  workspaceHealth: "https://decantr.ai/schemas/workspace-health-report.v1.json",
+  workspaceHealth: WORKSPACE_HEALTH_REPORT_V2_SCHEMA_URL,
   fileCritique: "https://decantr.ai/schemas/file-critique-report.v1.json",
   showcaseShortlist: "https://decantr.ai/schemas/showcase-shortlist-report.v1.json"
 };
-var EVIDENCE_BUNDLE_SCHEMA_URL = "https://decantr.ai/schemas/evidence-bundle.v1.json";
+var EVIDENCE_BUNDLE_SCHEMA_URL = EVIDENCE_BUNDLE_V2_SCHEMA_URL;
 function hashString(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
@@ -3941,7 +4240,8 @@ function createContractAssertions(projectRoot, audit) {
   if (v4) {
     const declaredRoutes = Object.keys(v4.blueprint.routes ?? {}).sort();
     for (const route of declaredRoutes) {
-      const routeTarget = (v4.blueprint.routes ?? {})[route];
+      const routeTarget = v4.blueprint.routes?.[route];
+      if (!routeTarget) continue;
       const section = v4.blueprint.sections.find((entry) => entry.id === routeTarget.section);
       const page = section?.pages.find((entry) => entry.id === routeTarget.page);
       assertions.push(
@@ -4027,6 +4327,8 @@ function createContractAssertions(projectRoot, audit) {
 }
 function createEvidenceBundle(input) {
   const assertions = input.assertions ?? createContractAssertions(input.projectRoot, input.audit);
+  const evidenceTier = input.report.evidenceTier ?? createEvidenceTier(input.report);
+  const authority = input.report.authority ?? createAuthorityResolution(input.report);
   let resolvedProjectRoot = input.projectRoot;
   try {
     resolvedProjectRoot = realpathSync2(input.projectRoot);
@@ -4039,13 +4341,18 @@ function createEvidenceBundle(input) {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     project: {
       id: projectId,
-      rootLabel: basename2(input.projectRoot) || "project"
+      rootLabel: basename2(input.projectRoot) || "project",
+      workflowMode: input.report.summary.workflowMode,
+      adoptionMode: input.report.summary.adoptionMode
     },
     toolchain: {
-      verifierVersion: input.verifierVersion ?? null
+      verifierVersion: input.verifierVersion ?? null,
+      cliVersion: input.cliVersion ?? null,
+      mcpServerVersion: input.mcpServerVersion ?? null
     },
     privacy: {
       localOnly: true,
+      sourceIncluded: false,
       redactedFields: [
         "source",
         "prompt",
@@ -4054,8 +4361,10 @@ function createEvidenceBundle(input) {
         "absolute_path",
         "repository_name"
       ],
-      screenshotsLocalOnly: true
+      screenshotsLocalOnly: true,
+      hostedUploadAllowed: false
     },
+    evidenceTier,
     health: {
       status: input.report.status,
       score: input.report.score,
@@ -4073,7 +4382,9 @@ function createEvidenceBundle(input) {
       graphDiff: provenanceEntry(input.projectRoot, ".decantr/graph/graph.diff.json"),
       contractCapsule: provenanceEntry(input.projectRoot, ".decantr/graph/contract-capsule.json"),
       ...input.workspaceConfigPath ? { workspaceConfig: provenanceForPath(input.projectRoot, input.workspaceConfigPath) } : {},
-      ...input.designTokensPath ? { designTokens: provenanceForPath(input.projectRoot, input.designTokensPath) } : {}
+      ...input.designTokensPath ? { designTokens: provenanceForPath(input.projectRoot, input.designTokensPath) } : {},
+      ...input.runtimeProbePath ? { runtimeProbe: provenanceForPath(input.projectRoot, input.runtimeProbePath) } : {},
+      ...input.visualManifestPath ? { visualManifest: provenanceForPath(input.projectRoot, input.visualManifestPath) } : {}
     },
     assertions,
     findings: input.report.findings.map((finding) => ({
@@ -4090,10 +4401,37 @@ function createEvidenceBundle(input) {
       graph: finding.graph,
       repair: redactRepairAction(input.projectRoot, finding.repair),
       repairPlan: buildProjectHealthRepairPlan(input.projectRoot, finding),
+      evidenceTier: finding.evidenceTier ?? evidenceTier,
+      authorityLane: finding.authorityLane ?? authority.conflicts.find((conflict) => conflict.id === finding.id)?.lane ?? authority.activeLane,
+      resolutionActions: finding.resolutionActions ?? authority.conflicts.find((conflict) => conflict.id === finding.id)?.recommendedActions,
+      privacy: finding.privacy ?? {
+        sourceIncluded: false,
+        redacted: true,
+        localOnly: true
+      },
+      loopVerdict: finding.loopVerdict ?? input.report.loop?.state,
       remediationSummary: finding.remediation.summary,
       commands: finding.remediation.commands,
       promptCommand: `decantr health --prompt ${finding.id}`
     })),
+    runtimeProbe: input.runtimeProbe ?? null,
+    artifacts: input.artifacts ?? [
+      {
+        id: "artifact:project-health",
+        kind: "project-health",
+        path: "decantr-health.json",
+        hash: null,
+        localOnly: true,
+        redacted: true
+      }
+    ],
+    dashboard: {
+      safeToUpload: false,
+      retentionClass: "local-only",
+      redactionNotes: [
+        "Evidence Bundle v2 does not include raw source, prompts, secrets, absolute paths, or uploaded screenshots by default."
+      ]
+    },
     ...input.browser ? { browser: input.browser } : {},
     ...input.designTokens ? { designTokens: input.designTokens } : {}
   };
@@ -4848,6 +5186,10 @@ function buildRegistryContext(projectRoot) {
   const patternRegistry = /* @__PURE__ */ new Map();
   const cacheDir = join6(projectRoot, ".decantr", "cache");
   const customDir = join6(projectRoot, ".decantr", "custom");
+  const addPattern = (id, source, data = null) => {
+    if (typeof id !== "string" || !id.trim() || patternRegistry.has(id)) return;
+    patternRegistry.set(id, data ?? { id, source });
+  };
   const cachedThemesDir = join6(cacheDir, "@official", "themes");
   try {
     if (existsSync6(cachedThemesDir)) {
@@ -4881,17 +5223,27 @@ function buildRegistryContext(projectRoot) {
         (name) => name.endsWith(".json") && name !== "index.json"
       )) {
         const data = JSON.parse(readFileSync6(join6(cachedPatternsDir, file), "utf-8"));
-        if (data.id && !patternRegistry.has(data.id)) {
-          patternRegistry.set(data.id, data);
-        }
+        addPattern(data.id, "cache", data);
       }
     }
   } catch {
   }
-  for (const id of ["content-section", "footer", "form-basic", "hero", "nav-header"]) {
-    if (!patternRegistry.has(id)) {
-      patternRegistry.set(id, { id, source: "bundled" });
+  const customPatternsDir = join6(customDir, "patterns");
+  try {
+    if (existsSync6(customPatternsDir)) {
+      for (const file of readdirSync5(customPatternsDir).filter((name) => name.endsWith(".json"))) {
+        const data = JSON.parse(readFileSync6(join6(customPatternsDir, file), "utf-8"));
+        addPattern(data.id, "custom", data);
+      }
     }
+  } catch {
+  }
+  const localPatterns = readJsonIfExists(join6(projectRoot, ".decantr", "local-patterns.json"));
+  for (const pattern of localPatterns?.patterns ?? []) {
+    addPattern(pattern.id, "local-law", pattern);
+  }
+  for (const id of ["content-section", "footer", "form-basic", "hero", "nav-header"]) {
+    addPattern(id, "bundled");
   }
   return { themeRegistry, patternRegistry };
 }
@@ -7666,9 +8018,15 @@ function getJsxTextContent(node) {
   });
   return text;
 }
+function hasNonEmptyJsxAttribute(attributes, ...names) {
+  const attribute = getJsxAttribute(attributes, ...names);
+  if (!attribute?.initializer) return false;
+  const literalValue = getJsxAttributeLiteralValue(attribute);
+  return literalValue === null || literalValue.trim().length > 0;
+}
 function hasAccessibleLabel(attributes, textContent) {
   return Boolean(
-    getJsxAttribute(attributes, "aria-label", "aria-labelledby", "title") || textContent.trim().length > 0
+    hasNonEmptyJsxAttribute(attributes, "aria-label", "aria-labelledby", "title") || textContent.trim().length > 0
   );
 }
 function isNonSemanticInteractiveTag(tagName) {
@@ -7693,6 +8051,18 @@ function collectLabelForIds(root) {
   walk(root);
   return ids;
 }
+function collectElementIds(root) {
+  const ids = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (ts6.isJsxSelfClosingElement(node) || ts6.isJsxOpeningElement(node)) {
+      const idValue = getJsxAttributeLiteralValue(getJsxAttribute(node.attributes, "id"));
+      if (idValue?.trim()) ids.add(idValue.trim());
+    }
+    ts6.forEachChild(node, walk);
+  };
+  walk(root);
+  return ids;
+}
 function isWrappedInJsxLabel(node) {
   let current = node.parent;
   while (current) {
@@ -7715,21 +8085,37 @@ function hasAncestorJsxTag(node, tagName) {
 }
 function isLabelableFormControl(tagName, attributes) {
   if (!tagName) return false;
-  if (tagName === "select" || tagName === "textarea") return true;
-  if (tagName !== "input") return false;
+  const normalizedTagName = tagName.toLowerCase();
+  if (normalizedTagName === "select" || normalizedTagName === "textarea") return true;
+  if (normalizedTagName !== "input" && !isLikelyProjectFormControlTag(tagName)) return false;
   const inputType = (getJsxAttributeLiteralValue(getJsxAttribute(attributes, "type")) ?? "text").toLowerCase();
   return !["hidden", "submit", "reset", "button"].includes(inputType);
 }
+function isLikelyProjectFormControlTag(tagName) {
+  if (tagName === tagName.toLowerCase()) return false;
+  const normalizedTagName = tagName.toLowerCase();
+  return /(?:^|(?:text|email|password|search|number|tel|url|date))input$/.test(normalizedTagName) || /^(?:textarea|textArea|select|combobox|comboBox|checkbox|radio|switch)$/i.test(tagName);
+}
 function getNormalizedInputType(attributes) {
   return (getJsxAttributeLiteralValue(getJsxAttribute(attributes, "type")) ?? "text").trim().toLowerCase();
 }
-function hasFormControlLabel(node, tagName, attributes, labelForIds, textContent) {
+function hasFormControlLabel(node, tagName, attributes, labelForIds, elementIds, textContent) {
   if (!isLabelableFormControl(tagName, attributes)) return true;
-  if (hasAccessibleLabel(attributes, textContent)) return true;
+  if (hasNonEmptyJsxAttribute(attributes, "aria-label", "title")) return true;
+  if (hasAriaLabelledByReference(attributes, elementIds)) return true;
+  if (textContent.trim().length > 0) return true;
   if (isWrappedInJsxLabel(node)) return true;
   const idValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, "id"));
   return Boolean(idValue && labelForIds.has(idValue));
 }
+function hasAriaLabelledByReference(attributes, elementIds) {
+  const attribute = getJsxAttribute(attributes, "aria-labelledby");
+  if (!attribute?.initializer) return false;
+  const literalValue = getJsxAttributeLiteralValue(attribute);
+  if (literalValue === null) return true;
+  const references = literalValue.trim().split(/\s+/).filter(Boolean);
+  return references.some((reference) => elementIds.has(reference));
+}
 function isExternalLinkTargetBlankWithoutRel(attributes) {
   const targetValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, "target"));
   if (targetValue !== "_blank") return false;
@@ -9414,7 +9800,7 @@ function countAuthAnonymousRedirectSignals(code) {
   ];
   return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
 }
-var OPEN_REDIRECT_QUERY_KEY_PATTERN = String.raw`next|redirect(?:To|[_-]to)?|return(?:To|[_-]to)?|callback(?:Url|[_-]url)?|continue(?:Url|[_-]url)?|from`;
+var OPEN_REDIRECT_QUERY_KEY_PATTERN = "next|redirect(?:To|[_-]to)?|return(?:To|[_-]to)?|callback(?:Url|[_-]url)?|continue(?:Url|[_-]url)?|from";
 var OPEN_REDIRECT_SOURCE_PATTERN = String.raw`\b(?:searchParams|(?:request|req)\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\b(?:router\.query|route\.query|query)\.(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})\b|\b(?:new\s+)?URLSearchParams\s*\(\s*(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:search|hash)(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\s*\)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\bnew\s+URL\(\s*(?:request|req)\.url\s*\)\.searchParams\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)`;
 var OPEN_REDIRECT_SOURCE_REGEX = new RegExp(OPEN_REDIRECT_SOURCE_PATTERN, "i");
 var OPEN_REDIRECT_QUERY_KEY_REGEX = new RegExp(`^(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})$`, "i");
@@ -13330,6 +13716,7 @@ function analyzeAstSignals(filePath, code) {
   const namedExpressionInitializers = collectNamedExpressionInitializers(sourceFile);
   const namedPropertyAliases = collectNamedPropertyAliases(sourceFile);
   const labelForIds = collectLabelForIds(sourceFile);
+  const elementIds = collectElementIds(sourceFile);
   let navigationLandmarkCount = 0;
   let unlabeledNavigationLandmarkCount = 0;
   const walk = (node) => {
@@ -13736,7 +14123,7 @@ function analyzeAstSignals(filePath, code) {
           signals.authInputWithoutNameCount += 1;
         }
       }
-      if (!hasFormControlLabel(node, tagName, node.attributes, labelForIds, "")) {
+      if (!hasFormControlLabel(node, tagName, node.attributes, labelForIds, elementIds, "")) {
         signals.formControlWithoutLabelCount += 1;
       }
     }
@@ -13851,6 +14238,7 @@ function analyzeAstSignals(filePath, code) {
         tagName,
         node.openingElement.attributes,
         labelForIds,
+        elementIds,
         textContent
       )) {
         signals.formControlWithoutLabelCount += 1;
@@ -15636,14 +16024,23 @@ async function critiqueFile(filePath, projectRoot) {
   });
 }
 export {
+  AUTHORITY_RESOLUTION_V2_SCHEMA_URL,
   COMPONENT_REUSE_RULE_ID,
+  DECANTR_CI_REPORT_V2_SCHEMA_URL,
   EVIDENCE_BUNDLE_SCHEMA_URL,
+  EVIDENCE_BUNDLE_V2_SCHEMA_URL,
   INTERACTION_SIGNALS,
   KNOWN_VERIFICATION_DIAGNOSTICS,
+  LOOP_READINESS_V2_SCHEMA_URL,
+  PROJECT_HEALTH_REPORT_V2_SCHEMA_URL,
+  PROOF_FIELD_REPORT_V2_SCHEMA_URL,
   RAW_CONTROL_REUSE_RULE_ID,
+  RUNTIME_PROBE_PAYLOAD_V2_SCHEMA_URL,
   SCAN_REPORT_SCHEMA_URL,
   STYLE_BRIDGE_ARBITRARY_VALUE_RULE_ID,
+  VERIFICATION_COMMON_V2_SCHEMA_URL,
   VERIFICATION_SCHEMA_URLS,
+  WORKSPACE_HEALTH_REPORT_V2_SCHEMA_URL,
   anchorFindingsToGraph,
   auditBuiltDist,
   auditComponentReuse,
@@ -15653,8 +16050,12 @@ export {
   collectMissingPackManifestFiles,
   collectProjectSourceFiles,
   collectSourceImports,
+  createAuthorityOrder,
+  createAuthorityResolution,
   createContractAssertions,
   createEvidenceBundle,
+  createEvidenceTier,
+  createLoopReadiness,
   createProjectSourceProgram,
   createSourceInventory,
   createUnavailableScanReport,