@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/ai/testing/conformance/ai-no-sdk-leak.suite.d.ts

@@ -0,0 +1,150 @@
+import type { ConformanceSuite } from '../../../testing/index';
+/**
+ * One source tree the suite scans for provider SDK imports.
+ *
+ * @stability experimental
+ */
+export interface SdkLeakTree {
+    /** A label for the test titles, for example `@marinoscar/platform-api`. */
+    name: string;
+    /** Absolute root of the tree. */
+    root: string;
+    /**
+     * Directories, relative to `root` with `/` separators and a trailing `/`,
+     * where an adapter may import its SDK. Omit for a tree where no file may
+     * (the app, the web, the contract).
+     */
+    sdkDirs?: readonly string[];
+    /** Vacuity guard: the tree must hold at least this many source files. */
+    minFiles: number;
+}
+/**
+ * The one manifest allowed to declare provider SDKs.
+ *
+ * @stability experimental
+ */
+export interface SdkOwnerManifest {
+    /** Absolute path of the owning package's `package.json`. */
+    manifest: string;
+    /** SDK names it must declare (proves the check reads real dependencies). */
+    declares: readonly string[];
+}
+/**
+ * How an app configures the `ai-no-sdk-leak` suite.
+ *
+ * @example
+ * ```ts
+ * aiNoSdkLeak: {
+ *   apiTrees: [
+ *     { name: '@marinoscar/platform-api', root: PACKAGE_SRC, sdkDirs: aiPackageProviderDirs(PACKAGE_SRC), minFiles: 100 },
+ *     { name: 'apps/api/src', root: join(REPO, 'apps/api/src'), minFiles: 100 },
+ *   ],
+ *   webTrees: [{ name: 'apps/web/src', root: join(REPO, 'apps/web/src'), minFiles: 50 }],
+ *   sdkOwner: { manifest: PACKAGE_JSON, declares: ['openai'] },
+ *   noSdkManifests: [join(REPO, 'package.json'), join(REPO, 'apps/api/package.json')],
+ * }
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export interface AiNoSdkLeakOptions {
+    /** API-side trees. The platform package passes its adapter directories as `sdkDirs`; the app passes none. */
+    apiTrees: readonly SdkLeakTree[];
+    /** Trees the browser ships (web sources, contract sources): no SDK import anywhere. */
+    webTrees: readonly SdkLeakTree[];
+    /**
+     * The one manifest allowed to declare provider SDKs, and the SDK names it
+     * must declare (proves the check reads real dependencies). Omit when the app
+     * consumes the package from `node_modules`: the package owns its dependencies.
+     */
+    sdkOwner?: SdkOwnerManifest;
+    /** Absolute `package.json` paths that must declare no provider SDK. */
+    noSdkManifests: readonly string[];
+    /** More SDK package names to ban, beyond {@link PROVIDER_SDK_PACKAGES}. */
+    extraSdkPackages?: readonly string[];
+    /**
+     * Directories where the adapter of a provider registered with
+     * `registerAiProvider` (an app's or another package's) may import its SDK
+     * (PP-14.6), relative to the root of each `apiTrees` entry, with `/`
+     * separators and a trailing `/`: `['platform-extensions/ai/']`. Applied in
+     * addition to a tree's own `sdkDirs`. Nothing else in that tree may import
+     * an SDK, and each directory must hold at least one source file in some tree
+     * (a typo would otherwise exempt nothing and look green).
+     *
+     * The SDK packages each registered definition lists in `sdkPackages` are
+     * banned too, everywhere outside these directories, so an adapter's SDK
+     * stays inside its own folder; a `package.json` that declares one of them is
+     * not a finding (the folder's owner must declare what it imports).
+     */
+    providerDirs?: readonly string[];
+}
+/**
+ * Known AI provider SDK package names. Not exhaustive of every SDK that will
+ * ever exist: exhaustive of every one worth naming, so a reviewer adding a
+ * provider sees this list and extends it.
+ *
+ * @stability experimental
+ */
+export declare const PROVIDER_SDK_PACKAGES: readonly string[];
+/**
+ * The platform package's own adapter directories, in the form
+ * {@link SdkLeakTree.sdkDirs} takes: one per provider the AI slice ships,
+ * relative to `packageRoot` (the package's `src`, or its `dist`).
+ *
+ * @param packageRoot - the root of the package tree being scanned.
+ * @returns one `<slice>/<providers>/<id>/` entry per provider directory, empty when the slice is not under `packageRoot`.
+ *
+ * @stability experimental
+ */
+export declare function aiPackageProviderDirs(packageRoot: string): string[];
+/**
+ * The module specifiers a source text imports, re-exports, dynamically
+ * imports or requires.
+ *
+ * @param source - TypeScript or JavaScript source.
+ * @returns the specifiers, in pattern order.
+ *
+ * @stability experimental
+ */
+export declare function importSpecifiers(source: string): string[];
+/**
+ * The SDK packages the registered AI provider definitions declare
+ * (`sdkPackages`), de-duplicated, in registration order.
+ *
+ * @returns the package names.
+ * @stability experimental
+ */
+export declare function registeredAiSdkPackages(): string[];
+/**
+ * `<file>: imports "<sdk>"` for every provider SDK import outside the exempt directories.
+ *
+ * @param files - scanned files with root-relative paths.
+ * @param exemptDirs - directories (root-relative, `/`-terminated) where an import is allowed.
+ * @param banned - the banned package names (default {@link PROVIDER_SDK_PACKAGES}).
+ * @returns one message per offending import.
+ *
+ * @stability experimental
+ */
+export declare function findSdkLeaks(files: ReadonlyArray<{
+    rel: string;
+    source: string;
+}>, exemptDirs?: readonly string[], banned?: readonly string[]): string[];
+/**
+ * The provider SDKs a `package.json` declares, in any dependency field.
+ *
+ * @param manifest - a parsed `package.json`.
+ * @param banned - the banned package names (default {@link PROVIDER_SDK_PACKAGES}).
+ * @returns the declared SDK names.
+ *
+ * @stability experimental
+ */
+export declare function declaredSdks(manifest: Record<string, unknown>, banned?: readonly string[]): string[];
+/**
+ * The suite behind `runPlatformConformance({ suites: { aiNoSdkLeak } })`.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const aiNoSdkLeakSuite: ConformanceSuite<AiNoSdkLeakOptions>;
+//# sourceMappingURL=ai-no-sdk-leak.suite.d.ts.map

package/dist/ai/testing/conformance/ai-no-sdk-leak.suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-no-sdk-leak.suite.d.ts","sourceRoot":"","sources":["../../../../src/ai/testing/conformance/ai-no-sdk-leak.suite.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAKV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB;IACjC,6GAA6G;IAC7G,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC,uFAAuF;IACvF,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAcjD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAanE;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAWzD;AAOD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACrD,UAAU,GAAE,SAAS,MAAM,EAAO,EAClC,MAAM,GAAE,SAAS,MAAM,EAA0B,GAChD,MAAM,EAAE,CAWV;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,SAAS,MAAM,EAA0B,GAAG,MAAM,EAAE,CAM3H;AAoLD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,gBAAgB,CAAC,kBAAkB,CAMjE,CAAC"}

package/dist/ai/testing/conformance/ai-no-sdk-leak.suite.js

@@ -0,0 +1,359 @@
+"use strict";
+// =============================================================================
+// Suite: no AI provider SDK leaks outside its own adapter (issues #435, #742)
+// =============================================================================
+//
+// CLAUDE.md AI rule 1: a provider SDK is imported only inside the directory of
+// the adapter that owns it. `ai/core` already pins the narrow claim that it
+// imports nothing beyond `zod` and `@nestjs/common` (its own spec). This suite
+// is the wider one:
+//
+//   - in the platform package, NO file OUTSIDE a provider's own directory may
+//     import a provider SDK;
+//   - in the app, NO file may import one at all: a feature calls
+//     `AiService.forUser(...)`;
+//   - NO file of the web or the contract may import one (the browser must never
+//     hold a provider SDK any more than it may hold a provider key);
+//   - NO app `package.json` and no other package declares a provider SDK: they
+//     are dependencies of `@marinoscar/platform-api` only.
+//
+// THE BANNED LIST IS PACKAGE NAMES, NOT A GREP FOR "openai" AS A STRING, so a
+// comment or a variable named `openaiKeyHint` does not fail the suite. It is
+// deliberately wider than what a `package.json` happens to declare today: a
+// fork adding `@anthropic-ai/sdk` or `@google/genai` without also adding its
+// adapter under the provider directory should fail on day one, not be missed
+// because the list only knew about the SDKs already in the tree.
+//
+// NOTHING HERE NAMES A PATH. The app passes the source trees it ships (with the
+// directories where an adapter may import its SDK) and the manifests to check.
+// The platform package's own adapter directories come from
+// {@link aiPackageProviderDirs}, which reads the AI slice's layout next to this
+// file, so an app that consumes the package from `node_modules` and an app that
+// builds it from source both pass the directory they have.
+//
+// Moved from the reference app's `apps/api/test/ai/ai-no-sdk-leak.spec.ts` with
+// the same case list (the manifest cases are one per manifest, as before).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aiNoSdkLeakSuite = exports.PROVIDER_SDK_PACKAGES = void 0;
+exports.aiPackageProviderDirs = aiPackageProviderDirs;
+exports.importSpecifiers = importSpecifiers;
+exports.registeredAiSdkPackages = registeredAiSdkPackages;
+exports.findSdkLeaks = findSdkLeaks;
+exports.declaredSdks = declaredSdks;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_1 = require("../../../testing/index");
+const ai_provider_definition_1 = require("../../providers/ai-provider-definition");
+/**
+ * Known AI provider SDK package names. Not exhaustive of every SDK that will
+ * ever exist: exhaustive of every one worth naming, so a reviewer adding a
+ * provider sees this list and extends it.
+ *
+ * @stability experimental
+ */
+exports.PROVIDER_SDK_PACKAGES = Object.freeze([
+    'openai',
+    '@anthropic-ai/sdk',
+    '@google/genai',
+    '@google/generative-ai',
+    '@google-cloud/vertexai',
+    'cohere-ai',
+    '@mistralai/mistralai',
+    'mistralai',
+    'groq-sdk',
+    '@aws-sdk/client-bedrock-runtime',
+    'replicate',
+    'together-ai',
+    'ollama',
+]);
+/**
+ * The platform package's own adapter directories, in the form
+ * {@link SdkLeakTree.sdkDirs} takes: one per provider the AI slice ships,
+ * relative to `packageRoot` (the package's `src`, or its `dist`).
+ *
+ * @param packageRoot - the root of the package tree being scanned.
+ * @returns one `<slice>/<providers>/<id>/` entry per provider directory, empty when the slice is not under `packageRoot`.
+ *
+ * @stability experimental
+ */
+function aiPackageProviderDirs(packageRoot) {
+    // The adapters live in `providers/<id>/` beside `testing/` in the AI slice
+    // (this file is `<slice>/testing/conformance/`), and the package source and
+    // its build have the same layout, so the slice-relative location is read off
+    // this file and re-applied to the root the caller passes. No path is spelled.
+    const providers = (0, node_path_1.resolve)(__dirname, '..', '..', 'providers');
+    const prefix = (0, node_path_1.relative)((0, node_path_1.resolve)(__dirname, '..', '..', '..'), providers).split(node_path_1.sep).join('/');
+    const dir = (0, node_path_1.join)((0, node_path_1.resolve)(packageRoot), prefix);
+    if (!(0, node_fs_1.statSync)(dir, { throwIfNoEntry: false }))
+        return [];
+    return (0, node_fs_1.readdirSync)(dir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => `${prefix}/${entry.name}/`);
+}
+// The planted sources of the detector cases are assembled from these, so this
+// file never contains an import of its own that the scan above would flag when
+// an app scans the package source (the reference app does).
+const IMPORT = ['im', 'port'].join('');
+const REQUIRE = ['req', 'uire'].join('');
+function sourceFiles(dir) {
+    if (!(0, node_fs_1.statSync)(dir, { throwIfNoEntry: false }))
+        return [];
+    return (0, node_fs_1.readdirSync)(dir).flatMap((entry) => {
+        const full = (0, node_path_1.join)(dir, entry);
+        const stat = (0, node_fs_1.statSync)(full);
+        if (stat.isDirectory())
+            return entry === 'node_modules' ? [] : sourceFiles(full);
+        if (!entry.endsWith('.ts') && !entry.endsWith('.tsx'))
+            return [];
+        if (entry.endsWith('.spec.ts') || entry.endsWith('.test.ts') || entry.endsWith('.test.tsx'))
+            return [];
+        if (entry.endsWith('.d.ts'))
+            return [];
+        return [full];
+    });
+}
+/**
+ * The module specifiers a source text imports, re-exports, dynamically
+ * imports or requires.
+ *
+ * @param source - TypeScript or JavaScript source.
+ * @returns the specifiers, in pattern order.
+ *
+ * @stability experimental
+ */
+function importSpecifiers(source) {
+    const patterns = [
+        // named/default/namespace import or re-export ... from '...'
+        /(?:import|export)\s[^'"]*?from\s+['"]([^'"]+)['"]/g,
+        // side-effect-only `import '...'`
+        /import\s+['"]([^'"]+)['"]/g,
+        /import\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /require\(\s*['"]([^'"]+)['"]\s*\)/g,
+    ];
+    return patterns.flatMap((re) => [...source.matchAll(re)].map((match) => match[1]));
+}
+/** True when `specifier` names (or is a subpath of) a banned provider SDK package. */
+function namesProviderSdk(specifier, banned) {
+    return banned.some((pkg) => specifier === pkg || specifier.startsWith(`${pkg}/`));
+}
+/**
+ * The SDK packages the registered AI provider definitions declare
+ * (`sdkPackages`), de-duplicated, in registration order.
+ *
+ * @returns the package names.
+ * @stability experimental
+ */
+function registeredAiSdkPackages() {
+    return [...new Set((0, ai_provider_definition_1.aiProviderDefinitions)().flatMap((definition) => definition.sdkPackages ?? []))];
+}
+/**
+ * `<file>: imports "<sdk>"` for every provider SDK import outside the exempt directories.
+ *
+ * @param files - scanned files with root-relative paths.
+ * @param exemptDirs - directories (root-relative, `/`-terminated) where an import is allowed.
+ * @param banned - the banned package names (default {@link PROVIDER_SDK_PACKAGES}).
+ * @returns one message per offending import.
+ *
+ * @stability experimental
+ */
+function findSdkLeaks(files, exemptDirs = [], banned = exports.PROVIDER_SDK_PACKAGES) {
+    const offenders = [];
+    for (const file of files) {
+        if (exemptDirs.some((dir) => file.rel.startsWith(dir)))
+            continue;
+        for (const specifier of importSpecifiers(file.source)) {
+            if (namesProviderSdk(specifier, banned))
+                offenders.push(`${file.rel}: imports "${specifier}"`);
+        }
+    }
+    return offenders;
+}
+/**
+ * The provider SDKs a `package.json` declares, in any dependency field.
+ *
+ * @param manifest - a parsed `package.json`.
+ * @param banned - the banned package names (default {@link PROVIDER_SDK_PACKAGES}).
+ * @returns the declared SDK names.
+ *
+ * @stability experimental
+ */
+function declaredSdks(manifest, banned = exports.PROVIDER_SDK_PACKAGES) {
+    const fields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+    return fields.flatMap((field) => Object.keys(manifest[field] ?? {}).filter((name) => namesProviderSdk(name, banned)));
+}
+function readTree(root) {
+    return sourceFiles(root).map((file) => ({
+        rel: (0, node_path_1.relative)(root, file).split(node_path_1.sep).join('/'),
+        source: (0, node_fs_1.readFileSync)(file, 'utf8'),
+    }));
+}
+const finding = (file, message) => ({ file, message });
+const treeKey = (kind, name) => `${kind}:${name}`;
+/** Runs the scan; see {@link aiNoSdkLeakSuite}. */
+function check(_context, options) {
+    const registered = registeredAiSdkPackages();
+    // What a package.json may not declare: the known SDKs, minus the ones a registered
+    // provider definition owns (the folder that imports them declares them).
+    const bannedInManifests = [...exports.PROVIDER_SDK_PACKAGES, ...(options.extraSdkPackages ?? [])].filter((name) => !registered.includes(name));
+    const banned = [...exports.PROVIDER_SDK_PACKAGES, ...(options.extraSdkPackages ?? []), ...registered];
+    const providerDirs = options.providerDirs ?? [];
+    const scanned = {};
+    const findings = [];
+    const providerDirFiles = new Map(providerDirs.map((dir) => [dir, 0]));
+    for (const [kind, trees] of [
+        ['api', options.apiTrees],
+        ['web', options.webTrees],
+    ]) {
+        for (const tree of trees) {
+            const files = readTree(tree.root);
+            const key = treeKey(kind, tree.name);
+            scanned[key] = files.length;
+            scanned[`${key}#sdkDirs`] = tree.sdkDirs?.length ?? 0;
+            // Provider directories apply to app-side trees only: a web tree never gets one.
+            const exempt = kind === 'api' ? [...(tree.sdkDirs ?? []), ...providerDirs] : [...(tree.sdkDirs ?? [])];
+            if (kind === 'api') {
+                for (const dir of providerDirs) {
+                    providerDirFiles.set(dir, (providerDirFiles.get(dir) ?? 0) + files.filter((file) => file.rel.startsWith(dir)).length);
+                }
+            }
+            for (const message of findSdkLeaks(files, exempt, banned)) {
+                findings.push(finding(`${key}|${message.split(': ')[0]}`, message.slice(message.indexOf(': ') + 2)));
+            }
+        }
+    }
+    const readManifest = (path) => JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+    for (const [dir, count] of providerDirFiles) {
+        if (count === 0)
+            findings.push(finding(`providerDir|${dir}`, 'holds no source file in any api tree, so it exempts nothing'));
+    }
+    scanned['providerDirs'] = providerDirs.length;
+    scanned['registeredSdkPackages'] = registered.length;
+    if (options.sdkOwner) {
+        const declared = declaredSdks(readManifest(options.sdkOwner.manifest), banned);
+        scanned['sdkOwner#declared'] = options.sdkOwner.declares.filter((name) => declared.includes(name)).length;
+    }
+    for (const path of options.noSdkManifests) {
+        for (const sdk of declaredSdks(readManifest(path), bannedInManifests))
+            findings.push(finding(`manifest|${path}`, `declares "${sdk}"`));
+    }
+    return { scanned, scannedFiles: {}, findings };
+}
+/** The findings of one tree, as `<file>: <message>` lines. */
+function treeLines(report, key) {
+    return report.findings.filter((f) => f.file.startsWith(`${key}|`)).map((f) => `${f.file.slice(key.length + 1)}: ${f.message}`);
+}
+/** The tests the harness registers for this suite. */
+function cases(options) {
+    const out = [];
+    for (const [kind, trees] of [
+        ['api', options.apiTrees],
+        ['web', options.webTrees],
+    ]) {
+        for (const tree of trees) {
+            const key = treeKey(kind, tree.name);
+            const hasDirs = tree.sdkDirs !== undefined;
+            out.push({
+                name: `${tree.name}: finds a non-trivial source tree${hasDirs ? ' and at least one provider directory' : ''}, so this cannot pass vacuously`,
+                run: (report, expect) => {
+                    expect(report.scanned[key]).toBeGreaterThanOrEqual(tree.minFiles);
+                    if (hasDirs)
+                        expect(report.scanned[`${key}#sdkDirs`]).toBeGreaterThanOrEqual(1);
+                },
+            });
+            out.push({
+                name: hasDirs
+                    ? `${tree.name}: imports no provider SDK outside its own adapter directory`
+                    : kind === 'api'
+                        ? `${tree.name}: imports no provider SDK anywhere: a feature calls AiService.forUser`
+                        : `${tree.name}: imports no provider SDK anywhere — the browser must never hold one, any more than it may hold a provider key`,
+                run: (report, expect) => {
+                    expect(treeLines(report, key)).toEqual([]);
+                },
+            });
+        }
+    }
+    if ((options.providerDirs ?? []).length > 0) {
+        out.push({
+            name: 'every provider directory holds source files, so a typo cannot exempt nothing and look green',
+            run: (report, expect) => {
+                expect(report.findings.filter((f) => f.file.startsWith('providerDir|')).map((f) => `${f.file.slice('providerDir|'.length)}: ${f.message}`)).toEqual([]);
+            },
+        });
+    }
+    if (options.sdkOwner) {
+        const owner = options.sdkOwner;
+        out.push({
+            name: 'declares the shipped SDKs in the owning package only',
+            run: (report, expect) => {
+                expect(report.scanned['sdkOwner#declared']).toBeGreaterThanOrEqual(owner.declares.length);
+            },
+        });
+    }
+    for (const path of options.noSdkManifests) {
+        out.push({
+            name: `${path.split(/[\\/]/).slice(-3).join('/')} declares no provider SDK`,
+            run: (report, expect) => {
+                expect(treeLines(report, 'manifest').filter((line) => line.startsWith(path))).toEqual([]);
+            },
+        });
+    }
+    out.push({
+        name: 'the detector flags an SDK import planted in the app',
+        run: (_report, expect) => {
+            const planted = [
+                { rel: 'features/summary.service.ts', source: `${IMPORT} OpenAI from 'openai';\nexport const x = 1;` },
+                { rel: 'features/other.ts', source: `const sdk = ${REQUIRE}('@anthropic-ai/sdk/resources');` },
+                { rel: 'features/fine.ts', source: "// mentions openai in prose only\nconst openaiKeyHint = 'x';" },
+            ];
+            expect(findSdkLeaks(planted)).toEqual([
+                'features/summary.service.ts: imports "openai"',
+                'features/other.ts: imports "@anthropic-ai/sdk/resources"',
+            ]);
+        },
+    }, {
+        name: 'the detector exempts only the provider directories it is given',
+        run: (_report, expect) => {
+            const planted = [
+                { rel: 'providers/openai/openai.adapter.ts', source: `${IMPORT} OpenAI from 'openai';` },
+                { rel: 'runtime/ai.service.ts', source: `${IMPORT} OpenAI from 'openai';` },
+            ];
+            expect(findSdkLeaks(planted, ['providers/openai/'])).toEqual(['runtime/ai.service.ts: imports "openai"']);
+        },
+    }, {
+        name: 'the detector bans a registered provider SDK outside the provider directories, and allows it inside',
+        run: (_report, expect) => {
+            const planted = [
+                { rel: 'platform-extensions/ai/acme/acme.adapter.ts', source: `${IMPORT} { Acme } from 'acme-sdk/client';` },
+                { rel: 'features/summary.service.ts', source: `${IMPORT} { Acme } from 'acme-sdk';` },
+            ];
+            expect(findSdkLeaks(planted, ['platform-extensions/ai/'], [...exports.PROVIDER_SDK_PACKAGES, 'acme-sdk'])).toEqual([
+                'features/summary.service.ts: imports "acme-sdk"',
+            ]);
+        },
+    }, {
+        name: 'the detector flags a provider SDK declared in an app package.json',
+        run: (_report, expect) => {
+            expect(declaredSdks({ name: 'api', dependencies: { '@nestjs/core': '^11', openai: '^7' } })).toEqual(['openai']);
+            expect(declaredSdks({ devDependencies: { '@google/genai': '^2' } })).toEqual(['@google/genai']);
+            expect(declaredSdks({ dependencies: { zod: '^4' } })).toEqual([]);
+        },
+    });
+    return out;
+}
+/**
+ * The suite behind `runPlatformConformance({ suites: { aiNoSdkLeak } })`.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.aiNoSdkLeakSuite = {
+    id: 'ai-no-sdk-leak',
+    title: 'no AI provider SDK leaks outside its own adapter directory (#435, #739)',
+    description: 'No provider SDK is imported outside the adapter directory that owns it, none in the web, none declared outside the owning package (AI rule 1).',
+    check,
+    cases,
+};
+if (!index_1.conformanceSuites.has(exports.aiNoSdkLeakSuite.id))
+    index_1.conformanceSuites.register(exports.aiNoSdkLeakSuite);
+//# sourceMappingURL=ai-no-sdk-leak.suite.js.map

package/dist/ai/testing/conformance/ai-no-sdk-leak.suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-no-sdk-leak.suite.js","sourceRoot":"","sources":["../../../../src/ai/testing/conformance/ai-no-sdk-leak.suite.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,oBAAoB;AACpB,EAAE;AACF,8EAA8E;AAC9E,6BAA6B;AAC7B,iEAAiE;AACjE,gCAAgC;AAChC,gFAAgF;AAChF,qEAAqE;AACrE,+EAA+E;AAC/E,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iEAAiE;AACjE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,2DAA2D;AAC3D,gFAAgF;AAChF,gFAAgF;AAChF,2DAA2D;AAC3D,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;;;AAmIhF,sDAaC;AAyCD,4CAWC;AAcD,0DAEC;AAYD,oCAeC;AAWD,oCAMC;AA9PD,qCAA8D;AAC9D,yCAAyD;AAEzD,kDAA2D;AAC3D,mFAA+E;AA4F/E;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,QAAQ;IACR,mBAAmB;IACnB,eAAe;IACf,uBAAuB;IACvB,wBAAwB;IACxB,WAAW;IACX,sBAAsB;IACtB,WAAW;IACX,UAAU;IACV,iCAAiC;IACjC,WAAW;IACX,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAA,oBAAQ,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,eAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAA,kBAAQ,EAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzD,OAAO,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,4DAA4D;AAC5D,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvC,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAUzC,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC,IAAA,kBAAQ,EAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzD,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACvG,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,QAAQ,GAAG;QACf,6DAA6D;QAC7D,oDAAoD;QACpD,kCAAkC;QAClC,4BAA4B;QAC5B,mCAAmC;QACnC,oCAAoC;KACrC,CAAC;IAEF,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,SAAiB,EAAE,MAAyB;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAA,8CAAqB,GAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAC1B,KAAqD,EACrD,aAAgC,EAAE,EAClC,SAA4B,6BAAqB;IAEjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACjE,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,cAAc,SAAS,GAAG,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,QAAiC,EAAE,SAA4B,6BAAqB;IAC/G,MAAM,MAAM,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAE/F,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CAAE,QAAQ,CAAC,KAAK,CAAwC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAC5H,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG,EAAE,IAAA,oBAAQ,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,eAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9C,MAAM,EAAE,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAAe,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3F,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAEjF,mDAAmD;AACnD,SAAS,KAAK,CAAC,QAA4B,EAAE,OAA2B;IACtE,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,mFAAmF;IACnF,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAiB,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;KACjB,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YACtD,gFAAgF;YAChF,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YACvG,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAA2B,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAElI,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,OAAO,CAAC,uBAAuB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAErD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/E,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,8DAA8D;AAC9D,SAAS,SAAS,CAAC,MAAyB,EAAE,GAAW;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAC,OAA2B;IACxC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;KACjB,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;YAE3C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,oCAAoC,OAAO,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,iCAAiC;gBAC5I,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;oBACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACnE,IAAI,OAAO;wBAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,UAAU,CAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;gBACnF,CAAC;aACF,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,OAAO;oBACX,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,6DAA6D;oBAC3E,CAAC,CAAC,IAAI,KAAK,KAAK;wBACd,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,uEAAuE;wBACrF,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,gHAAgH;gBAClI,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;oBACtB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC7C,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,6FAA6F;YACnG,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1J,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sDAAsD;YAC5D,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7F,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B;YAC3E,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBACtB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,IAAI,CACN;QACE,IAAI,EAAE,qDAAqD;QAC3D,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,OAAO,GAAiB;gBAC5B,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,MAAM,6CAA6C,EAAE;gBACtG,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,EAAE,eAAe,OAAO,kCAAkC,EAAE;gBAC9F,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,8DAA8D,EAAE;aACpG,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;gBACpC,+CAA+C;gBAC/C,0DAA0D;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,EACD;QACE,IAAI,EAAE,gEAAgE;QACtE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,OAAO,GAAiB;gBAC5B,EAAE,GAAG,EAAE,oCAAoC,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,EAAE;gBACxF,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,EAAE;aAC5E,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC5G,CAAC;KACF,EACD;QACE,IAAI,EAAE,oGAAoG;QAC1G,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,OAAO,GAAiB;gBAC5B,EAAE,GAAG,EAAE,6CAA6C,EAAE,MAAM,EAAE,GAAG,MAAM,mCAAmC,EAAE;gBAC5G,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,MAAM,4BAA4B,EAAE;aACtF,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,GAAG,6BAAqB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzG,iDAAiD;aAClD,CAAC,CAAC;QACL,CAAC;KACF,EACD;QACE,IAAI,EAAE,mEAAmE;QACzE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjH,MAAM,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YAChG,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;KACF,CACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACU,QAAA,gBAAgB,GAAyC;IACpE,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,yEAAyE;IAChF,WAAW,EAAE,gJAAgJ;IAC7J,KAAK;IACL,KAAK;CACN,CAAC;AAEF,IAAI,CAAC,yBAAiB,CAAC,GAAG,CAAC,wBAAgB,CAAC,EAAE,CAAC;IAAE,yBAAiB,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC"}

package/dist/ai/testing/conformance/ai-orchestration-boundary.registered.d.ts

@@ -0,0 +1,11 @@
+import type { ConformanceAppSuite } from '../../../testing/index';
+import { type OrchestrationBoundaryOptions } from './orchestration-boundary.suite';
+/**
+ * The suite behind `runPlatformConformance({ suites: { aiOrchestrationBoundary } })`;
+ * its options are those of {@link runOrchestrationBoundarySuite}.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const aiOrchestrationBoundarySuite: ConformanceAppSuite<OrchestrationBoundaryOptions>;
+//# sourceMappingURL=ai-orchestration-boundary.registered.d.ts.map

package/dist/ai/testing/conformance/ai-orchestration-boundary.registered.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-orchestration-boundary.registered.d.ts","sourceRoot":"","sources":["../../../../src/ai/testing/conformance/ai-orchestration-boundary.registered.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAiC,KAAK,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAElH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,mBAAmB,CAAC,4BAA4B,CAQ1F,CAAC"}

package/dist/ai/testing/conformance/ai-orchestration-boundary.registered.js

@@ -0,0 +1,24 @@
+"use strict";
+// The orchestration boundary (CLAUDE.md AI rule 6) as a registered suite
+// (issue #742). The scan itself is `orchestration-boundary.suite.ts` (#739);
+// this only gives it a suite id so an app runs it through
+// `runPlatformConformance()` like the rest.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aiOrchestrationBoundarySuite = void 0;
+const orchestration_boundary_suite_1 = require("./orchestration-boundary.suite");
+/**
+ * The suite behind `runPlatformConformance({ suites: { aiOrchestrationBoundary } })`;
+ * its options are those of {@link runOrchestrationBoundarySuite}.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.aiOrchestrationBoundarySuite = {
+    id: 'ai-orchestration-boundary',
+    title: 'the AI orchestration boundary (CLAUDE.md AI rule 6)',
+    description: 'An orchestration library is imported only under the roots an app allows, never from a web source, and never declared by a banned manifest (AI rule 6).',
+    register(_api, _context, options) {
+        (0, orchestration_boundary_suite_1.runOrchestrationBoundarySuite)(options);
+    },
+};
+//# sourceMappingURL=ai-orchestration-boundary.registered.js.map

package/dist/ai/testing/conformance/ai-orchestration-boundary.registered.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-orchestration-boundary.registered.js","sourceRoot":"","sources":["../../../../src/ai/testing/conformance/ai-orchestration-boundary.registered.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,0DAA0D;AAC1D,4CAA4C;;;AAG5C,iFAAkH;AAElH;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAsD;IAC7F,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,qDAAqD;IAC5D,WAAW,EACT,wJAAwJ;IAC1J,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO;QAC9B,IAAA,4DAA6B,EAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACF,CAAC"}

package/dist/ai/testing/conformance/ai-rbac-matrix.suite.d.ts

@@ -0,0 +1,29 @@
+import type { ConformanceAppSuite } from '../../../testing/index';
+import { type AiConformanceFixture } from './ai-conformance-fixture';
+/**
+ * How an app configures the `ai-rbac-matrix` suite.
+ *
+ * @example
+ * ```ts
+ * suites: { aiRbacMatrix: { fixture: aiConformanceFixture } }
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export interface AiRbacMatrixOptions {
+    /** How the app boots, and the role grants it seeds; see {@link AiConformanceFixture}. */
+    fixture: AiConformanceFixture;
+    /** Vacuity guard: at least this many AI routes (consumer and admin) must be found (default 15, the platform's own). */
+    minRoutes?: number;
+    /** Vacuity guard: at least this many of them must carry `x-rbac` permissions (default 10). */
+    minPermissionedRoutes?: number;
+}
+/**
+ * The suite behind `runPlatformConformance({ suites: { aiRbacMatrix } })`.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const aiRbacMatrixSuite: ConformanceAppSuite<AiRbacMatrixOptions>;
+//# sourceMappingURL=ai-rbac-matrix.suite.d.ts.map

package/dist/ai/testing/conformance/ai-rbac-matrix.suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-rbac-matrix.suite.d.ts","sourceRoot":"","sources":["../../../../src/ai/testing/conformance/ai-rbac-matrix.suite.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAqC,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUxG;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,OAAO,EAAE,oBAAoB,CAAC;IAC9B,uHAAuH;IACvH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAoJD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBAAmB,CAAC,mBAAmB,CAQtE,CAAC"}