@devtrack-solution/codesdd 1.2.2 → 1.2.4-rc3

package/dist/core/sdd/quality-validation.js

@@ -0,0 +1,239 @@
+import { z } from 'zod';
+import { pluginArtifactManifestSchema, } from './plugin-broker.js';
+import { pluginComplianceIndexSchema, pluginValidationManifestSchema, } from './plugin-evidence.js';
+const FEATURE_REF_PATTERN = /^FEAT-\d{4}$/;
+const SCENARIO_ID_PATTERN = /^QVAL-\d{4}$/;
+const ARCHITECTURE_SCHEMA_ID_PATTERN = /^ARCH-GATE-[a-z0-9][a-z0-9-]*$/;
+const RUN_ID_PATTERN = /^qrun-[0-9]{8}t[0-9]{6}z-[a-z0-9-]+$/;
+const ISSUE_CODE_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:[\\/]/;
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+const safeRelativePathSchema = z
+    .string()
+    .min(1)
+    .refine((value) => isSafeRelativePath(value), {
+    message: 'Path must be relative to the project root and must not contain traversal segments.',
+});
+export const qualityAuthorityRefSchema = z.object({
+    type: z.enum(['adr', 'skill', 'foundation', 'debate', 'epic', 'feature', 'schema']),
+    ref: z.string().min(1),
+    path: safeRelativePathSchema.optional(),
+    version: z.string().min(1).optional(),
+    update_policy: z.string().min(1),
+});
+export const qualityGateRefSchema = z.object({
+    id: z.string().min(1),
+    type: z.enum(['schema', 'filesystem', 'import', 'runtime', 'evidence', 'certification', 'drift']),
+    severity: z.enum(['warn', 'fail']).default('warn'),
+    issue_codes: z.array(z.string().regex(ISSUE_CODE_PATTERN)).default([]),
+    remediation: z.string().min(1),
+});
+export const qualityScenarioExpectedArtifactSchema = z.object({
+    path_pattern: z.string().min(1),
+    required: z.boolean().default(true),
+    artifact_class: z.string().min(1),
+    checksum_required: z.boolean().default(false),
+});
+export const qualityScenarioSchema = z.object({
+    schema_version: z.literal(1),
+    id: z.string().regex(SCENARIO_ID_PATTERN),
+    title: z.string().min(10),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN).optional(),
+    mode: z.enum(['dry_run', 'apply_sandbox', 'runtime', 'traceability']),
+    intent: z.string().min(30),
+    authority: z.array(qualityAuthorityRefSchema).min(1),
+    input: z.object({
+        prompt: z.string().min(1).optional(),
+        fixture_path: safeRelativePathSchema.optional(),
+        payload: jsonObjectSchema.default({}),
+    }),
+    expected_artifacts: z.array(qualityScenarioExpectedArtifactSchema).default([]),
+    gates: z.array(qualityGateRefSchema).min(1),
+    negative_variants: z
+        .array(z.object({
+        id: z.string().min(1),
+        description: z.string().min(10),
+        expected_issue_codes: z.array(z.string().regex(ISSUE_CODE_PATTERN)).min(1),
+    }))
+        .default([]),
+    allowed_nondeterminism: z.array(z.string().min(1)).default([]),
+    required_evidence: z.array(z.string().min(1)).min(1),
+});
+export const architectureLayerRuleSchema = z.object({
+    path_patterns: z.array(z.string().min(1)).min(1),
+    allowed_file_patterns: z.array(z.string().min(1)).default([]),
+    forbidden_file_patterns: z.array(z.string().min(1)).default([]),
+    allowed_imports: z.array(z.string().min(1)).default([]),
+    forbidden_imports: z.array(z.string().min(1)).default([]),
+    required_evidence: z.array(z.string().min(1)).default([]),
+});
+export const qualityArchitectureSchema = z.object({
+    schema_version: z.literal(1),
+    id: z.string().regex(ARCHITECTURE_SCHEMA_ID_PATTERN),
+    title: z.string().min(10),
+    stack: z.string().min(1),
+    authority: z.array(qualityAuthorityRefSchema).min(1),
+    applies_to: z.object({
+        plugin: z.string().min(1).optional(),
+        capability: z.string().min(1).optional(),
+        project_kind: z.string().min(1).optional(),
+    }),
+    layers: z.record(z.string().min(1), architectureLayerRuleSchema).refine((layers) => Object.keys(layers).length > 0, { message: 'At least one architecture layer rule is required.' }),
+    exceptions: z.object({
+        require_adr: z.boolean().default(true),
+        require_expiration: z.boolean().default(true),
+        allowed_refs: z.array(z.string().min(1)).default([]),
+    }),
+    update_policy: z.object({
+        owner: z.string().min(1),
+        review_trigger: z.string().min(1),
+        stale_after_days: z.number().int().positive().optional(),
+    }),
+});
+export const qualityRunFindingSchema = z.object({
+    code: z.string().regex(ISSUE_CODE_PATTERN),
+    severity: z.enum(['info', 'warn', 'error', 'blocker']),
+    message: z.string().min(1),
+    remediation: z.string().min(1),
+    path: safeRelativePathSchema.optional(),
+    gate_id: z.string().min(1).optional(),
+});
+export const qualityRunSchema = z.object({
+    schema_version: z.literal(1),
+    run_id: z.string().regex(RUN_ID_PATTERN),
+    scenario_ref: z.string().regex(SCENARIO_ID_PATTERN),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    started_at: z.string().datetime(),
+    finished_at: z.string().datetime().optional(),
+    mode: z.enum(['dry_run', 'apply_sandbox', 'runtime', 'traceability']),
+    status: z.enum(['passed', 'warning', 'failed', 'blocked']),
+    plugin_ref: z
+        .object({
+        id: z.string().min(1),
+        version: z.string().min(1),
+        capability: z.string().min(1),
+    })
+        .optional(),
+    command: z.object({
+        argv: z.array(z.string().min(1)).min(1),
+        cwd: safeRelativePathSchema.default('.'),
+        env_keys: z.array(z.string().min(1)).default([]),
+    }),
+    schema_versions: z.record(z.string(), z.string()).default({}),
+    artifacts: z.array(safeRelativePathSchema).default([]),
+    findings: z.array(qualityRunFindingSchema).default([]),
+    evidence_bundle_path: safeRelativePathSchema.optional(),
+    metadata: jsonObjectSchema.default({}),
+});
+export const qualityFilesystemSnapshotSchema = z.object({
+    root: safeRelativePathSchema.default('.'),
+    files: z.array(z.object({
+        path: safeRelativePathSchema,
+        size_bytes: z.number().int().nonnegative(),
+        sha256: z.string().min(1).optional(),
+    })).default([]),
+});
+export const qualityImportGraphSchema = z.object({
+    nodes: z.array(safeRelativePathSchema).default([]),
+    edges: z.array(z.object({
+        from: safeRelativePathSchema,
+        to: z.string().min(1),
+        kind: z.enum(['relative', 'package', 'alias']).default('relative'),
+    })).default([]),
+});
+export const qualityEvidenceBundleSchema = z
+    .object({
+    schema_version: z.literal(1),
+    run: qualityRunSchema,
+    scenario: qualityScenarioSchema,
+    architecture_schema: qualityArchitectureSchema.optional(),
+    artifact_manifest: pluginArtifactManifestSchema.optional(),
+    validation_manifest: pluginValidationManifestSchema.optional(),
+    compliance_index: pluginComplianceIndexSchema.optional(),
+    filesystem_snapshot: qualityFilesystemSnapshotSchema,
+    import_graph: qualityImportGraphSchema,
+    command_log_ref: safeRelativePathSchema.optional(),
+    exceptions: z.array(z.object({
+        ref: z.string().min(1),
+        reason: z.string().min(1),
+        expires_at: z.string().datetime().optional(),
+        compensating_control: z.string().min(1),
+    })).default([]),
+    checksums: z.array(z.object({
+        path: safeRelativePathSchema,
+        sha256: z.string().min(1),
+    })).default([]),
+})
+    .superRefine((bundle, context) => {
+    if (bundle.run.scenario_ref !== bundle.scenario.id) {
+        context.addIssue({
+            code: 'custom',
+            path: ['run', 'scenario_ref'],
+            message: `Run scenario_ref ${bundle.run.scenario_ref} must match scenario id ${bundle.scenario.id}.`,
+        });
+    }
+    if (bundle.scenario.feature_ref && bundle.run.feature_ref !== bundle.scenario.feature_ref) {
+        context.addIssue({
+            code: 'custom',
+            path: ['run', 'feature_ref'],
+            message: `Run feature_ref ${bundle.run.feature_ref} must match scenario feature_ref ${bundle.scenario.feature_ref}.`,
+        });
+    }
+    if (bundle.run.evidence_bundle_path) {
+        const expectedPrefix = `.sdd/reports/quality-runs/${bundle.run.run_id}/`;
+        if (!bundle.run.evidence_bundle_path.startsWith(expectedPrefix)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['run', 'evidence_bundle_path'],
+                message: `Evidence bundle path must live under ${expectedPrefix}.`,
+            });
+        }
+    }
+    for (const requiredEvidence of bundle.scenario.required_evidence) {
+        if (!bundleHasRequiredEvidence(bundle, requiredEvidence)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['scenario', 'required_evidence'],
+                message: `Required evidence "${requiredEvidence}" is missing from the evidence bundle.`,
+            });
+        }
+    }
+});
+export function parseQualityScenario(value) {
+    return qualityScenarioSchema.parse(value);
+}
+export function parseQualityArchitectureSchema(value) {
+    return qualityArchitectureSchema.parse(value);
+}
+export function parseQualityRun(value) {
+    return qualityRunSchema.parse(value);
+}
+export function parseQualityEvidenceBundle(value) {
+    return qualityEvidenceBundleSchema.parse(value);
+}
+function isSafeRelativePath(value) {
+    if (value.startsWith('/') || WINDOWS_ABSOLUTE_PATH_PATTERN.test(value)) {
+        return false;
+    }
+    return !value.split(/[\\/]+/u).some((segment) => segment === '..');
+}
+function bundleHasRequiredEvidence(bundle, evidence) {
+    if (evidence === 'artifact_manifest')
+        return Boolean(bundle.artifact_manifest);
+    if (evidence === 'validation_manifest')
+        return Boolean(bundle.validation_manifest);
+    if (evidence === 'compliance_index')
+        return Boolean(bundle.compliance_index);
+    if (evidence === 'architecture_schema')
+        return Boolean(bundle.architecture_schema);
+    if (evidence === 'filesystem_snapshot')
+        return bundle.filesystem_snapshot.files.length > 0;
+    if (evidence === 'import_graph')
+        return bundle.import_graph.nodes.length > 0 || bundle.import_graph.edges.length > 0;
+    if (evidence === 'command_log')
+        return Boolean(bundle.command_log_ref);
+    if (evidence === 'checksums')
+        return bundle.checksums.length > 0;
+    return bundle.run.artifacts.some((artifact) => artifact.includes(evidence));
+}
+//# sourceMappingURL=quality-validation.js.map

package/dist/core/sdd/release-readiness.d.ts

@@ -0,0 +1,19 @@
+export type ReleaseReadinessStatus = 'ready' | 'warning' | 'blocked';
+export interface ReleaseReadinessCheck {
+    id: string;
+    status: 'pass' | 'warn' | 'fail';
+    summary: string;
+    evidence?: string;
+}
+export interface ReleaseReadinessReport {
+    schema_version: 1;
+    status: ReleaseReadinessStatus;
+    generated_at: string;
+    blockers: string[];
+    warnings: string[];
+    checks: ReleaseReadinessCheck[];
+    ci_parity_commands: string[];
+}
+export declare function evaluateReleaseReadiness(projectRoot: string): Promise<ReleaseReadinessReport>;
+export declare function formatReleaseReadinessReport(report: ReleaseReadinessReport): string;
+//# sourceMappingURL=release-readiness.d.ts.map