@genn-inc/cluebase-cli 0.0.1

package/src/setup-check.mjs

@@ -0,0 +1,575 @@
+// setup-check: mechanical verification of installed setup steps, secret
+// leaks, and SDK lifecycle presence. Constants live in setup-check-constants,
+// scan/detector helpers in setup-check-scan-a / -scan-b.
+
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import {
+  findLifecycleCallApiNames,
+  findLifecycleGuardViolations,
+  stripSourceNoise,
+} from "./lifecycle-guard.mjs";
+import {
+  backendSdkSpecForFramework,
+  FRONTEND_SDK_PACKAGE,
+  REQUIRED_LIFECYCLE_APIS,
+  sourceMatchesBackendInit,
+} from "./setup-check-constants.mjs";
+import {
+  addCheck,
+  dependencyHasAnyPackage,
+  findFrontendLifecycleNonPublicEnvFiles,
+  findSecretLeaks,
+  frontendPackageRoots,
+  packageJsonSourcesWithDependency,
+  readAllowedSourceText,
+  readDependencyText,
+  readFrontendConfigText,
+  readSetupManifest,
+  setupBackendRootPaths,
+  setupSourcePaths,
+  sourceHasAuthCallbackScopedCluebaseInitCall,
+  sourceHasComponentScopedCluebaseInitCall,
+  sourceHasVerifiedFrontendSdkAccess,
+  sourceIsUnderFrontendRoot,
+  sourcesHaveBackendSdkImport,
+  sourcesHaveFrontendSdkImport,
+  startsWithRoot,
+  validateSetupManifestContract,
+  validateSetupStepFiles,
+} from "./setup-check-scan-a.mjs";
+import {
+  companyBoundaryPattern,
+  findBackendCluebaseEnvRequiredIndexFiles,
+  findBackendLifecycleReadEndpointFiles,
+  findBackendSdkInitMissingServiceKeyFiles,
+  findCluebaseInitCallEmptyEnvFallbackFiles,
+  findFastapiMissingMiddlewareFiles,
+  findFrontendBackendTracePropagationMissingFiles,
+  findFrontendInitBeforeCluebaseInitCallFiles,
+  findFrontendLifecycleReadSideEffectFiles,
+  findHardcodedLifecycleIdentityFiles,
+  findNextLifecycleMissingUseClientFiles,
+  findRepeatedIdentityHelperFiles,
+  frontendIdentityBoundaryPattern,
+  identityBoundaryPattern,
+  logoutBoundaryPattern,
+} from "./setup-check-scan-b.mjs";
+
+// FIX-118: the discovery artifact records where the setup AI decided the
+// lifecycle boundaries actually are. setup-check uses that placement as the
+// source of truth for whether the backend needs identify/group, instead of
+// re-pattern-matching the raw backend source (which cannot distinguish a real
+// one-time auth boundary from a reused token-hydration path).
+const readDiscoveries = async (repoRoot) => {
+	try {
+		const raw = await readFile(
+			join(repoRoot, ".cluebase", "discoveries.json"),
+			"utf8",
+		);
+		const parsed = JSON.parse(raw);
+		return parsed && typeof parsed === "object" ? parsed : null;
+	} catch {
+		return null;
+	}
+};
+
+const siteIsUnderBackend = (site, backendRootPaths) =>
+	typeof site?.file === "string" &&
+	backendRootPaths.some((root) => startsWithRoot(site.file, root));
+
+// Returns { present, hasBackendIdentify, hasBackendGroup } from discoveries.
+// `present: false` means no discovery artifact — callers fall back to the
+// pattern-based requirement.
+export const backendBoundariesFromDiscovery = (
+	discoveries,
+	backendRootPaths = [],
+) => {
+	if (!discoveries || typeof discoveries !== "object") {
+		return { present: false };
+	}
+	const identifySites = Array.isArray(discoveries.identify_sites)
+		? discoveries.identify_sites
+		: [];
+	const groupSites = Array.isArray(discoveries.group_sites)
+		? discoveries.group_sites
+		: [];
+	return {
+		present: true,
+		hasBackendIdentify: identifySites.some((site) =>
+			siteIsUnderBackend(site, backendRootPaths),
+		),
+		hasBackendGroup: groupSites.some((site) =>
+			siteIsUnderBackend(site, backendRootPaths),
+		),
+	};
+};
+
+const checkSdkLifecycle = ({
+	backendRootPaths = [],
+	dependencySources = [],
+	discoveryBackendBoundaries = null,
+	framework,
+	sources,
+}) => {
+	const combined = sources
+		.map((source) => stripSourceNoise(source.text, { stripStrings: true }))
+		.join("\n");
+	const backendSources = sources.filter((source) =>
+		backendRootPaths.some((root) => startsWithRoot(source.file_path, root)),
+	);
+	const frontendRootPaths = frontendPackageRoots(dependencySources);
+	const frontendSources = sources.filter(
+		(source) =>
+			!backendRootPaths.some((root) =>
+				startsWithRoot(source.file_path, root),
+			) && sourceIsUnderFrontendRoot(source, frontendRootPaths),
+	);
+	const backendCombined = backendSources
+		.map((source) => stripSourceNoise(source.text, { stripStrings: true }))
+		.join("\n");
+	const frontendCombined = frontendSources
+		.map((source) => stripSourceNoise(source.text, { stripStrings: true }))
+		.join("\n");
+	const foundApiNames = findLifecycleCallApiNames(combined);
+	const backendFoundApiNames = findLifecycleCallApiNames(backendCombined);
+	const frontendFoundApiNames = findLifecycleCallApiNames(frontendCombined);
+	const sourceByPath = new Map(
+		sources.map((source) => [source.file_path, source]),
+	);
+	const frontendLifecycleFilesWithoutVerifiedSdk = frontendSources
+		.filter(
+			(source) =>
+				findLifecycleCallApiNames(
+					stripSourceNoise(source.text, { stripStrings: true }),
+				).length > 0,
+		)
+		.filter((source) => {
+			const apiNames = findLifecycleCallApiNames(
+				stripSourceNoise(source.text, { stripStrings: true }),
+			);
+			return !sourceHasVerifiedFrontendSdkAccess({
+				apiNames,
+				source,
+				sourceByPath,
+			});
+		})
+		.map((source) => source.file_path);
+	let missingApis = [];
+	// `CluebaseInit` is the prescribed App Router bootstrap Client Component
+	// (see STEP 5: `export function CluebaseInit() { return null; }`), so a
+	// declaration of that name is the intended pattern, not a no-op shim. A
+	// `window.CluebaseInit` global assignment is still a shim signal, and
+	// `function/const CluebaseIdentify|CluebaseSetOrganization|CluebaseLogout` are never
+	// prescribed component names, so those remain flagged.
+	const noOpPattern =
+		/window\.Cluebase(?:Init|Identify|SetOrganization|Logout)|(?:function|const|let|var)\s+Cluebase(?:Identify|SetOrganization|Logout)\b/;
+	const componentLifecycleInitFiles = sources
+		.filter((source) => sourceHasComponentScopedCluebaseInitCall(source.text))
+		.map((source) => source.file_path);
+	const authCallbackLifecycleInitFiles = frontendSources
+		.filter((source) => sourceHasAuthCallbackScopedCluebaseInitCall(source.text))
+		.map((source) => source.file_path);
+	const blockingLifecycleCalls = sources.flatMap((source) =>
+		findLifecycleGuardViolations(
+			stripSourceNoise(source.text, { stripStrings: true }),
+		).map((violation) => ({
+			file_path: source.file_path,
+			...violation,
+		})),
+	);
+	const blockingLifecycleFiles = [
+		...new Set(blockingLifecycleCalls.map((violation) => violation.file_path)),
+	];
+	const backendPresent = backendSources.length > 0;
+	const backendSpec = backendSdkSpecForFramework(framework);
+	const backendSdkDependencyPresent =
+		!backendPresent ||
+		dependencyHasAnyPackage(dependencySources, backendSpec.packages);
+	const backendSdkImportPresent =
+		!backendPresent ||
+		sourcesHaveBackendSdkImport(backendSources, backendSpec);
+	const backendSdkPresent =
+		!backendPresent || (backendSdkDependencyPresent && backendSdkImportPresent);
+	const backendSdkInstallabilityVerified =
+		!backendPresent || backendSpec.installabilityStatus !== "unverified";
+	const backendInitPresent =
+		!backendPresent || sourceMatchesBackendInit(framework, backendCombined);
+	const backendInitObserved = backendPresent && backendInitPresent;
+	const foundApis = REQUIRED_LIFECYCLE_APIS.filter(
+		(api) =>
+			foundApiNames.includes(api) ||
+			(api === "cluebase.init" && backendInitObserved),
+	);
+	const backendSdkInitMissingServiceKeyFiles =
+		findBackendSdkInitMissingServiceKeyFiles({
+			backendSources,
+			framework,
+		});
+	const fastapiMissingMiddlewareFiles = findFastapiMissingMiddlewareFiles({
+		backendSources,
+		framework,
+	});
+	const backendCluebaseEnvRequiredIndexFiles =
+		findBackendCluebaseEnvRequiredIndexFiles(backendSources);
+	const hardcodedLifecycleIdentityFiles =
+		findHardcodedLifecycleIdentityFiles(sources);
+	const backendLifecycleReadEndpointFiles =
+		findBackendLifecycleReadEndpointFiles(backendSources);
+	const frontendLifecyclePresent = frontendFoundApiNames.length > 0;
+	const frontendSdkDependencyPresent =
+		!frontendLifecyclePresent ||
+		packageJsonSourcesWithDependency(dependencySources, FRONTEND_SDK_PACKAGE)
+			.length > 0;
+	const frontendSdkImportPresent =
+		!frontendLifecyclePresent || sourcesHaveFrontendSdkImport(frontendSources);
+	const frontendSdkPresent =
+		!frontendLifecyclePresent ||
+		(frontendSdkDependencyPresent && frontendSdkImportPresent);
+	const frontendLifecycleNonPublicEnvFiles =
+		findFrontendLifecycleNonPublicEnvFiles({
+			frontendSources,
+		});
+	const frontendLifecycleReadSideEffectFiles =
+		findFrontendLifecycleReadSideEffectFiles(frontendSources);
+	const repeatedIdentityHelperFiles = findRepeatedIdentityHelperFiles(sources);
+	const cluebaseInitEmptyEnvFallbackFiles =
+		findCluebaseInitCallEmptyEnvFallbackFiles(frontendSources);
+	const frontendInitBeforeCluebaseInitCallFiles =
+		findFrontendInitBeforeCluebaseInitCallFiles(frontendSources);
+	const frontendBackendTracePropagationMissingFiles =
+		findFrontendBackendTracePropagationMissingFiles({
+			backendPresent,
+			frontendSources,
+		});
+	const nextLifecycleMissingUseClientFiles =
+		findNextLifecycleMissingUseClientFiles({
+			dependencySources,
+			frontendSources,
+		});
+	// FIX-118: pattern-matching the backend source only tells us the backend
+	// *has auth/organization-shaped routes*, not whether any of them is a real
+	// one-time boundary. When the discovery artifact is available, use its
+	// actual placement decision as the source of truth; fall back to the
+	// pattern only when discovery is absent (e.g. setup-check run standalone).
+	const backendPatternIdentity =
+		backendPresent && identityBoundaryPattern.test(backendCombined);
+	const backendPatternOrganization =
+		backendPresent && companyBoundaryPattern.test(backendCombined);
+	const backendIdentityRequired = discoveryBackendBoundaries?.present
+		? Boolean(discoveryBackendBoundaries.hasBackendIdentify)
+		: backendPatternIdentity;
+	const backendOrganizationRequired = discoveryBackendBoundaries?.present
+		? Boolean(discoveryBackendBoundaries.hasBackendGroup)
+		: backendPatternOrganization;
+	// No silent skip: when the source pattern matched but discovery deferred the
+	// boundary to the client (browser auth), record why the requirement lifted.
+	const backendIdentityDeferredToClient =
+		Boolean(discoveryBackendBoundaries?.present) &&
+		backendPatternIdentity &&
+		!backendIdentityRequired;
+	const backendOrganizationDeferredToClient =
+		Boolean(discoveryBackendBoundaries?.present) &&
+		backendPatternOrganization &&
+		!backendOrganizationRequired;
+	const backendLogoutRequired =
+		backendPresent && logoutBoundaryPattern.test(backendCombined);
+	const backendMissingApis = [
+		...(backendIdentityRequired &&
+		!backendFoundApiNames.includes("cluebase.identify")
+			? ["cluebase.identify"]
+			: []),
+		...(backendLogoutRequired && !backendFoundApiNames.includes("cluebase.reset")
+			? ["cluebase.reset"]
+			: []),
+		...(backendOrganizationRequired &&
+		!backendFoundApiNames.includes("cluebase.group")
+			? ["cluebase.group"]
+			: []),
+	];
+	const frontendIdentityRequired =
+		frontendSources.length > 0 &&
+		frontendIdentityBoundaryPattern.test(frontendCombined);
+	const frontendLogoutRequired =
+		frontendSources.length > 0 && logoutBoundaryPattern.test(frontendCombined);
+	const frontendOrganizationRequired =
+		frontendSources.length > 0 && companyBoundaryPattern.test(frontendCombined);
+	const frontendLifecycleRequired =
+		frontendLifecyclePresent ||
+		frontendIdentityRequired ||
+		frontendOrganizationRequired ||
+		frontendLogoutRequired;
+	const frontendMissingApis = [
+		...(frontendLifecycleRequired &&
+		!frontendFoundApiNames.includes("cluebase.init")
+			? ["cluebase.init"]
+			: []),
+		...(frontendIdentityRequired &&
+		!frontendFoundApiNames.includes("cluebase.identify")
+			? ["cluebase.identify"]
+			: []),
+		...(frontendOrganizationRequired &&
+		!frontendFoundApiNames.includes("cluebase.group")
+			? ["cluebase.group"]
+			: []),
+		...(frontendLogoutRequired && !frontendFoundApiNames.includes("cluebase.reset")
+			? ["cluebase.reset"]
+			: []),
+	];
+	const requiredApis = [
+		...(backendPresent || frontendSources.length > 0 ? ["cluebase.init"] : []),
+		...(backendIdentityRequired || frontendIdentityRequired
+			? ["cluebase.identify"]
+			: []),
+		...(backendOrganizationRequired || frontendOrganizationRequired
+			? ["cluebase.group"]
+			: []),
+		...(backendLogoutRequired || frontendLogoutRequired ? ["cluebase.reset"] : []),
+	];
+	missingApis = [...new Set(requiredApis)].filter(
+		(api) => !foundApis.includes(api),
+	);
+	return {
+		foundApis,
+		missingApis,
+		required_apis: [...new Set(requiredApis)],
+		backend_lifecycle: {
+			backend_present: backendPresent,
+			backend_root_paths: backendRootPaths,
+			dependency_files: dependencySources.map((source) => source.file_path),
+			expected_sdk_packages: backendSpec.packages,
+			expected_sdk_imports: backendSpec.imports,
+			sdk_installability_status: backendSpec.installabilityStatus,
+			sdk_installability_verified: backendSdkInstallabilityVerified,
+			sdk_blocker: backendSdkInstallabilityVerified
+				? null
+				: backendSpec.blocker,
+			sdk_dependency_present: backendSdkDependencyPresent,
+			sdk_import_present: backendSdkImportPresent,
+			sdk_dependency_or_import_present: backendSdkPresent,
+			sdk_init_present: backendInitPresent,
+			sdk_init_missing_service_key_files: backendSdkInitMissingServiceKeyFiles,
+			fastapi_missing_middleware_files: fastapiMissingMiddlewareFiles,
+			cluebase_env_required_index_files: backendCluebaseEnvRequiredIndexFiles,
+			hardcoded_lifecycle_identity_files:
+				hardcodedLifecycleIdentityFiles.filter((filePath) =>
+					backendRootPaths.some((root) => startsWithRoot(filePath, root)),
+				),
+			repeated_identity_helper_files:
+				repeatedIdentityHelperFiles.filter((filePath) =>
+					backendRootPaths.some((root) => startsWithRoot(filePath, root)),
+				),
+			lifecycle_read_endpoint_files: backendLifecycleReadEndpointFiles,
+			required_apis: [
+				...(backendIdentityRequired ? ["cluebase.identify"] : []),
+				...(backendOrganizationRequired ? ["cluebase.group"] : []),
+				...(backendLogoutRequired ? ["cluebase.reset"] : []),
+			],
+			missing_apis: backendMissingApis,
+			identity_deferred_to_client: backendIdentityDeferredToClient,
+			organization_deferred_to_client: backendOrganizationDeferredToClient,
+			lifecycle_deferral_reason:
+				backendIdentityDeferredToClient || backendOrganizationDeferredToClient
+					? "discovery determined the user's identity / active organization is established client-side (browser auth); the backend has no one-time auth boundary, so backend cluebase.identify / cluebase.group are not required here. Frontend identify / group coverage is still verified."
+					: null,
+		},
+		frontend_lifecycle: {
+			lifecycle_present: frontendLifecyclePresent,
+			found_apis: frontendFoundApiNames,
+			expected_sdk_package: FRONTEND_SDK_PACKAGE,
+			sdk_dependency_present: frontendSdkDependencyPresent,
+			sdk_import_present: frontendSdkImportPresent,
+			sdk_dependency_or_import_present: frontendSdkPresent,
+			lifecycle_files_without_verified_sdk:
+				frontendLifecycleFilesWithoutVerifiedSdk,
+			wrong_sdk_packages: [],
+			frontend_lifecycle_non_public_env_files:
+				frontendLifecycleNonPublicEnvFiles,
+			cluebase_init_empty_env_fallback_files: cluebaseInitEmptyEnvFallbackFiles,
+			frontend_init_before_cluebase_init_files: frontendInitBeforeCluebaseInitCallFiles,
+			backend_trace_propagation_missing_files:
+				frontendBackendTracePropagationMissingFiles,
+			next_lifecycle_missing_use_client_files:
+				nextLifecycleMissingUseClientFiles,
+			lifecycle_read_side_effect_files: frontendLifecycleReadSideEffectFiles,
+			hardcoded_lifecycle_identity_files:
+				hardcodedLifecycleIdentityFiles.filter(
+					(filePath) =>
+						!backendRootPaths.some((root) => startsWithRoot(filePath, root)),
+				),
+			repeated_identity_helper_files:
+				repeatedIdentityHelperFiles.filter(
+					(filePath) =>
+						!backendRootPaths.some((root) => startsWithRoot(filePath, root)),
+				),
+			required_apis: [
+				...(frontendLifecycleRequired ? ["cluebase.init"] : []),
+				...(frontendIdentityRequired ? ["cluebase.identify"] : []),
+				...(frontendOrganizationRequired ? ["cluebase.group"] : []),
+				...(frontendLogoutRequired ? ["cluebase.reset"] : []),
+			],
+			missing_apis: frontendMissingApis,
+		},
+		has_noop_wrapper: noOpPattern.test(combined),
+		component_lifecycle_init_files: componentLifecycleInitFiles,
+		auth_callback_lifecycle_init_files: authCallbackLifecycleInitFiles,
+		blocking_lifecycle_files: blockingLifecycleFiles,
+		blocking_lifecycle_calls: blockingLifecycleCalls,
+		unguarded_lifecycle_files: blockingLifecycleFiles,
+		unguarded_lifecycle_calls: blockingLifecycleCalls,
+		passed:
+			missingApis.length === 0 &&
+			backendSdkPresent &&
+			backendSdkInstallabilityVerified &&
+			backendInitPresent &&
+			backendSdkInitMissingServiceKeyFiles.length === 0 &&
+			fastapiMissingMiddlewareFiles.length === 0 &&
+			backendCluebaseEnvRequiredIndexFiles.length === 0 &&
+			hardcodedLifecycleIdentityFiles.length === 0 &&
+			repeatedIdentityHelperFiles.length === 0 &&
+			backendLifecycleReadEndpointFiles.length === 0 &&
+			backendMissingApis.length === 0 &&
+			frontendMissingApis.length === 0 &&
+			frontendSdkPresent &&
+			frontendLifecycleFilesWithoutVerifiedSdk.length === 0 &&
+			frontendLifecycleNonPublicEnvFiles.length === 0 &&
+			cluebaseInitEmptyEnvFallbackFiles.length === 0 &&
+			frontendInitBeforeCluebaseInitCallFiles.length === 0 &&
+			frontendBackendTracePropagationMissingFiles.length === 0 &&
+			nextLifecycleMissingUseClientFiles.length === 0 &&
+			authCallbackLifecycleInitFiles.length === 0 &&
+			frontendLifecycleReadSideEffectFiles.length === 0 &&
+			!noOpPattern.test(combined) &&
+			componentLifecycleInitFiles.length === 0 &&
+			blockingLifecycleFiles.length === 0,
+	};
+};
+
+export const runSetupCheck = async ({
+	repoRoot,
+	request,
+	requireSdkLifecycle = false,
+}) => {
+	const resolvedRepoRoot = resolve(repoRoot ?? ".");
+	const checks = [];
+	const setupManifest = await readSetupManifest(resolvedRepoRoot);
+	const manifestContract = validateSetupManifestContract(setupManifest);
+	addCheck(
+		checks,
+		"setup_manifest_contract",
+		!(requireSdkLifecycle || setupManifest) ||
+			(manifestContract.checked && manifestContract.findings.length === 0),
+		manifestContract.checked
+			? manifestContract.findings.length === 0
+				? "setup manifest contains current AI setup responsibility boundaries"
+				: "setup manifest is missing current AI setup responsibility boundaries"
+			: "setup manifest contract was not checked because .cluebase/setup-manifest.json is absent or unreadable",
+		{
+			checked: manifestContract.checked,
+			findings: manifestContract.findings,
+		},
+	);
+
+	const missingSetupSteps = await validateSetupStepFiles({
+		repoRoot: resolvedRepoRoot,
+	});
+	addCheck(
+		checks,
+		"setup_step_files",
+		missingSetupSteps.length === 0,
+		missingSetupSteps.length === 0
+			? "nine setup step files are installed"
+			: "setup step files are missing",
+		{ missing_files: missingSetupSteps },
+	);
+
+	const sourcePaths = await setupSourcePaths({
+		repoRoot: resolvedRepoRoot,
+		request,
+		includeFrontend: requireSdkLifecycle,
+		setupManifest,
+	});
+	const excludedPaths = request?.excluded_source_paths ?? [];
+	const sources = await readAllowedSourceText({
+		repoRoot: resolvedRepoRoot,
+		allowedSourcePaths: sourcePaths,
+		excludedSourcePaths: excludedPaths,
+	});
+	const dependencySources = await readDependencyText({
+		repoRoot: resolvedRepoRoot,
+		roots: sourcePaths,
+	});
+	const frontendConfigSources = requireSdkLifecycle
+		? await readFrontendConfigText({
+				repoRoot: resolvedRepoRoot,
+				roots: sourcePaths,
+			})
+		: [];
+	const secretLeaks = findSecretLeaks([
+		...sources,
+		...dependencySources,
+		...frontendConfigSources,
+	]);
+	addCheck(
+		checks,
+		"no_secret_values",
+		secretLeaks.length === 0,
+		"no obvious secret values found",
+		{
+			files: secretLeaks,
+		},
+	);
+
+	if (requireSdkLifecycle) {
+		const backendRootPaths = setupBackendRootPaths(request);
+		const discoveries = await readDiscoveries(resolvedRepoRoot);
+		const discoveryBackendBoundaries = backendBoundariesFromDiscovery(
+			discoveries,
+			backendRootPaths,
+		);
+		const sdkLifecycle = checkSdkLifecycle({
+			backendRootPaths,
+			dependencySources,
+			discoveryBackendBoundaries,
+			framework: request?.framework,
+			sources,
+		});
+		addCheck(
+			checks,
+			"sdk_lifecycle",
+			sdkLifecycle.passed,
+			"static SDK lifecycle references are present and non-blocking; dependency install, import, app startup, and event delivery are not verified by this check",
+			{
+				found_apis: sdkLifecycle.foundApis,
+				missing_apis: sdkLifecycle.missingApis,
+				required_apis: sdkLifecycle.required_apis,
+				verification_scope:
+					"static_source_only_not_dependency_install_or_runtime_event_delivery",
+				backend_lifecycle: sdkLifecycle.backend_lifecycle,
+				frontend_lifecycle: sdkLifecycle.frontend_lifecycle,
+				has_noop_wrapper: sdkLifecycle.has_noop_wrapper,
+				component_lifecycle_init_files:
+					sdkLifecycle.component_lifecycle_init_files,
+				auth_callback_lifecycle_init_files:
+					sdkLifecycle.auth_callback_lifecycle_init_files,
+				blocking_lifecycle_files: sdkLifecycle.blocking_lifecycle_files,
+				blocking_lifecycle_calls: sdkLifecycle.blocking_lifecycle_calls,
+				unguarded_lifecycle_files: sdkLifecycle.unguarded_lifecycle_files,
+				unguarded_lifecycle_calls: sdkLifecycle.unguarded_lifecycle_calls,
+			},
+		);
+	}
+
+	const passed = checks.every((check) => check.passed);
+	return {
+		passed,
+		static_passed: passed,
+		completion_status:
+			passed && requireSdkLifecycle
+				? "static_passed_runtime_verification_required"
+				: passed
+					? "passed"
+					: "failed",
+		checks,
+	};
+};