@happyvertical/smrt-dev-mcp 0.60.8 → 0.60.10

package/dist/review-smrt-project-ByEwPcor.js

@@ -0,0 +1,774 @@
+import { existsSync, readFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { access, readFile, readdir } from "node:fs/promises";
+//#region src/tools/intent-detector.ts
+var COMMENT_LINE = /^\s*(\/\/|\/\*|\*|<!--)/;
+function normalizeSpecifier(value) {
+	if (value.startsWith("@")) {
+		const [scope, name] = value.split("/");
+		return scope && name ? `${scope}/${name}` : value;
+	}
+	return value.split("/")[0];
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** `*_cents`-style glob (`*` = any run) -> case-insensitive anchored regex. */
+function globToRegExp(glob) {
+	const pattern = glob.split("*").map((part) => escapeRegExp(part)).join(".*");
+	return new RegExp(`^${pattern}$`, "i");
+}
+function camelToSnake(name) {
+	return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}
+var DECIMAL_PROPERTY = /^\s*(?:(?:public|private|protected|readonly|static)\s+)*(\w+)\s*(?::\s*number\s*)?=\s*-?\d+\.\d+/;
+var DECIMAL_TYPED_FIELD = /@field\(\s*\{[^}]*type\s*:\s*['"]decimal['"][^}]*\}\s*\)\s*(?:(?:public|private|protected|readonly)\s+)*(\w+)/;
+/**
+* Signal grammar. Add a kind here only when an index row cannot be expressed
+* with the existing ones; intents themselves never appear in this file.
+*
+* - `import:<module>`  the module (or a subpath of it) is imported.
+* - `call:<ident>`     `ident(` appears in code.
+* - `regex:<pattern>`  the JavaScript regular expression matches a line.
+* - `decimal-field:<glob>`  a property whose name matches the glob (compared
+*   as written and as snake_case) is declared with a decimal literal
+*   (`= 0.0`) or `@field({ type: 'decimal' })`.
+*/
+var COMPILERS = {
+	import: (signal) => ({ matchImport: normalizeSpecifier(signal.value) }),
+	call: (signal) => {
+		if (!/^[\w$.]+$/.test(signal.value)) return { error: `invalid identifier "${signal.value}"` };
+		const pattern = new RegExp(`(?<![\\w$])${escapeRegExp(signal.value)}\\s*\\(`);
+		return { matchLine: (line) => pattern.test(line) };
+	},
+	regex: (signal) => {
+		try {
+			const pattern = new RegExp(signal.value);
+			return { matchLine: (line) => pattern.test(line) };
+		} catch (error) {
+			return { error: `invalid regular expression (${error instanceof Error ? error.message : String(error)})` };
+		}
+	},
+	"decimal-field": (signal) => {
+		const glob = globToRegExp(signal.value);
+		const matches = (name) => !!name && (glob.test(name) || glob.test(camelToSnake(name)));
+		return { matchLine: (line) => matches(DECIMAL_PROPERTY.exec(line)?.[1]) || matches(DECIMAL_TYPED_FIELD.exec(line)?.[1]) };
+	}
+};
+Object.keys(COMPILERS);
+function compileRow(row, noted, onNote) {
+	const compiled = [];
+	for (const signal of row.signals) {
+		const compiler = COMPILERS[signal.kind];
+		const skip = (reason) => {
+			const key = `${row.intentPage}\0${signal.raw}`;
+			if (noted.has(key)) return;
+			noted.add(key);
+			onNote(`intent index: skipping signal \`${signal.raw}\` for ${row.intentPage} (${reason})`);
+		};
+		if (!compiler) {
+			skip(`unknown signal kind "${signal.kind}"`);
+			continue;
+		}
+		const result = compiler(signal);
+		if ("error" in result) skip(result.error);
+		else compiled.push({
+			raw: signal.raw,
+			...result
+		});
+	}
+	return compiled;
+}
+function importLine(file, specifier) {
+	const lines = file.content.split("\n");
+	const pattern = new RegExp(`['"]${escapeRegExp(specifier)}(?:/[^'"]*)?['"]`);
+	const index = lines.findIndex((line) => !COMMENT_LINE.test(line) && pattern.test(line));
+	return index < 0 ? 1 : index + 1;
+}
+/**
+* For every (intent row, package) where a signal is present and the package
+* imports none of the row's home packages, emit one finding.
+*/
+function detectHandRolled(rows, packages, options = {}) {
+	const onNote = options.onNote ?? (() => void 0);
+	const maxEvidence = options.maxEvidence ?? 6;
+	const noted = /* @__PURE__ */ new Set();
+	const findings = [];
+	for (const row of rows) {
+		const signals = compileRow(row, noted, onNote);
+		if (signals.length === 0 || row.homePackages.length === 0) continue;
+		const homeNames = row.homePackages.map((home) => home.packageName);
+		for (const pkg of packages) {
+			if (pkg.name && homeNames.includes(pkg.name)) continue;
+			if (pkg.files.some((file) => file.imports.some((specifier) => homeNames.includes(specifier)))) continue;
+			const evidence = [];
+			const matched = /* @__PURE__ */ new Set();
+			for (const file of pkg.files) for (const signal of signals) if (signal.matchImport !== void 0) {
+				if (!file.imports.includes(signal.matchImport)) continue;
+				matched.add(signal.raw);
+				evidence.push({
+					filePath: file.relativePath,
+					line: importLine(file, signal.matchImport),
+					signal: signal.raw,
+					detail: `Imports ${signal.matchImport}`
+				});
+			} else if (signal.matchLine) {
+				const lines = file.content.split("\n");
+				for (let index = 0; index < lines.length; index += 1) {
+					if (COMMENT_LINE.test(lines[index])) continue;
+					if (!signal.matchLine(lines[index])) continue;
+					matched.add(signal.raw);
+					evidence.push({
+						filePath: file.relativePath,
+						line: index + 1,
+						signal: signal.raw,
+						detail: `Matches ${signal.raw}`
+					});
+					break;
+				}
+			}
+			if (evidence.length === 0) continue;
+			evidence.sort((left, right) => left.filePath.localeCompare(right.filePath) || left.line - right.line);
+			findings.push({
+				code: `hand-rolled-${row.intentPage.replace(/^\/intents\//, "").replace(/\.md$/, "")}`,
+				intent: row.intent,
+				intentPage: row.intentPage,
+				componentPages: row.homePackages.map((home) => home.componentPage),
+				entryPoint: row.entryPoint,
+				packageName: pkg.name ?? pkg.relativePath,
+				packagePath: pkg.relativePath,
+				installedHomePackages: homeNames.filter((name) => pkg.installed.has(name)),
+				homePackages: homeNames,
+				matchedSignals: Array.from(matched),
+				evidence: evidence.slice(0, maxEvidence)
+			});
+		}
+	}
+	return findings;
+}
+//#endregion
+//#region src/tools/intent-index.ts
+var PACKAGE_SCOPE = "@happyvertical/";
+/** Split a table row on unescaped pipes, unescaping `\|` inside cells. */
+function splitRow(line) {
+	const cells = [];
+	let current = "";
+	for (let index = 0; index < line.length; index += 1) {
+		const char = line[index];
+		if (char === "\\" && line[index + 1] === "|") {
+			current += "|";
+			index += 1;
+		} else if (char === "|") {
+			cells.push(current);
+			current = "";
+		} else current += char;
+	}
+	cells.push(current);
+	if (cells[0]?.trim() === "") cells.shift();
+	if (cells.length > 0 && cells[cells.length - 1].trim() === "") cells.pop();
+	return cells.map((cell) => cell.trim());
+}
+function linkTargets(cell) {
+	return Array.from(cell.matchAll(/\[([^\]]*)\]\(([^)\s]+)\)/g)).map((match) => ({
+		text: match[1],
+		href: match[2]
+	}));
+}
+/** `/intents/x.md`, `./x.md` or `x.md` -> `/<kind>/x.md`. */
+function conceptId(href, kind) {
+	return `/${kind}/${href.split("#")[0].split("/").pop() ?? href}`;
+}
+function parseSignals(cell) {
+	const signals = [];
+	for (const match of cell.matchAll(/`([^`]+)`/g)) {
+		const raw = match[1].trim();
+		const colon = raw.indexOf(":");
+		if (colon <= 0) {
+			signals.push({
+				kind: "",
+				value: raw,
+				raw
+			});
+			continue;
+		}
+		signals.push({
+			kind: raw.slice(0, colon).trim(),
+			value: raw.slice(colon + 1),
+			raw
+		});
+	}
+	return signals;
+}
+/**
+* Parse the first intent table found in `markdown`. Columns are located by
+* header name (`Intent`, `Page`, `Home package(s)`, `Entry point`,
+* `Hand-rolled signals`) so column order may change. Rows without a page link
+* are ignored.
+*/
+function parseIntentIndex(markdown) {
+	const lines = markdown.split(/\r?\n/);
+	const headerIndex = lines.findIndex((line) => /^\s*\|/.test(line) && /\bintent\b/i.test(line));
+	if (headerIndex < 0) return [];
+	const headers = splitRow(lines[headerIndex]).map((cell) => cell.toLowerCase());
+	const column = (needle, fallback) => {
+		const found = headers.findIndex((header) => header.includes(needle));
+		return found >= 0 ? found : fallback;
+	};
+	const columns = {
+		intent: column("intent", 0),
+		page: column("page", 1),
+		home: column("home", 2),
+		entry: column("entry", 3),
+		signals: column("signal", 4)
+	};
+	const rows = [];
+	for (const line of lines.slice(headerIndex + 1)) {
+		if (!/^\s*\|/.test(line)) {
+			if (rows.length > 0 || line.trim() !== "") break;
+			continue;
+		}
+		if (/^\s*\|[\s:|-]+\|\s*$/.test(line)) continue;
+		const cells = splitRow(line);
+		const pageLink = linkTargets(cells[columns.page] ?? "")[0];
+		if (!pageLink) continue;
+		const homePackages = linkTargets(cells[columns.home] ?? "").map((link) => {
+			const componentPage = conceptId(link.href, "components");
+			const name = componentPage.replace(/^\/components\//, "").replace(/\.md$/, "");
+			return {
+				name,
+				packageName: `${PACKAGE_SCOPE}${name}`,
+				componentPage
+			};
+		});
+		rows.push({
+			intent: cells[columns.intent] ?? "",
+			intentPage: conceptId(pageLink.href, "intents"),
+			homePackages,
+			entryPoint: cells[columns.entry] ?? "",
+			signals: parseSignals(cells[columns.signals] ?? "")
+		});
+	}
+	return rows;
+}
+//#endregion
+//#region src/tools/review-smrt-project.ts
+/**
+* Ecosystem-aware downstream project review.
+* Advisory only: scans manifests and source files, then reports alignment risks.
+*/
+/** Relative location of the intent index inside this package's `dist/`. */
+var PACKAGED_INTENT_INDEX = join("dist", "knowledge", "intents", "index.md");
+function findOwnPackageRoot() {
+	let current = dirname(fileURLToPath(import.meta.url));
+	for (;;) {
+		const manifest = join(current, "package.json");
+		if (existsSync(manifest)) try {
+			if (JSON.parse(readFileSync(manifest, "utf-8")).name === "@happyvertical/smrt-dev-mcp") return current;
+		} catch {}
+		const parent = dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+/**
+* Locations of the trusted default intent index, in resolution order (#4690):
+* the packaged full index, then the monorepo's committed index when this
+* package sits in `<repo>/packages/` of the smrt checkout. The reviewed
+* project's own tree is never consulted.
+*/
+function defaultIntentIndexCandidates(packageRoot) {
+	const root = packageRoot ?? findOwnPackageRoot();
+	if (!root) return [];
+	const candidates = [join(root, PACKAGED_INTENT_INDEX)];
+	const packagesDir = dirname(root);
+	if (basename(packagesDir) === "packages") {
+		const repoRoot = dirname(packagesDir);
+		if (existsSync(join(repoRoot, "pnpm-workspace.yaml"))) candidates.push(join(repoRoot, "docs", "knowledge", "intents", "index.md"));
+	}
+	return candidates;
+}
+var SOURCE_EXTENSIONS = /\.(tsx?|jsx?|svelte)$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	"build",
+	".git",
+	".smrt",
+	".svelte-kit",
+	"coverage"
+]);
+var DEPENDENCY_SECTIONS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+var SMRT_PACKAGE_PREFIX = "@happyvertical/smrt-";
+var HAPPYVERTICAL_PACKAGE_PREFIX = "@happyvertical/";
+async function reviewSmrtProject(args) {
+	const projectPath = resolve(args.directory ?? args.rootDir ?? process.cwd());
+	if (!await pathExists(projectPath)) return JSON.stringify({
+		projectPath,
+		packageCount: 0,
+		packages: [],
+		findings: [],
+		summary: {
+			high: 0,
+			medium: 0,
+			low: 0
+		},
+		diagnostics: [{
+			severity: "warning",
+			message: `Project directory does not exist: ${projectPath}`
+		}]
+	}, null, 2);
+	const packageContexts = await buildPackageContexts(projectPath);
+	const sourceFiles = await listSourceFiles(projectPath, packageContexts);
+	await attachSourceFiles(sourceFiles, packageContexts, projectPath);
+	const duplicates = await runDuplicateDetection(args, projectPath, packageContexts);
+	const findings = limitFindings([
+		...duplicates.findings,
+		...findMissingHappyVerticalDependencies(packageContexts),
+		...findCustomManifestGeneration(sourceFiles, projectPath),
+		...findDirectStorageBypasses(sourceFiles, packageContexts, projectPath),
+		...findCustomHttpShells(sourceFiles, packageContexts, projectPath),
+		...findLocalAuthTenancy(sourceFiles, packageContexts, projectPath),
+		...findUiShellDrift(packageContexts, projectPath),
+		...findMissingManifestArtifacts(sourceFiles, packageContexts, projectPath)
+	], args.maxFindings);
+	const packages = packageContexts.map(packageInventory).sort((left, right) => left.path.localeCompare(right.path));
+	const summary = summarizeFindings(findings);
+	return JSON.stringify({
+		projectPath,
+		packageCount: packages.length,
+		packages,
+		findings: args.includeSourceEvidence === false ? findings.map(({ evidence: _evidence, ...finding }) => finding) : findings,
+		summary,
+		duplicateDetection: duplicates.status,
+		referenceChecks: [
+			"Prefer SMRT scanner/runtime manifests over custom manifest builders.",
+			"Prefer SvelteKit plus @happyvertical/smrt-svelte for app shells.",
+			"Prefer @happyvertical/sql and @happyvertical/files/assets/content over direct durable node:fs storage.",
+			"Prefer smrt-users, smrt-tenancy, and profile/audit packages over local static auth seams."
+		],
+		suggestedFollowUpIssues: findings.map((finding) => ({
+			title: finding.suggestedIssueTitle,
+			severity: finding.severity,
+			area: finding.area
+		}))
+	}, null, 2);
+}
+async function buildPackageContexts(projectPath) {
+	const packageJsonPaths = await listPackageJsonFiles(projectPath);
+	const contexts = await Promise.all(packageJsonPaths.map(async (packageJsonPath) => {
+		const json = JSON.parse(await readFile(packageJsonPath, "utf-8"));
+		const directory = dirname(packageJsonPath);
+		return {
+			directory,
+			relativePath: relative(projectPath, directory) || ".",
+			packageJsonPath,
+			json,
+			dependencies: collectDependencies(json),
+			scripts: isRecord(json.scripts) ? json.scripts : {},
+			imports: /* @__PURE__ */ new Map(),
+			sourceFiles: []
+		};
+	}));
+	if (contexts.length === 0) contexts.push({
+		directory: projectPath,
+		relativePath: ".",
+		packageJsonPath: join(projectPath, "package.json"),
+		json: {},
+		dependencies: /* @__PURE__ */ new Set(),
+		scripts: {},
+		imports: /* @__PURE__ */ new Map(),
+		sourceFiles: []
+	});
+	return contexts.sort((left, right) => left.directory.length - right.directory.length);
+}
+async function listPackageJsonFiles(projectPath) {
+	const files = [];
+	await visit(projectPath, async (filePath, entryName) => {
+		if (entryName === "package.json") files.push(filePath);
+	});
+	return files;
+}
+async function listSourceFiles(projectPath, packages) {
+	const files = [];
+	await visit(projectPath, async (filePath, entryName) => {
+		if (!SOURCE_EXTENSIONS.test(entryName)) return;
+		if (entryName.endsWith(".d.ts") || entryName.endsWith(".test.ts") || entryName.endsWith(".spec.ts")) return;
+		const packageDir = findOwningPackage(filePath, packages).directory;
+		const content = await readFile(filePath, "utf-8");
+		files.push({
+			path: filePath,
+			packageDir,
+			content
+		});
+	});
+	return files;
+}
+async function attachSourceFiles(sourceFiles, packages, projectPath) {
+	for (const sourceFile of sourceFiles) {
+		const owner = packages.find((pkg) => pkg.directory === sourceFile.packageDir);
+		if (!owner) continue;
+		owner.sourceFiles.push(sourceFile);
+		for (const importedPackage of extractImports(sourceFile.content)) {
+			if (!importedPackage.startsWith(HAPPYVERTICAL_PACKAGE_PREFIX)) continue;
+			const evidence = {
+				filePath: relative(projectPath, sourceFile.path),
+				line: lineNumber(sourceFile.content, importedPackage),
+				detail: `Imports ${importedPackage}`
+			};
+			const existing = owner.imports.get(importedPackage) ?? [];
+			existing.push(evidence);
+			owner.imports.set(importedPackage, existing);
+		}
+	}
+}
+function findMissingHappyVerticalDependencies(packages) {
+	return packages.flatMap((pkg) => {
+		const ownName = typeof pkg.json.name === "string" ? pkg.json.name : void 0;
+		const missing = Array.from(pkg.imports.keys()).filter((importedPackage) => importedPackage !== ownName && !pkg.dependencies.has(importedPackage));
+		if (missing.length === 0) return [];
+		return [{
+			severity: missing.some((name) => name.startsWith(SMRT_PACKAGE_PREFIX)) ? "high" : "medium",
+			area: "dependencies",
+			code: "missing-happyvertical-dependencies",
+			title: `${packageLabel(pkg)} imports HappyVertical packages that package.json does not declare`,
+			evidence: missing.flatMap((name) => pkg.imports.get(name) ?? []),
+			recommendation: "Declare every imported @happyvertical package in the owning package manifest so downstream installs and generated knowledge stay reproducible.",
+			suggestedIssueTitle: `Declare missing HappyVertical dependencies in ${packageLabel(pkg)}`
+		}];
+	});
+}
+function findCustomManifestGeneration(sourceFiles, projectPath) {
+	return sourceFiles.filter((file) => /manifest\.json/.test(file.content) && /objects\s*:/.test(file.content) && /\b(writeFile|writeFileSync)\b/.test(file.content) && !/@happyvertical\/smrt-scanner/.test(file.content)).map((file) => ({
+		severity: "high",
+		area: "manifest",
+		code: "custom-object-manifest-generation",
+		title: "Custom SMRT object manifest generation detected",
+		evidence: [{
+			filePath: relative(projectPath, file.path),
+			line: lineNumber(file.content, "manifest.json"),
+			detail: "Writes a manifest.json object inventory outside the SMRT scanner/runtime path."
+		}],
+		recommendation: "Use the SMRT scanner/runtime manifest path so defaults, relationships, schemas, tenant fields, and cross-package references match framework behavior.",
+		suggestedIssueTitle: "Replace custom object manifest generation with SMRT scanner/runtime manifest generation"
+	}));
+}
+function findDirectStorageBypasses(sourceFiles, packages, projectPath) {
+	return sourceFiles.flatMap((file) => {
+		const owner = findOwningPackage(file.path, packages);
+		const usesFs = /from\s+['"](?:node:fs|node:fs\/promises|fs|fs\/promises)['"]|require\(['"](?:node:fs|node:fs\/promises|fs|fs\/promises)['"]\)/.test(file.content);
+		const writesDurableData = /\b(writeFile|appendFile|mkdir|rm|rename)\b/.test(file.content) && /(\.json|data|storage|persist|cache|db)/i.test(file.content);
+		const usesDirectSql = /from\s+['"](?:better-sqlite3|sqlite3|pg|mysql2?|knex|drizzle-orm)['"]/.test(file.content);
+		if ((!usesFs || !writesDurableData) && !usesDirectSql) return [];
+		if (owner.dependencies.has("@happyvertical/sql") || owner.dependencies.has("@happyvertical/files") || owner.dependencies.has("@happyvertical/smrt-assets") || owner.dependencies.has("@happyvertical/smrt-content")) return [];
+		return [{
+			severity: "medium",
+			area: "storage",
+			code: "direct-storage-bypass",
+			title: `${packageLabel(owner)} appears to bypass HappyVertical storage packages`,
+			evidence: [{
+				filePath: relative(projectPath, file.path),
+				line: lineNumber(file.content, usesDirectSql ? "sqlite" : "writeFile"),
+				detail: usesDirectSql ? "Imports a direct SQL/storage library without @happyvertical/sql." : "Uses node:fs-style durable writes without @happyvertical/files/assets/content."
+			}],
+			recommendation: "Route durable data through @happyvertical/sql, @happyvertical/files, SMRT assets, or SMRT content unless this is explicitly build-only tooling.",
+			suggestedIssueTitle: `Review direct storage usage in ${packageLabel(owner)}`
+		}];
+	});
+}
+function findCustomHttpShells(sourceFiles, packages, projectPath) {
+	const evidenceByPackage = /* @__PURE__ */ new Map();
+	for (const pkg of packages) {
+		if (pkg.dependencies.has("@sveltejs/kit")) continue;
+		const routerDependencies = [
+			"express",
+			"fastify",
+			"hono",
+			"koa"
+		].filter((dep) => pkg.dependencies.has(dep));
+		if (routerDependencies.length === 0) continue;
+		appendEvidence(evidenceByPackage, pkg, {
+			filePath: relative(projectPath, pkg.packageJsonPath),
+			detail: `Declares custom router package(s): ${routerDependencies.join(", ")}.`
+		});
+	}
+	for (const file of sourceFiles) {
+		const owner = findOwningPackage(file.path, packages);
+		if (owner.dependencies.has("@sveltejs/kit")) continue;
+		if (!/from\s+['"](?:node:http|http|node:https|https)['"]|createServer\s*\(/.test(file.content)) continue;
+		appendEvidence(evidenceByPackage, owner, {
+			filePath: relative(projectPath, file.path),
+			line: lineNumber(file.content, "createServer"),
+			detail: "Custom HTTP routing found without the SvelteKit/SMRT app-shell dependency pattern."
+		});
+	}
+	return Array.from(evidenceByPackage.entries()).map(([owner, evidence]) => ({
+		severity: "medium",
+		area: "api-shell",
+		code: "custom-http-shell",
+		title: `${packageLabel(owner)} uses a custom HTTP shell`,
+		evidence,
+		recommendation: "Compare the app shell against the Anytown/Ergot SvelteKit + SMRT shell pattern before adding custom HTTP infrastructure.",
+		suggestedIssueTitle: `Align ${packageLabel(owner)} app shell with SMRT/SvelteKit conventions`
+	}));
+}
+function appendEvidence(evidenceByPackage, pkg, evidence) {
+	const existing = evidenceByPackage.get(pkg);
+	if (existing) {
+		existing.push(evidence);
+		return;
+	}
+	evidenceByPackage.set(pkg, [evidence]);
+}
+function findLocalAuthTenancy(sourceFiles, packages, projectPath) {
+	return sourceFiles.flatMap((file) => {
+		const owner = findOwningPackage(file.path, packages);
+		const pathSignal = /(auth|tenant|audit|session|rbac|user)/i.test(file.path);
+		const codeSignal = /\b(tenantId|tenant|role|permission|session|auditLog|apiKey)\b/.test(file.content);
+		if (!pathSignal || !codeSignal) return [];
+		if (owner.dependencies.has("@happyvertical/smrt-users") || owner.dependencies.has("@happyvertical/smrt-tenancy") || owner.dependencies.has("@happyvertical/smrt-profiles")) return [];
+		return [{
+			severity: "medium",
+			area: "auth-tenancy",
+			code: "local-auth-tenancy",
+			title: `${packageLabel(owner)} contains local auth/tenancy/audit logic`,
+			evidence: [{
+				filePath: relative(projectPath, file.path),
+				line: lineNumber(file.content, "tenant"),
+				detail: "Auth, tenancy, session, role, or audit terminology appears without smrt-users/smrt-tenancy/smrt-profiles dependencies."
+			}],
+			recommendation: "Add explicit adapters to smrt-users, smrt-tenancy, and profile/audit models or document why this local implementation is intentionally isolated.",
+			suggestedIssueTitle: `Review auth and tenancy adapters in ${packageLabel(owner)}`
+		}];
+	});
+}
+function findUiShellDrift(packages, projectPath) {
+	return packages.flatMap((pkg) => {
+		if (!(pkg.sourceFiles.some((file) => file.path.endsWith(".svelte")) || /(?:web|ui|app|site|frontend)/i.test(packageLabel(pkg)) || pkg.dependencies.has("svelte") || pkg.dependencies.has("vite"))) return [];
+		if (pkg.dependencies.has("@happyvertical/smrt-svelte")) return [];
+		return [{
+			severity: "low",
+			area: "ui-shell",
+			code: "missing-smrt-svelte-shell",
+			title: `${packageLabel(pkg)} looks like UI work without @happyvertical/smrt-svelte`,
+			evidence: [{
+				filePath: relative(projectPath, pkg.packageJsonPath),
+				detail: "UI-facing package does not declare @happyvertical/smrt-svelte."
+			}],
+			recommendation: "Use @happyvertical/smrt-svelte and the SvelteKit shell pattern for downstream app UI unless this package is intentionally framework-agnostic.",
+			suggestedIssueTitle: `Check SMRT Svelte shell alignment for ${packageLabel(pkg)}`
+		}];
+	});
+}
+function findMissingManifestArtifacts(sourceFiles, packages, projectPath) {
+	return packages.flatMap((pkg) => {
+		if (!pkg.sourceFiles.some((file) => /@smrt\s*\(/.test(file.content))) return [];
+		if (sourceFiles.some((file) => file.packageDir === pkg.directory && /@happyvertical\/smrt-scanner/.test(file.content)) || pathExistsSyncHint(join(pkg.directory, ".smrt", "manifest.json")) || pathExistsSyncHint(join(pkg.directory, "dist", "manifest.json"))) return [];
+		return [{
+			severity: "low",
+			area: "manifest",
+			code: "missing-generated-manifest-artifact",
+			title: `${packageLabel(pkg)} has @smrt objects but no generated manifest artifact was found`,
+			evidence: [{
+				filePath: relative(projectPath, pkg.packageJsonPath),
+				detail: "No .smrt/manifest.json or dist/manifest.json was visible during review."
+			}],
+			recommendation: "Run the package build/test manifest generation path and verify it uses the SMRT scanner/runtime manifest pipeline.",
+			suggestedIssueTitle: `Verify SMRT manifest generation for ${packageLabel(pkg)}`
+		}];
+	});
+}
+async function visit(dir, onFile) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const fullPath = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (SKIP_DIRS.has(entry.name)) continue;
+			await visit(fullPath, onFile);
+			continue;
+		}
+		if (entry.isFile()) await onFile(fullPath, entry.name);
+	}
+}
+function collectDependencies(packageJson) {
+	const dependencies = /* @__PURE__ */ new Set();
+	for (const sectionName of DEPENDENCY_SECTIONS) {
+		const section = packageJson[sectionName];
+		if (!isRecord(section)) continue;
+		for (const dependencyName of Object.keys(section)) dependencies.add(dependencyName);
+	}
+	return dependencies;
+}
+function extractImports(content) {
+	const imports = /* @__PURE__ */ new Set();
+	for (const pattern of [
+		/(?:import|export)\s+(?:type\s+)?(?:[^'"]+\s+from\s+)?['"]([^'"]+)['"]/g,
+		/\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+		/\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+	]) for (const match of content.matchAll(pattern)) {
+		const imported = normalizePackageImport(match[1]);
+		if (imported) imports.add(imported);
+	}
+	return Array.from(imports);
+}
+function normalizePackageImport(value) {
+	if (!value || value.startsWith(".") || value.startsWith("/")) return void 0;
+	if (value.startsWith("@")) {
+		const [scope, name] = value.split("/");
+		return scope && name ? `${scope}/${name}` : value;
+	}
+	return value.split("/")[0];
+}
+function findOwningPackage(filePath, packages) {
+	const normalized = resolve(filePath);
+	return packages.filter((pkg) => normalized === pkg.directory || normalized.startsWith(`${pkg.directory}${sep}`)).sort((left, right) => right.directory.length - left.directory.length)[0] ?? packages[0];
+}
+function packageInventory(pkg) {
+	const declaredHappyVerticalDependencies = Array.from(pkg.dependencies).filter((dependency) => dependency.startsWith(HAPPYVERTICAL_PACKAGE_PREFIX)).sort();
+	const importedHappyVerticalPackages = Array.from(pkg.imports.keys()).sort();
+	const ownName = typeof pkg.json.name === "string" ? pkg.json.name : void 0;
+	return {
+		name: packageLabel(pkg),
+		path: pkg.relativePath,
+		private: typeof pkg.json.private === "boolean" ? pkg.json.private : void 0,
+		scripts: Object.keys(pkg.scripts).sort(),
+		declaredHappyVerticalDependencies,
+		importedHappyVerticalPackages,
+		missingHappyVerticalDependencies: importedHappyVerticalPackages.filter((name) => name !== ownName && !pkg.dependencies.has(name)),
+		hasSvelteKit: pkg.dependencies.has("@sveltejs/kit"),
+		hasSmrtSvelte: pkg.dependencies.has("@happyvertical/smrt-svelte")
+	};
+}
+function summarizeFindings(findings) {
+	return findings.reduce((summary, finding) => {
+		summary[finding.severity]++;
+		return summary;
+	}, {
+		high: 0,
+		medium: 0,
+		low: 0
+	});
+}
+function limitFindings(findings, maxFindings) {
+	const sorted = findings.sort((left, right) => severityRank(left.severity) - severityRank(right.severity) || left.area.localeCompare(right.area) || left.title.localeCompare(right.title));
+	return maxFindings && maxFindings > 0 ? sorted.slice(0, maxFindings) : sorted;
+}
+function severityRank(severity) {
+	return severity === "high" ? 0 : severity === "medium" ? 1 : 2;
+}
+function packageLabel(pkg) {
+	return typeof pkg.json.name === "string" ? pkg.json.name : pkg.relativePath;
+}
+function lineNumber(content, needle) {
+	const index = content.indexOf(needle);
+	if (index < 0) return void 0;
+	return content.slice(0, index).split("\n").length;
+}
+function isRecord(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+async function pathExists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function pathExistsSyncHint(path) {
+	return existsSync(path);
+}
+async function runDuplicateDetection(args, projectPath, packageContexts) {
+	const status = {
+		enabled: args.detectDuplicates !== false,
+		indexPath: null,
+		intentCount: 0,
+		notes: []
+	};
+	if (!status.enabled) return {
+		findings: [],
+		status
+	};
+	const explicit = args.intentIndexPath ? isAbsolute(args.intentIndexPath) ? args.intentIndexPath : resolve(projectPath, args.intentIndexPath) : void 0;
+	const candidates = explicit ? [explicit] : defaultIntentIndexCandidates(args.packageRoot);
+	const indexPath = candidates.find((candidate) => existsSync(candidate));
+	if (!indexPath) {
+		status.notes.push(`No intent index found (tried ${candidates.join(", ") || "none"}); duplicate detection skipped. Reinstall @happyvertical/smrt-dev-mcp or pass intentIndexPath.`);
+		return {
+			findings: [],
+			status
+		};
+	}
+	const rows = parseIntentIndex(await readFile(indexPath, "utf-8"));
+	status.indexPath = indexPath;
+	status.intentCount = rows.length;
+	if (rows.length === 0) {
+		status.notes.push(`Intent index ${indexPath} has no parsable rows.`);
+		return {
+			findings: [],
+			status
+		};
+	}
+	if (!packageContexts.some((pkg) => Array.from(pkg.dependencies).some((name) => name.startsWith(SMRT_PACKAGE_PREFIX)) || Array.from(pkg.imports.keys()).some((name) => name.startsWith(SMRT_PACKAGE_PREFIX)))) {
+		status.notes.push("No @happyvertical/smrt-* dependency or import found; duplicate detection skipped.");
+		return {
+			findings: [],
+			status
+		};
+	}
+	const homeNames = new Set(rows.flatMap((row) => row.homePackages.map((home) => home.packageName)));
+	return {
+		findings: detectHandRolled(rows, packageContexts.map((pkg) => ({
+			name: typeof pkg.json.name === "string" ? pkg.json.name : void 0,
+			relativePath: pkg.relativePath,
+			installed: new Set(Array.from(homeNames).filter((name) => pkg.dependencies.has(name) || existsSync(join(pkg.directory, "node_modules", name)) || existsSync(join(projectPath, "node_modules", name)))),
+			files: pkg.sourceFiles.map((file) => ({
+				relativePath: relative(projectPath, file.path),
+				content: file.content,
+				imports: extractImports(file.content)
+			}))
+		})), { onNote: (note) => {
+			status.notes.push(note);
+			process.stderr.write(`[smrt-dev-mcp] ${note}\n`);
+		} }).map(duplicateFinding),
+		status
+	};
+}
+function duplicateFinding(found) {
+	const first = found.evidence[0];
+	const installedUnused = found.installedHomePackages.length > 0;
+	const homeList = found.homePackages.join(", ");
+	const title = `${found.packageName} appears to hand-roll "${found.intent}"`;
+	return {
+		severity: installedUnused ? "medium" : "low",
+		area: "duplicate-detection",
+		code: found.code,
+		title,
+		message: `${title} (signals: ${found.matchedSignals.join(", ")}); ${installedUnused ? `${found.installedHomePackages.join(", ")} is installed but never imported` : `none of ${homeList} is imported`}. Intent page ${found.intentPage}; component pages ${found.componentPages.join(", ")}.`,
+		file: `${first.filePath}:${first.line}`,
+		packageName: found.packageName,
+		intentPage: found.intentPage,
+		componentPages: found.componentPages,
+		evidence: found.evidence.map((item) => ({
+			filePath: item.filePath,
+			line: item.line,
+			detail: item.detail
+		})),
+		recommendation: `Read ${found.intentPage} before keeping this implementation; the framework entry point is ${found.entryPoint} (${found.componentPages.join(", ")}). Advisory only: keep the hand-rolled code if it covers a case the package does not.`,
+		suggestedIssueTitle: `Evaluate ${homeList} instead of hand-rolled ${found.intent.toLowerCase()} in ${found.packageName}`
+	};
+}
+//#endregion
+export { reviewSmrtProject as t };
+
+//# sourceMappingURL=review-smrt-project-ByEwPcor.js.map