@decantr/verifier 3.5.5 → 3.6.1

package/README.md

@@ -35,9 +35,10 @@ npm install @decantr/verifier
 - project audits check that `pack-manifest.json` references real pack markdown/JSON files on disk
 - project audits tolerate partial or malformed generated review packs without crashing Project Health, so half-attached Brownfield projects still receive actionable findings
 - Next.js static/document outputs are treated as framework-rendered documents instead of requiring a Vite-style `id="root"` mount element
+- generic static apps can satisfy runtime root proof through semantic app roots such as `main`, `role="main"`, `section.todoapp`, or `#todoapp`, while framework targets still require framework mount/document evidence
 - project source audits ignore test, spec, story, fixture, and mock files for production drift warnings such as localhost endpoints and unsafe rendering patterns
 - project audits emit `COMP001` / `import-existing-component` findings when a production source file locally redeclares a primitive such as `Button`, `Card`, or `Dialog` while an exported reusable primitive already exists under common component paths
-- project audits emit `COMP010` / `replace-raw-control-with-local-component` findings when production JSX renders raw controls such as `<button>` or `<input>` while a project-owned primitive already exists
+- project audits emit `COMP010` / `replace-raw-control-with-local-component` findings when production JSX renders generic raw controls such as `<button>` or text-like `<input>` while a project-owned primitive already exists; specialized inputs such as file, hidden, checkbox, radio, color, range, and Dropzone `getInputProps()` controls are not treated as generic `Input` drift
 - project audits emit behavior-obligation findings when accepted `.decantr/local-patterns.json` patterns declare `behavior_obligations` and production source strongly violates statically checkable dialog/form obligations:
   - `A11Y010` / `restore-dialog-accessible-name`
   - `A11Y011` / `restore-label-association`
@@ -49,7 +50,7 @@ npm install @decantr/verifier
 - project audits emit `TOKEN010` / `replace-arbitrary-style-with-bridge-token` findings when an accepted `.decantr/style-bridge.json` exists and production JSX uses arbitrary Tailwind values such as `bg-[#0f172a]`, values inside `cn()`, `clsx()`, `classnames()`, `cva()`, and `tv()` calls, hardcoded inline color styles such as `style={{ backgroundColor: "#0f172a" }}`, or hardcoded visual values in production CSS/module stylesheets
 - published verifier report schemas are exercised by AJV-backed round-trip tests against real audit, critique, and shortlist-report outputs
 - project audits include runtime evidence when a built `dist/` output is present:
-  - root document
+  - root document, including semantic static app roots for generic static apps
   - document title
   - document `lang` and `viewport` metadata
   - emitted assets

package/dist/index.d.ts

@@ -450,6 +450,7 @@ interface RuntimeAudit {
 interface BuiltDistAuditOptions {
     distDir?: string;
     routeHints?: string[];
+    runtimeTarget?: string | null;
 }
 declare function emptyRuntimeAudit(failures?: string[]): RuntimeAudit;
 declare function auditBuiltDist(projectRoot: string, options?: BuiltDistAuditOptions): Promise<RuntimeAudit>;

package/dist/index.js

@@ -69,6 +69,18 @@ var RAW_CONTROL_COMPONENT_BY_ELEMENT = {
   table: "Table",
   textarea: "Textarea"
 };
+var NON_GENERIC_INPUT_TYPES = /* @__PURE__ */ new Set([
+  "button",
+  "checkbox",
+  "color",
+  "file",
+  "hidden",
+  "image",
+  "radio",
+  "range",
+  "reset",
+  "submit"
+]);
 function normalizePath(path) {
   return path.replace(/\\/g, "/");
 }
@@ -120,10 +132,14 @@ function jsxAttributeStringValue(node, attributeName) {
   }
   return null;
 }
-function isHiddenInput(node) {
+function isSpecializedInput(node) {
   const tagName = jsxIdentifierName(node.tagName);
   if (tagName !== "input") return false;
-  return jsxAttributeStringValue(node, "type")?.toLowerCase() === "hidden";
+  const type = jsxAttributeStringValue(node, "type")?.toLowerCase();
+  if (type && NON_GENERIC_INPUT_TYPES.has(type)) return true;
+  return node.attributes.properties.some(
+    (property) => ts.isJsxSpreadAttribute(property) && /\bgetInputProps\s*\(/.test(property.expression.getText())
+  );
 }
 function isReusableComponentPath(file, name) {
   const normalized = normalizePath(file);
@@ -222,7 +238,7 @@ function collectRawControls(sourceFile, file) {
     if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
       const tagName = jsxIdentifierName(node.tagName);
       const component = tagName && Object.hasOwn(RAW_CONTROL_COMPONENT_BY_ELEMENT, tagName) ? RAW_CONTROL_COMPONENT_BY_ELEMENT[tagName] : null;
-      if (component && !isHiddenInput(node)) {
+      if (component && !isSpecializedInput(node)) {
         rawControls.push({
           element: tagName,
           component,
@@ -992,6 +1008,49 @@ function isNextProject(projectRoot) {
     return false;
   }
 }
+function readProjectDependencies(projectRoot) {
+  try {
+    const pkg = JSON.parse(readFileSync2(join(projectRoot, "package.json"), "utf-8"));
+    return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  } catch {
+    return {};
+  }
+}
+function isFrameworkRuntimeProject(projectRoot, runtimeTarget) {
+  const normalizedTarget = runtimeTarget?.toLowerCase() ?? "";
+  if (["angular", "next", "nextjs", "nuxt", "react", "solid", "svelte", "sveltekit", "vue"].includes(
+    normalizedTarget
+  )) {
+    return true;
+  }
+  if (existsSync(join(projectRoot, "vite.config.js")) || existsSync(join(projectRoot, "vite.config.ts")) || existsSync(join(projectRoot, "angular.json")) || existsSync(join(projectRoot, "svelte.config.js")) || existsSync(join(projectRoot, "svelte.config.ts"))) {
+    return true;
+  }
+  const dependencies = readProjectDependencies(projectRoot);
+  return [
+    "@angular/core",
+    "@angular/router",
+    "@sveltejs/kit",
+    "next",
+    "nuxt",
+    "react",
+    "react-dom",
+    "solid-js",
+    "svelte",
+    "vue"
+  ].some((name) => Boolean(dependencies[name]));
+}
+function hasFrameworkMountPoint(html) {
+  return /\bid=(["'])(?:root|app|__next)\1/i.test(html) || /<app-root(?:\s|>)/i.test(html) || /<[^>]+\bdata-(?:reactroot|sveltekit|astro-cid)\b/i.test(html);
+}
+function hasSemanticStaticAppRoot(html) {
+  return /<main(?:\s|>)/i.test(html) || /<[^>]+\brole=(["'])main\1/i.test(html) || /<section\b[^>]*(?:\bid=(["'])todoapp\1|\bclass=(["'])[^"']*\btodoapp\b[^"']*\2)/i.test(html);
+}
+function rootDocumentLooksUsable(html, options) {
+  if (options.frameworkDocumentOutput) return true;
+  if (hasFrameworkMountPoint(html)) return true;
+  return !options.frameworkRuntimeProject && hasSemanticStaticAppRoot(html);
+}
 async function startStaticServer(rootDir) {
   const server = createServer((req, res) => {
     const requestedUrl = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -1054,6 +1113,7 @@ async function auditBuiltDist(projectRoot, options = {}) {
   }
   const routeHints = Array.isArray(options.routeHints) && options.routeHints.length > 0 ? options.routeHints.map((route) => normalizeRouteHint(route)).filter(Boolean).slice(0, 8) : ["/"];
   const frameworkDocumentOutput = isNextProject(projectRoot);
+  const frameworkRuntimeProject = isFrameworkRuntimeProject(projectRoot, options.runtimeTarget);
   const indexHtml = readFileSync2(indexPath, "utf-8");
   const assetPaths = extractAssetPaths(indexHtml);
   const server = await startStaticServer(distDir);
@@ -1061,7 +1121,7 @@ async function auditBuiltDist(projectRoot, options = {}) {
     const rootResponse = await fetch(`${server.baseUrl}/`);
     const rootHtml = await rootResponse.text();
     const failures = frameworkDocumentOutput ? ["next-build-output"] : [];
-    const rootDocumentOk = rootResponse.ok && (frameworkDocumentOutput || /id="root"/.test(rootHtml));
+    const rootDocumentOk = rootResponse.ok && rootDocumentLooksUsable(rootHtml, { frameworkDocumentOutput, frameworkRuntimeProject });
     const titleOk = /<title>[^<]+<\/title>/i.test(rootHtml);
     const langOk = /<html[^>]*\slang=(["'])[^"']+\1/i.test(rootHtml);
     const viewportOk = /<meta[^>]+name=(["'])viewport\1[^>]*>/i.test(rootHtml);
@@ -1141,7 +1201,7 @@ async function auditBuiltDist(projectRoot, options = {}) {
     for (const routeHint of routeHints) {
       const routeResponse = await fetch(`${server.baseUrl}${routeHint}`);
       const routeHtml = await routeResponse.text();
-      const routeRootDocumentOk = routeResponse.ok && (frameworkDocumentOutput || /id="root"/.test(routeHtml));
+      const routeRootDocumentOk = routeResponse.ok && rootDocumentLooksUsable(routeHtml, { frameworkDocumentOutput, frameworkRuntimeProject });
       const routeTitleOk = /<title>[^<]+<\/title>/i.test(routeHtml);
       const routeLangOk = /<html[^>]*\slang=(["'])[^"']+\1/i.test(routeHtml);
       const routeViewportOk = /<meta[^>]+name=(["'])viewport\1[^>]*>/i.test(routeHtml);
@@ -2631,6 +2691,42 @@ function walkNextAppRoutes(dir, projectRoot, segments) {
   }
   return routes;
 }
+function walkSvelteKitRoutes(dir, projectRoot, segments) {
+  let entries;
+  try {
+    entries = readdirSync3(dir);
+  } catch {
+    return [];
+  }
+  const routes = [];
+  const pageFile = entries.find((entry) => /^\+page\.(svelte|ts|js)$/.test(entry));
+  const hasLayout = entries.some((entry) => /^\+layout\.(svelte|ts|js)$/.test(entry));
+  if (pageFile) {
+    routes.push({
+      path: `/${segments.filter(Boolean).join("/")}` || "/",
+      file: relative3(projectRoot, join3(dir, pageFile)).replace(/\\/g, "/"),
+      hasLayout
+    });
+  }
+  for (const entry of entries) {
+    if (shouldSkipDir(entry)) continue;
+    const fullPath = join3(dir, entry);
+    try {
+      if (!statSync2(fullPath).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    const routeSegment = segmentToRoute(entry);
+    routes.push(
+      ...walkSvelteKitRoutes(
+        fullPath,
+        projectRoot,
+        routeSegment === null ? segments : [...segments, routeSegment]
+      )
+    );
+  }
+  return routes;
+}
 function fileRouteFromPath(file, baseDir) {
   let withoutExt = file.slice(0, -extname3(file).length);
   if (withoutExt.endsWith("/index")) withoutExt = withoutExt.slice(0, -"/index".length);
@@ -2681,6 +2777,31 @@ function scanReactRouter(projectRoot) {
   }
   return { routes: [...routes.values()], hashRouting };
 }
+function normalizeRouterObjectPath(path) {
+  const cleaned = path.trim();
+  if (!cleaned || cleaned === "/") return "/";
+  if (cleaned === "*" || cleaned === "**" || cleaned.startsWith("#")) return null;
+  if (ROUTE_ASSET_EXTENSION_RE.test(cleaned)) return null;
+  return cleaned.startsWith("/") ? cleaned.replace(/\/+$/g, "") || "/" : `/${cleaned}`;
+}
+function scanAngularRouter(projectRoot) {
+  const routes = /* @__PURE__ */ new Map();
+  const files = walkFiles(projectRoot, {
+    extensions: /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"])
+  });
+  for (const file of files) {
+    const content = readTextFile(join3(projectRoot, file));
+    if (!content) continue;
+    const isRouterFile = content.includes("@angular/router") || content.includes("RouterModule.forRoot") || content.includes("provideRouter") || /\bRoutes\s*=/.test(content);
+    if (!isRouterFile) continue;
+    for (const match of content.matchAll(/\bpath\s*:\s*["'`]([^"'`]*)["'`]/g)) {
+      const routePath = normalizeRouterObjectPath(match[1] ?? "");
+      if (!routePath || routes.has(routePath)) continue;
+      routes.set(routePath, { path: routePath, file, hasLayout: false });
+    }
+  }
+  return [...routes.values()];
+}
 function firstRouteLiteralMatch(match) {
   return match.slice(1).find((value) => typeof value === "string") ?? null;
 }
@@ -2815,7 +2936,7 @@ function scanRoutes(projectRoot, detection) {
     if (pagesRoutes.length > 0) return { strategy: "pages-router", routes: pagesRoutes };
   }
   if (detection.framework === "svelte") {
-    const routes = scanFileRoutes(projectRoot, "src/routes", /* @__PURE__ */ new Set([".svelte", ".ts", ".js"]));
+    const routes = existsSync3(join3(projectRoot, "src/routes")) ? walkSvelteKitRoutes(join3(projectRoot, "src/routes"), projectRoot, []) : [];
     if (routes.length > 0) return { strategy: "sveltekit-router", routes };
   }
   if (detection.framework === "nuxt") {
@@ -2828,6 +2949,10 @@ function scanRoutes(projectRoot, detection) {
     const router = scanReactRouter(projectRoot);
     if (router.routes.length > 0) return { strategy: "vue-router", routes: router.routes };
   }
+  if (detection.framework === "angular") {
+    const routes = scanAngularRouter(projectRoot);
+    if (routes.length > 0) return { strategy: "angular-router", routes };
+  }
   const reactRouter = scanReactRouter(projectRoot);
   if (reactRouter.routes.length > 0)
     return { strategy: "react-router", routes: reactRouter.routes };
@@ -5634,7 +5759,8 @@ function appendTopologyFindings(findings, essence, reviewPack) {
 }
 async function runRuntimeAudit(projectRoot, essence) {
   return auditBuiltDist(projectRoot, {
-    routeHints: extractRouteHintsFromEssence(essence)
+    routeHints: extractRouteHintsFromEssence(essence),
+    runtimeTarget: typeof essence?.meta?.target === "string" ? essence.meta.target : null
   });
 }
 function extractFailedRouteDocuments(runtimeAudit) {