@thomasminh1995/depverdict 0.6.0-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (252) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +518 -0
  3. package/bin/depverdict.js +7 -0
  4. package/bin/upgradelens.js +7 -0
  5. package/docs/GR-01-Semantic-Grounding-Failure-Analysis.md +309 -0
  6. package/docs/GR-02-Versioned-Action-Evaluation-Criteria.md +187 -0
  7. package/docs/GR-03-Extractive-Contract-Safety-Experiment.md +242 -0
  8. package/docs/GR-04-Versioned-Production-Extractive-Contract.md +154 -0
  9. package/docs/IA-01-Repository-Usage-Discovery.md +122 -0
  10. package/docs/IA-02-Repository-Impact-Analysis.md +118 -0
  11. package/docs/IA-03-Repository-Impact-Evidence.md +160 -0
  12. package/docs/IA-04-CLI-Orchestration.md +235 -0
  13. package/docs/IA-05-Real-Provider-Validation.md +235 -0
  14. package/docs/IA-05-VinGrade-Validation.md +339 -0
  15. package/docs/MVP-01.md +48 -0
  16. package/docs/MVP-02-Architecture.md +536 -0
  17. package/docs/MVP-02-CLI-HTTP-Runtime.md +50 -0
  18. package/docs/MVP-02-HTTP-Lifecycle.md +37 -0
  19. package/docs/MVP-02-Knowledge-Manifest-Generation.md +75 -0
  20. package/docs/MVP-02-Knowledge-Manifest.md +279 -0
  21. package/docs/MVP-02-Knowledge-Research-Orchestration.md +62 -0
  22. package/docs/MVP-02-Knowledge-Store.md +87 -0
  23. package/docs/MVP-02-PyPI-Registry-Adapter.md +97 -0
  24. package/docs/MVP-02-Research-Planning.md +196 -0
  25. package/docs/MVP-02-Source-Provenance.md +81 -0
  26. package/docs/MVP-02-npm-Registry-Adapter.md +99 -0
  27. package/docs/RR-01-End-to-End-and-Real-Provider-Validation.md +393 -0
  28. package/docs/RR-01-RERUN-Extractive-Contract-Validation.md +566 -0
  29. package/docs/RR-02-Full-Product-Workflow-and-Developer-CLI-UX-Review.md +35 -0
  30. package/docs/RR02-FIX-01-Persistent-Qualification-Resolution.md +32 -0
  31. package/docs/RR02-FIX-02-Stage-aware-CLI-Progress-and-Heartbeat.md +28 -0
  32. package/docs/RR02-FIX-03-npm-Capture-Evidence-Exclusion.md +33 -0
  33. package/docs/RR02-FIX-03A-Complete-Package-Exclusion-and-Evidence-Commit.md +223 -0
  34. package/docs/RR02-FIX-04-Event-loop-safe-Heartbeat.md +393 -0
  35. package/docs/RR02-FIX-05-Materialize-Persisted-Qualification.md +207 -0
  36. package/docs/RR02-RERUN-CLI-Qualification-Progress-UX-and-Package-Validation.md +342 -0
  37. package/docs/VinGrade-MVP-02-Validation.md +480 -0
  38. package/docs/VinGrade-RC02-Live-Validation.md +273 -0
  39. package/docs/ai-capability-discovery.md +573 -0
  40. package/docs/ai-engineering-production-readiness.md +390 -0
  41. package/docs/ai-engineering-review.md +251 -0
  42. package/docs/ai-runtime-governance-discovery.md +754 -0
  43. package/docs/architecture-overview.md +78 -0
  44. package/docs/cli-progress.md +111 -0
  45. package/docs/decisions/diff-01-brand-distribution-identity.md +450 -0
  46. package/docs/decisions/diff-02-identity-compatibility-contract.md +274 -0
  47. package/docs/decisions/diff-03-repository-docs-community-migration.md +165 -0
  48. package/docs/decisions/diff-04-release-evidence-gap-acceptance.md +110 -0
  49. package/docs/discovery/mvp-05-ai-migration-planning-discovery.md +350 -0
  50. package/docs/gateway-runtime-discovery.md +614 -0
  51. package/docs/live-ai-validation.md +299 -0
  52. package/docs/migration-planning-qualification-resolution.md +99 -0
  53. package/docs/migrations/upgradelens-to-depverdict.md +97 -0
  54. package/docs/mp-r03-deterministic-upgrade-decision-architecture.md +135 -0
  55. package/docs/mp-r04-evidence-bounded-migration-handoff-architecture.md +116 -0
  56. package/docs/mp-r05-product-completion-and-decision-first-cli-architecture.md +162 -0
  57. package/docs/mvp-05-deterministic-context-runtime.md +127 -0
  58. package/docs/mvp-05-migration-checklist-contract.md +166 -0
  59. package/docs/mvp-05-migration-checklist-orchestration.md +105 -0
  60. package/docs/mvp-05-migration-evaluation-and-qualification.md +135 -0
  61. package/docs/mvp-05-provider-neutral-generator.md +79 -0
  62. package/docs/ollama-local-smoke-validation.md +156 -0
  63. package/docs/openai-compatible-runtime-discovery.md +789 -0
  64. package/docs/openrouter-one-dependency-validation.md +205 -0
  65. package/docs/oss-02-package-guard-hardening-architecture.md +131 -0
  66. package/docs/oss-04-public-ci-package-metadata-architecture.md +142 -0
  67. package/docs/package-content-policy.md +98 -0
  68. package/docs/releases/v0.5.0-technical-preview.md +114 -0
  69. package/docs/releases/v0.6.0-alpha.1-depverdict-preview.md +101 -0
  70. package/docs/reviews/diff-02-identity-contract-compatibility.md +413 -0
  71. package/docs/reviews/diff-03-repository-docs-community-migration.md +364 -0
  72. package/docs/reviews/diff-04-depverdict-distribution-identity-readiness-rereview.md +453 -0
  73. package/docs/reviews/diff-04-fix-post-rename-identity-release-remediation.md +310 -0
  74. package/docs/reviews/diff-05-final-preview-distribution-qualification.md +561 -0
  75. package/docs/reviews/mvp-05-final-product-value-workflow-rereview.md +471 -0
  76. package/docs/reviews/mvp-05-product-workflow-review.md +605 -0
  77. package/docs/reviews/oss-01-duplicate-artifact-investigation-cleanup.md +411 -0
  78. package/docs/reviews/oss-02-package-guard-hardening.md +303 -0
  79. package/docs/reviews/oss-03-community-scaffolding.md +378 -0
  80. package/docs/reviews/oss-04-public-ci-package-metadata.md +439 -0
  81. package/docs/reviews/oss-05-technical-preview-qualification.md +482 -0
  82. package/docs/reviews/upgradelens-vs-upgradedepdetective-source-comparison.md +355 -0
  83. package/docs/reviews/v0.5.0-pre-release-smoke.md +263 -0
  84. package/docs/reviews/v0.5.0-version-bump-release-verification.md +306 -0
  85. package/docs/runtime-contract-discovery.md +521 -0
  86. package/docs/structured-output-compatibility-report.md +100 -0
  87. package/docs/ts-fix-01-exact-duplicate-occurrence-target-selection-architecture.md +111 -0
  88. package/docs/version-analysis-architecture.md +827 -0
  89. package/eval/README.md +86 -0
  90. package/eval/datasets/generic/declared-constraint.json +59 -0
  91. package/eval/datasets/generic/evidence-conflict.json +73 -0
  92. package/eval/datasets/generic/major-breaking-release.json +66 -0
  93. package/eval/datasets/generic/missing-evidence.json +46 -0
  94. package/eval/datasets/generic/patch-release-low.json +59 -0
  95. package/eval/datasets/node/axios-patch-low.json +59 -0
  96. package/eval/datasets/node/react-major-breaking.json +66 -0
  97. package/eval/datasets/node/react-minor-compatibility.json +66 -0
  98. package/eval/datasets/python/fastapi-deprecation.json +66 -0
  99. package/eval/datasets/python/pydantic-major-breaking.json +66 -0
  100. package/eval/migration-planning/golden-dataset-v2.json +306 -0
  101. package/eval/migration-planning/golden-dataset.json +214 -0
  102. package/eval/schemas/expected-result.schema.json +88 -0
  103. package/eval/schemas/golden-case.schema.json +181 -0
  104. package/package.json +57 -0
  105. package/schemas/ai-scorecard.schema.json +132 -0
  106. package/schemas/benchmark-report.schema.json +189 -0
  107. package/schemas/benchmark.schema.json +55 -0
  108. package/schemas/capability-profile.schema.json +44 -0
  109. package/schemas/conformance-report.schema.json +150 -0
  110. package/schemas/deployment-profile.schema.json +64 -0
  111. package/schemas/evaluation-report.schema.json +158 -0
  112. package/schemas/knowledge-evidence-bundle.schema.json +150 -0
  113. package/schemas/knowledge-manifest.schema.json +548 -0
  114. package/schemas/metrics.schema.json +178 -0
  115. package/schemas/migration-checklist-extractive-candidate.schema.json +42 -0
  116. package/schemas/migration-checklist.schema.json +706 -0
  117. package/schemas/migration-evaluation-dataset-v2.schema.json +208 -0
  118. package/schemas/migration-evaluation-dataset.schema.json +204 -0
  119. package/schemas/migration-planning-qualification-record.schema.json +234 -0
  120. package/schemas/project-manifest.schema.json +308 -0
  121. package/schemas/qualification-record.schema.json +56 -0
  122. package/schemas/repository-impact-evidence.schema.json +232 -0
  123. package/schemas/repository-impact.schema.json +202 -0
  124. package/schemas/upgrade-decision.schema.json +273 -0
  125. package/schemas/usage-index.schema.json +179 -0
  126. package/schemas/version-analysis.schema.json +449 -0
  127. package/src/ai-runtime-debug.js +325 -0
  128. package/src/ai-runtime-error.js +42 -0
  129. package/src/ai-runtime.js +174 -0
  130. package/src/ai-scorecard.js +204 -0
  131. package/src/ai-version-analysis.js +484 -0
  132. package/src/artifact-root-compatibility.js +91 -0
  133. package/src/benchmark-report.js +111 -0
  134. package/src/benchmark-runner.js +191 -0
  135. package/src/canonical-json.js +69 -0
  136. package/src/cli.js +1299 -0
  137. package/src/conformance-report.js +158 -0
  138. package/src/conformance-runner.js +253 -0
  139. package/src/constants.js +73 -0
  140. package/src/cooperative-scheduler.js +79 -0
  141. package/src/dependencies.js +44 -0
  142. package/src/dependency-ai-context.js +625 -0
  143. package/src/detectors.js +253 -0
  144. package/src/discovery.js +234 -0
  145. package/src/ecosystem-version-adapter.js +294 -0
  146. package/src/environment-compatibility.js +77 -0
  147. package/src/evaluation-comparator.js +158 -0
  148. package/src/evaluation-report.js +76 -0
  149. package/src/evaluation-runner.js +248 -0
  150. package/src/evidence-source-adapter.js +472 -0
  151. package/src/files.js +89 -0
  152. package/src/governance-diagnostics.js +64 -0
  153. package/src/governance-loader.js +63 -0
  154. package/src/governance-metadata.js +346 -0
  155. package/src/governance-validator.js +360 -0
  156. package/src/http/bounded-fetch.js +278 -0
  157. package/src/http/cli-http-runtime.js +44 -0
  158. package/src/impact/input-loader.js +157 -0
  159. package/src/impact/matcher.js +40 -0
  160. package/src/impact/repository-impact.js +199 -0
  161. package/src/impact/runtime.js +24 -0
  162. package/src/impact/status.js +62 -0
  163. package/src/impact/writer.js +30 -0
  164. package/src/impact-evidence/input-loader.js +202 -0
  165. package/src/impact-evidence/repository-impact-evidence.js +234 -0
  166. package/src/impact-evidence/runtime.js +16 -0
  167. package/src/impact-evidence/writer.js +30 -0
  168. package/src/index.js +563 -0
  169. package/src/installed-version-baseline.js +196 -0
  170. package/src/knowledge-cache.js +324 -0
  171. package/src/knowledge-evidence-bundle.js +101 -0
  172. package/src/knowledge-evidence-producer.js +233 -0
  173. package/src/knowledge-manifest-builder.js +188 -0
  174. package/src/knowledge-manifest-writer.js +32 -0
  175. package/src/knowledge-manifest.js +255 -0
  176. package/src/knowledge-research.js +615 -0
  177. package/src/metrics-engine.js +205 -0
  178. package/src/migration-checklist/ai-candidate.js +320 -0
  179. package/src/migration-checklist/assembler.js +37 -0
  180. package/src/migration-checklist/context-runtime.js +828 -0
  181. package/src/migration-checklist/evaluation/action-criteria.js +244 -0
  182. package/src/migration-checklist/evaluation/comparator-v2.js +332 -0
  183. package/src/migration-checklist/evaluation/comparator.js +279 -0
  184. package/src/migration-checklist/evaluation/dataset-v2.js +227 -0
  185. package/src/migration-checklist/evaluation/dataset.js +336 -0
  186. package/src/migration-checklist/evaluation/extractive-fixtures-v2.js +148 -0
  187. package/src/migration-checklist/evaluation/metrics-v2.js +226 -0
  188. package/src/migration-checklist/evaluation/metrics.js +158 -0
  189. package/src/migration-checklist/evaluation/qualification-v2.js +321 -0
  190. package/src/migration-checklist/evaluation/qualification.js +239 -0
  191. package/src/migration-checklist/evaluation/runner-v2.js +294 -0
  192. package/src/migration-checklist/evaluation/runner.js +194 -0
  193. package/src/migration-checklist/evaluation/scorecard-v2.js +106 -0
  194. package/src/migration-checklist/evaluation/scorecard.js +86 -0
  195. package/src/migration-checklist/extractive-candidate.js +166 -0
  196. package/src/migration-checklist/extractive-prompt.js +62 -0
  197. package/src/migration-checklist/generator.js +702 -0
  198. package/src/migration-checklist/grounding-policy.js +117 -0
  199. package/src/migration-checklist/input-loader.js +613 -0
  200. package/src/migration-checklist/migration-checklist.js +635 -0
  201. package/src/migration-checklist/presentation.js +292 -0
  202. package/src/migration-checklist/progress.js +96 -0
  203. package/src/migration-checklist/prompt.js +83 -0
  204. package/src/migration-checklist/qualification-guard.js +462 -0
  205. package/src/migration-checklist/qualification-resolution.js +122 -0
  206. package/src/migration-checklist/qualification-store.js +225 -0
  207. package/src/migration-checklist/runtime.js +205 -0
  208. package/src/migration-checklist/verification.js +134 -0
  209. package/src/migration-checklist/writer.js +35 -0
  210. package/src/openai-compatible-provider.js +451 -0
  211. package/src/orchestration/failure-log.js +32 -0
  212. package/src/orchestration/pipeline.js +200 -0
  213. package/src/orchestration/progress-events.js +337 -0
  214. package/src/orchestration/progress-reporter.js +131 -0
  215. package/src/orchestration/text-writer.js +22 -0
  216. package/src/portable.js +13 -0
  217. package/src/product-completion.js +249 -0
  218. package/src/project-manifest-input.js +90 -0
  219. package/src/project-manifest.js +141 -0
  220. package/src/python-requirements.js +137 -0
  221. package/src/registry/npm-packument.js +256 -0
  222. package/src/registry/npm-registry-adapter.js +262 -0
  223. package/src/registry/pypi-project.js +300 -0
  224. package/src/registry/pypi-registry-adapter.js +235 -0
  225. package/src/registry/sanitize-registry-body.js +51 -0
  226. package/src/renderers/console.js +160 -0
  227. package/src/renderers/impact-presentation.js +278 -0
  228. package/src/renderers/markdown.js +172 -0
  229. package/src/research-plan.js +455 -0
  230. package/src/runtime-conformance.js +275 -0
  231. package/src/source-provenance.js +393 -0
  232. package/src/source-url.js +62 -0
  233. package/src/structured-output-schema.js +66 -0
  234. package/src/target-selector.js +306 -0
  235. package/src/upgrade-decision/input-loader.js +107 -0
  236. package/src/upgrade-decision/presentation.js +43 -0
  237. package/src/upgrade-decision/runtime.js +21 -0
  238. package/src/upgrade-decision/upgrade-decision.js +626 -0
  239. package/src/upgrade-decision/writer.js +30 -0
  240. package/src/usage/analyzer-registry.js +63 -0
  241. package/src/usage/coverage.js +116 -0
  242. package/src/usage/input-loader.js +139 -0
  243. package/src/usage/js/analyzer.js +240 -0
  244. package/src/usage/js/parser.js +21 -0
  245. package/src/usage/runtime.js +187 -0
  246. package/src/usage/scope.js +44 -0
  247. package/src/usage/source-files.js +50 -0
  248. package/src/usage/usage-index.js +217 -0
  249. package/src/usage/writer.js +31 -0
  250. package/src/version-analysis-loader.js +203 -0
  251. package/src/version-analysis-manifest.js +314 -0
  252. package/src/version-analysis-writer.js +30 -0
@@ -0,0 +1,706 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://raw.githubusercontent.com/thomasMinh1995/UpgradeLens/main/schemas/migration-checklist.schema.json",
4
+ "title": "UpgradeLens Evidence-Grounded Migration Checklist",
5
+ "description": "A human-review checklist grounded in version, source-evidence, and positive repository-impact references.",
6
+ "type": "object",
7
+ "additionalProperties": false,
8
+ "required": [
9
+ "schemaVersion",
10
+ "generatedAt",
11
+ "generator",
12
+ "input",
13
+ "repository",
14
+ "status",
15
+ "summary",
16
+ "dependencies",
17
+ "limitations"
18
+ ],
19
+ "properties": {
20
+ "schemaVersion": { "const": "2.0.0" },
21
+ "generatedAt": { "type": "string", "format": "date-time" },
22
+ "generator": { "$ref": "#/$defs/generator" },
23
+ "input": { "$ref": "#/$defs/input" },
24
+ "repository": { "$ref": "#/$defs/repository" },
25
+ "status": { "$ref": "#/$defs/checklistStatus" },
26
+ "summary": { "$ref": "#/$defs/summary" },
27
+ "dependencies": {
28
+ "type": "array",
29
+ "items": { "$ref": "#/$defs/dependencyChecklist" }
30
+ },
31
+ "limitations": {
32
+ "type": "array",
33
+ "items": { "$ref": "#/$defs/limitation" }
34
+ }
35
+ },
36
+ "$defs": {
37
+ "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
38
+ "relativePath": {
39
+ "type": "string",
40
+ "minLength": 1,
41
+ "pattern": "^(?!/)(?![A-Za-z]:)(?!.*(?:^|/)\\.\\.(?:/|$))[^\\\\]+$"
42
+ },
43
+ "nullableString": { "type": ["string", "null"] },
44
+ "installedVersionSource": {
45
+ "type": "object",
46
+ "additionalProperties": false,
47
+ "required": ["type", "path", "lockfileVersion", "packagePath"],
48
+ "properties": {
49
+ "type": { "const": "package-lock" },
50
+ "path": { "$ref": "#/$defs/relativePath" },
51
+ "lockfileVersion": { "enum": [1, 2, 3] },
52
+ "packagePath": { "$ref": "#/$defs/relativePath" }
53
+ }
54
+ },
55
+ "installedVersionReason": {
56
+ "enum": [
57
+ "INVALID_LOCKFILE",
58
+ "LOCKFILE_NOT_FOUND",
59
+ "LOCKFILE_UNSUPPORTED",
60
+ "NON_REGISTRY_DEPENDENCY",
61
+ "PACKAGE_NOT_RESOLVED",
62
+ "RESOLVED_VERSION_UNAVAILABLE",
63
+ "WORKSPACE_RESOLUTION_AMBIGUOUS"
64
+ ]
65
+ },
66
+ "generator": {
67
+ "type": "object",
68
+ "additionalProperties": false,
69
+ "required": ["name", "version"],
70
+ "properties": {
71
+ "name": { "const": "UpgradeLens" },
72
+ "version": { "type": "string", "minLength": 1 }
73
+ }
74
+ },
75
+ "repository": {
76
+ "type": "object",
77
+ "additionalProperties": false,
78
+ "required": ["name", "root"],
79
+ "properties": {
80
+ "name": { "type": "string", "minLength": 1 },
81
+ "root": { "const": "." }
82
+ }
83
+ },
84
+ "projectManifestLineage": {
85
+ "type": "object",
86
+ "additionalProperties": false,
87
+ "required": ["schemaVersion", "artifact", "artifactDigest", "repository"],
88
+ "properties": {
89
+ "schemaVersion": { "const": "2.0.0" },
90
+ "artifact": { "$ref": "#/$defs/relativePath" },
91
+ "artifactDigest": { "$ref": "#/$defs/digest" },
92
+ "repository": { "$ref": "#/$defs/repository" }
93
+ }
94
+ },
95
+ "knowledgeManifestLineage": {
96
+ "type": "object",
97
+ "additionalProperties": false,
98
+ "required": ["schemaVersion", "artifact", "artifactDigest", "researchId"],
99
+ "properties": {
100
+ "schemaVersion": { "const": "1.0.0" },
101
+ "artifact": { "$ref": "#/$defs/relativePath" },
102
+ "artifactDigest": { "$ref": "#/$defs/digest" },
103
+ "researchId": { "$ref": "#/$defs/digest" }
104
+ }
105
+ },
106
+ "artifactLineage": {
107
+ "type": "object",
108
+ "additionalProperties": false,
109
+ "required": ["schemaVersion", "artifact", "artifactDigest"],
110
+ "properties": {
111
+ "schemaVersion": { "const": "1.0.0" },
112
+ "artifact": { "$ref": "#/$defs/relativePath" },
113
+ "artifactDigest": { "$ref": "#/$defs/digest" }
114
+ }
115
+ },
116
+ "input": {
117
+ "type": "object",
118
+ "additionalProperties": false,
119
+ "required": [
120
+ "projectManifest",
121
+ "knowledgeManifest",
122
+ "knowledgeEvidenceBundle",
123
+ "versionAnalysis",
124
+ "usageIndex",
125
+ "repositoryImpact",
126
+ "repositoryImpactEvidence",
127
+ "upgradeDecision"
128
+ ],
129
+ "properties": {
130
+ "projectManifest": { "$ref": "#/$defs/projectManifestLineage" },
131
+ "knowledgeManifest": { "$ref": "#/$defs/knowledgeManifestLineage" },
132
+ "knowledgeEvidenceBundle": { "$ref": "#/$defs/artifactLineage" },
133
+ "versionAnalysis": { "$ref": "#/$defs/artifactLineage" },
134
+ "usageIndex": { "$ref": "#/$defs/artifactLineage" },
135
+ "repositoryImpact": { "$ref": "#/$defs/artifactLineage" },
136
+ "repositoryImpactEvidence": { "$ref": "#/$defs/artifactLineage" },
137
+ "upgradeDecision": { "$ref": "#/$defs/artifactLineage" }
138
+ }
139
+ },
140
+ "checklistStatus": {
141
+ "enum": ["COMPLETE", "INCOMPLETE", "NO_GROUNDED_ACTION", "NOT_ANALYZED"]
142
+ },
143
+ "eligibility": {
144
+ "type": "object",
145
+ "additionalProperties": false,
146
+ "required": ["status", "reasonCode"],
147
+ "properties": {
148
+ "status": { "enum": ["ELIGIBLE", "INELIGIBLE", "REVIEW_REQUIRED"] },
149
+ "reasonCode": {
150
+ "enum": [
151
+ "ELIGIBLE",
152
+ "NOT_ANALYZED",
153
+ "NO_GROUNDED_ACTION",
154
+ "UNSUPPORTED_USAGE_COVERAGE",
155
+ "INVALID_OR_CONFLICTED_EVIDENCE",
156
+ "MANUAL_REVIEW_REQUIRED"
157
+ ]
158
+ }
159
+ }
160
+ },
161
+ "statusCounts": {
162
+ "type": "object",
163
+ "additionalProperties": false,
164
+ "required": ["COMPLETE", "INCOMPLETE", "NO_GROUNDED_ACTION", "NOT_ANALYZED"],
165
+ "properties": {
166
+ "COMPLETE": { "type": "integer", "minimum": 0 },
167
+ "INCOMPLETE": { "type": "integer", "minimum": 0 },
168
+ "NO_GROUNDED_ACTION": { "type": "integer", "minimum": 0 },
169
+ "NOT_ANALYZED": { "type": "integer", "minimum": 0 }
170
+ }
171
+ },
172
+ "handoffStatusCounts": {
173
+ "type": "object",
174
+ "additionalProperties": false,
175
+ "required": [
176
+ "NO_VERSION_CHANGE_REQUIRED",
177
+ "ACTIONABLE_WITH_REVIEW",
178
+ "INVESTIGATION_REQUIRED",
179
+ "INSUFFICIENT_EVIDENCE",
180
+ "NOT_ANALYZED",
181
+ "ACTION_GENERATION_FAILED",
182
+ "NO_GROUNDED_ACTION"
183
+ ],
184
+ "properties": {
185
+ "NO_VERSION_CHANGE_REQUIRED": { "type": "integer", "minimum": 0 },
186
+ "ACTIONABLE_WITH_REVIEW": { "type": "integer", "minimum": 0 },
187
+ "INVESTIGATION_REQUIRED": { "type": "integer", "minimum": 0 },
188
+ "INSUFFICIENT_EVIDENCE": { "type": "integer", "minimum": 0 },
189
+ "NOT_ANALYZED": { "type": "integer", "minimum": 0 },
190
+ "ACTION_GENERATION_FAILED": { "type": "integer", "minimum": 0 },
191
+ "NO_GROUNDED_ACTION": { "type": "integer", "minimum": 0 }
192
+ }
193
+ },
194
+ "summary": {
195
+ "type": "object",
196
+ "additionalProperties": false,
197
+ "required": [
198
+ "dependencyCount",
199
+ "findingCount",
200
+ "itemCount",
201
+ "groundedActionCount",
202
+ "aiAuthoredItemCount",
203
+ "candidateLocationCount",
204
+ "requiresHumanReviewItemCount",
205
+ "limitationCount",
206
+ "statusCounts",
207
+ "handoffStatusCounts"
208
+ ],
209
+ "properties": {
210
+ "dependencyCount": { "type": "integer", "minimum": 0 },
211
+ "findingCount": { "type": "integer", "minimum": 0 },
212
+ "itemCount": { "type": "integer", "minimum": 0 },
213
+ "groundedActionCount": { "type": "integer", "minimum": 0 },
214
+ "aiAuthoredItemCount": { "type": "integer", "minimum": 0 },
215
+ "candidateLocationCount": { "type": "integer", "minimum": 0 },
216
+ "requiresHumanReviewItemCount": { "type": "integer", "minimum": 0 },
217
+ "limitationCount": { "type": "integer", "minimum": 0 },
218
+ "statusCounts": { "$ref": "#/$defs/statusCounts" },
219
+ "handoffStatusCounts": { "$ref": "#/$defs/handoffStatusCounts" }
220
+ }
221
+ },
222
+ "dependency": {
223
+ "type": "object",
224
+ "additionalProperties": false,
225
+ "required": [
226
+ "projectId",
227
+ "packageId",
228
+ "declaredName",
229
+ "normalizedName",
230
+ "ecosystem",
231
+ "registry",
232
+ "packageManager",
233
+ "dependencyType",
234
+ "manifest"
235
+ ],
236
+ "properties": {
237
+ "projectId": { "type": "string", "minLength": 1 },
238
+ "packageId": { "type": "string", "minLength": 1 },
239
+ "declaredName": { "type": "string", "minLength": 1 },
240
+ "normalizedName": { "type": "string", "minLength": 1 },
241
+ "ecosystem": { "type": "string", "minLength": 1 },
242
+ "registry": { "type": "string", "minLength": 1 },
243
+ "packageManager": { "$ref": "#/$defs/nullableString" },
244
+ "dependencyType": { "type": "string", "minLength": 1 },
245
+ "manifest": { "$ref": "#/$defs/relativePath" }
246
+ }
247
+ },
248
+ "versions": {
249
+ "type": "object",
250
+ "additionalProperties": false,
251
+ "required": [
252
+ "analysisMode",
253
+ "declaredVersion",
254
+ "currentVersion",
255
+ "currentVersionSource",
256
+ "targetVersion",
257
+ "targetPolicy",
258
+ "delta"
259
+ ],
260
+ "properties": {
261
+ "analysisMode": { "enum": ["exactBaseline", "declaredConstraint", "unsupportedBaseline"] },
262
+ "declaredVersion": { "$ref": "#/$defs/nullableString" },
263
+ "installedVersion": { "$ref": "#/$defs/nullableString" },
264
+ "installedVersionStatus": { "enum": ["resolved", "unresolved", "legacyMissing"] },
265
+ "installedVersionSource": {
266
+ "anyOf": [
267
+ { "$ref": "#/$defs/installedVersionSource" },
268
+ { "type": "null" }
269
+ ]
270
+ },
271
+ "installedVersionReason": {
272
+ "anyOf": [
273
+ { "$ref": "#/$defs/installedVersionReason" },
274
+ { "type": "null" }
275
+ ]
276
+ },
277
+ "currentVersion": { "$ref": "#/$defs/nullableString" },
278
+ "currentVersionSource": {
279
+ "anyOf": [
280
+ { "enum": ["explicit", "exactDeclaration", "resolvedArtifact"] },
281
+ { "type": "null" }
282
+ ]
283
+ },
284
+ "targetVersion": { "$ref": "#/$defs/nullableString" },
285
+ "targetPolicy": { "enum": ["explicit", "registryLatest"] },
286
+ "delta": {
287
+ "type": "object",
288
+ "additionalProperties": false,
289
+ "required": ["direction", "classification"],
290
+ "properties": {
291
+ "direction": { "enum": ["upgrade", "same", "downgrade", "unknown"] },
292
+ "classification": { "enum": ["major", "minor", "patch", "prerelease", "other", "unknown"] }
293
+ }
294
+ }
295
+ },
296
+ "allOf": [
297
+ {
298
+ "if": {
299
+ "properties": { "installedVersionStatus": { "const": "resolved" } },
300
+ "required": ["installedVersionStatus"]
301
+ },
302
+ "then": {
303
+ "properties": {
304
+ "installedVersion": { "type": "string", "minLength": 1 },
305
+ "installedVersionSource": { "$ref": "#/$defs/installedVersionSource" },
306
+ "installedVersionReason": { "type": "null" }
307
+ }
308
+ }
309
+ },
310
+ {
311
+ "if": {
312
+ "properties": { "installedVersionStatus": { "const": "unresolved" } },
313
+ "required": ["installedVersionStatus"]
314
+ },
315
+ "then": {
316
+ "properties": {
317
+ "installedVersion": { "type": "null" },
318
+ "installedVersionSource": { "type": "null" },
319
+ "installedVersionReason": { "$ref": "#/$defs/installedVersionReason" }
320
+ }
321
+ }
322
+ },
323
+ {
324
+ "if": {
325
+ "properties": { "installedVersionStatus": { "const": "legacyMissing" } },
326
+ "required": ["installedVersionStatus"]
327
+ },
328
+ "then": {
329
+ "properties": {
330
+ "installedVersion": { "type": "null" },
331
+ "installedVersionSource": { "type": "null" },
332
+ "installedVersionReason": { "type": "null" }
333
+ }
334
+ }
335
+ }
336
+ ]
337
+ },
338
+ "candidateLocation": {
339
+ "type": "object",
340
+ "additionalProperties": false,
341
+ "required": ["impactEvidenceId", "symbol", "file"],
342
+ "properties": {
343
+ "impactEvidenceId": { "$ref": "#/$defs/digest" },
344
+ "symbol": { "type": "string", "minLength": 1 },
345
+ "file": { "$ref": "#/$defs/relativePath" }
346
+ }
347
+ },
348
+ "checklistItem": {
349
+ "type": "object",
350
+ "additionalProperties": false,
351
+ "required": [
352
+ "id",
353
+ "kind",
354
+ "basis",
355
+ "instruction",
356
+ "findingId",
357
+ "evidenceRefs",
358
+ "candidateLocations",
359
+ "requiresHumanReview"
360
+ ],
361
+ "properties": {
362
+ "id": { "$ref": "#/$defs/digest" },
363
+ "kind": {
364
+ "enum": [
365
+ "REVIEW_MIGRATION_INSTRUCTION",
366
+ "REVIEW_CANDIDATE_USAGE",
367
+ "VERIFY_OFFICIAL_REQUIREMENT",
368
+ "MANUAL_REVIEW_REQUIRED"
369
+ ]
370
+ },
371
+ "basis": { "enum": ["DETERMINISTIC", "AI_AUTHORED"] },
372
+ "instruction": { "type": "string", "minLength": 1, "maxLength": 2000 },
373
+ "findingId": { "type": "string", "minLength": 1 },
374
+ "evidenceRefs": {
375
+ "type": "array",
376
+ "uniqueItems": true,
377
+ "items": { "$ref": "#/$defs/digest" }
378
+ },
379
+ "candidateLocations": {
380
+ "type": "array",
381
+ "uniqueItems": true,
382
+ "items": { "$ref": "#/$defs/candidateLocation" }
383
+ },
384
+ "requiresHumanReview": { "const": true }
385
+ }
386
+ },
387
+ "findingChecklist": {
388
+ "type": "object",
389
+ "additionalProperties": false,
390
+ "required": [
391
+ "id",
392
+ "kind",
393
+ "summary",
394
+ "status",
395
+ "eligibility",
396
+ "evidenceRefs",
397
+ "positiveImpactLocations",
398
+ "items"
399
+ ],
400
+ "properties": {
401
+ "id": { "type": "string", "minLength": 1 },
402
+ "kind": { "const": "breakingChange" },
403
+ "summary": { "type": "string", "minLength": 1 },
404
+ "status": { "$ref": "#/$defs/checklistStatus" },
405
+ "eligibility": { "$ref": "#/$defs/eligibility" },
406
+ "evidenceRefs": {
407
+ "type": "array",
408
+ "uniqueItems": true,
409
+ "items": { "$ref": "#/$defs/digest" }
410
+ },
411
+ "positiveImpactLocations": {
412
+ "type": "array",
413
+ "uniqueItems": true,
414
+ "items": { "$ref": "#/$defs/candidateLocation" }
415
+ },
416
+ "items": {
417
+ "type": "array",
418
+ "items": { "$ref": "#/$defs/checklistItem" }
419
+ }
420
+ }
421
+ },
422
+ "limitation": {
423
+ "type": "object",
424
+ "additionalProperties": false,
425
+ "required": ["code", "message"],
426
+ "properties": {
427
+ "code": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
428
+ "message": { "type": "string", "minLength": 1 }
429
+ }
430
+ },
431
+ "decisionProjection": {
432
+ "type": "object",
433
+ "additionalProperties": false,
434
+ "required": [
435
+ "status",
436
+ "targetOrigin",
437
+ "recommendationDriver",
438
+ "primaryReasonCode",
439
+ "reasonCodes"
440
+ ],
441
+ "properties": {
442
+ "status": {
443
+ "enum": [
444
+ "KEEP_CURRENT", "UPGRADE_NOW", "PLAN_UPGRADE", "INVESTIGATE",
445
+ "INSUFFICIENT_EVIDENCE", "NOT_ANALYZED"
446
+ ]
447
+ },
448
+ "targetOrigin": { "enum": ["explicit", "registryLatest", "unknown"] },
449
+ "recommendationDriver": { "type": ["string", "null"], "minLength": 1 },
450
+ "primaryReasonCode": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
451
+ "reasonCodes": {
452
+ "type": "array",
453
+ "minItems": 1,
454
+ "uniqueItems": true,
455
+ "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
456
+ }
457
+ }
458
+ },
459
+ "affectedArea": {
460
+ "type": "object",
461
+ "additionalProperties": false,
462
+ "required": [
463
+ "impactEvidenceId", "findingId", "symbol", "file", "coverageStatus"
464
+ ],
465
+ "properties": {
466
+ "impactEvidenceId": { "$ref": "#/$defs/digest" },
467
+ "findingId": { "type": "string", "minLength": 1 },
468
+ "symbol": { "type": "string", "minLength": 1 },
469
+ "file": { "$ref": "#/$defs/relativePath" },
470
+ "coverageStatus": {
471
+ "enum": ["complete", "partial", "unavailable", "failed", "missing"]
472
+ }
473
+ }
474
+ },
475
+ "coverageState": {
476
+ "type": "object",
477
+ "additionalProperties": false,
478
+ "required": ["status", "reasonCode"],
479
+ "properties": {
480
+ "status": { "enum": ["complete", "partial", "unavailable", "failed", "missing"] },
481
+ "reasonCode": { "type": ["string", "null"] }
482
+ }
483
+ },
484
+ "verificationSource": {
485
+ "type": "object",
486
+ "additionalProperties": false,
487
+ "required": ["path", "contentDigest", "scriptName", "packageManager"],
488
+ "properties": {
489
+ "path": { "$ref": "#/$defs/relativePath" },
490
+ "contentDigest": { "$ref": "#/$defs/digest" },
491
+ "scriptName": { "enum": ["build", "check", "lint", "test", "typecheck"] },
492
+ "packageManager": { "enum": ["bun", "npm", "pnpm", "yarn"] }
493
+ }
494
+ },
495
+ "verificationCommand": {
496
+ "type": "object",
497
+ "additionalProperties": false,
498
+ "required": ["id", "role", "command", "workingDirectory", "source"],
499
+ "properties": {
500
+ "id": { "$ref": "#/$defs/digest" },
501
+ "role": { "enum": ["BUILD", "CHECK", "LINT", "TEST", "TYPECHECK"] },
502
+ "command": { "type": "string", "minLength": 1, "maxLength": 200 },
503
+ "workingDirectory": { "$ref": "#/$defs/relativePath" },
504
+ "source": { "$ref": "#/$defs/verificationSource" }
505
+ }
506
+ },
507
+ "verificationState": {
508
+ "type": "object",
509
+ "additionalProperties": false,
510
+ "required": ["status", "commands", "limitation"],
511
+ "properties": {
512
+ "status": {
513
+ "enum": ["AVAILABLE", "VERIFICATION_COMMAND_UNAVAILABLE", "NOT_APPLICABLE"]
514
+ },
515
+ "commands": {
516
+ "type": "array",
517
+ "uniqueItems": true,
518
+ "items": { "$ref": "#/$defs/verificationCommand" }
519
+ },
520
+ "limitation": {
521
+ "anyOf": [{ "$ref": "#/$defs/limitation" }, { "type": "null" }]
522
+ }
523
+ }
524
+ },
525
+ "officialEvidence": {
526
+ "type": "object",
527
+ "additionalProperties": false,
528
+ "required": [
529
+ "id", "sourceId", "kind", "authority", "trust", "contentDigest",
530
+ "locator", "releaseVersions"
531
+ ],
532
+ "properties": {
533
+ "id": { "$ref": "#/$defs/digest" },
534
+ "sourceId": { "type": "string", "minLength": 1 },
535
+ "kind": {
536
+ "enum": [
537
+ "breakingChanges", "changelog", "compatibility", "deprecations", "migrationGuide",
538
+ "releaseNotes"
539
+ ]
540
+ },
541
+ "authority": { "enum": ["officialProject", "publisherProvided"] },
542
+ "trust": { "enum": ["official", "publisher"] },
543
+ "contentDigest": { "$ref": "#/$defs/digest" },
544
+ "locator": { "type": "string", "minLength": 1 },
545
+ "releaseVersions": {
546
+ "type": "array",
547
+ "minItems": 1,
548
+ "uniqueItems": true,
549
+ "items": { "type": "string", "minLength": 1 }
550
+ }
551
+ }
552
+ },
553
+ "precondition": {
554
+ "type": "object",
555
+ "additionalProperties": false,
556
+ "required": ["code", "message"],
557
+ "properties": {
558
+ "code": {
559
+ "enum": [
560
+ "EXPLICIT_TARGET_SELECTED",
561
+ "TARGET_SCOPED_EVIDENCE_VALID",
562
+ "HUMAN_APPROVAL_REQUIRED"
563
+ ]
564
+ },
565
+ "message": { "type": "string", "minLength": 1 }
566
+ }
567
+ },
568
+ "recovery": {
569
+ "type": "object",
570
+ "additionalProperties": false,
571
+ "required": ["status", "evidenceRefs"],
572
+ "properties": {
573
+ "status": { "const": "RECOVERY_PLAN_NOT_PROVIDED" },
574
+ "evidenceRefs": {
575
+ "type": "array",
576
+ "maxItems": 0,
577
+ "items": { "$ref": "#/$defs/digest" }
578
+ }
579
+ }
580
+ },
581
+ "missingInformation": {
582
+ "type": "object",
583
+ "additionalProperties": false,
584
+ "required": ["code", "message"],
585
+ "properties": {
586
+ "code": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
587
+ "message": { "type": "string", "minLength": 1 }
588
+ }
589
+ },
590
+ "nextStep": {
591
+ "type": "object",
592
+ "additionalProperties": false,
593
+ "required": ["code", "message"],
594
+ "properties": {
595
+ "code": {
596
+ "enum": [
597
+ "NONE",
598
+ "COLLECT_TARGET_EVIDENCE",
599
+ "RESOLVE_INSTALLED_BASELINE",
600
+ "SELECT_OR_DISCOVER_TARGET",
601
+ "RERUN_VERSION_ANALYSIS",
602
+ "COMPLETE_HUMAN_INVESTIGATION",
603
+ "REVIEW_MIGRATION_HANDOFF"
604
+ ]
605
+ },
606
+ "message": { "type": "string", "minLength": 1 }
607
+ }
608
+ },
609
+ "handoff": {
610
+ "type": "object",
611
+ "additionalProperties": false,
612
+ "required": [
613
+ "status", "affectedAreas", "coverage", "verification", "officialEvidence", "preconditions",
614
+ "recovery", "reviewQuestions", "missingInformation", "nextStep",
615
+ "humanReviewRequired"
616
+ ],
617
+ "properties": {
618
+ "status": {
619
+ "enum": [
620
+ "NO_VERSION_CHANGE_REQUIRED",
621
+ "ACTIONABLE_WITH_REVIEW",
622
+ "INVESTIGATION_REQUIRED",
623
+ "INSUFFICIENT_EVIDENCE",
624
+ "NOT_ANALYZED",
625
+ "ACTION_GENERATION_FAILED",
626
+ "NO_GROUNDED_ACTION"
627
+ ]
628
+ },
629
+ "affectedAreas": {
630
+ "type": "array",
631
+ "uniqueItems": true,
632
+ "items": { "$ref": "#/$defs/affectedArea" }
633
+ },
634
+ "coverage": { "$ref": "#/$defs/coverageState" },
635
+ "verification": { "$ref": "#/$defs/verificationState" },
636
+ "officialEvidence": {
637
+ "type": "array",
638
+ "uniqueItems": true,
639
+ "items": { "$ref": "#/$defs/officialEvidence" }
640
+ },
641
+ "preconditions": {
642
+ "type": "array",
643
+ "uniqueItems": true,
644
+ "items": { "$ref": "#/$defs/precondition" }
645
+ },
646
+ "recovery": { "$ref": "#/$defs/recovery" },
647
+ "reviewQuestions": {
648
+ "type": "array",
649
+ "uniqueItems": true,
650
+ "items": { "type": "string", "minLength": 1 }
651
+ },
652
+ "missingInformation": {
653
+ "type": "array",
654
+ "uniqueItems": true,
655
+ "items": { "$ref": "#/$defs/missingInformation" }
656
+ },
657
+ "nextStep": { "$ref": "#/$defs/nextStep" },
658
+ "humanReviewRequired": { "type": "boolean" }
659
+ }
660
+ },
661
+ "dependencyChecklist": {
662
+ "type": "object",
663
+ "additionalProperties": false,
664
+ "required": [
665
+ "analysisResultId",
666
+ "decisionId",
667
+ "decision",
668
+ "handoff",
669
+ "dependency",
670
+ "versions",
671
+ "analysisStatus",
672
+ "status",
673
+ "eligibility",
674
+ "selectedEvidenceRefs",
675
+ "findings",
676
+ "limitations"
677
+ ],
678
+ "properties": {
679
+ "analysisResultId": {
680
+ "anyOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }]
681
+ },
682
+ "decisionId": { "$ref": "#/$defs/digest" },
683
+ "decision": { "$ref": "#/$defs/decisionProjection" },
684
+ "handoff": { "$ref": "#/$defs/handoff" },
685
+ "dependency": { "$ref": "#/$defs/dependency" },
686
+ "versions": { "$ref": "#/$defs/versions" },
687
+ "analysisStatus": { "enum": ["analyzed", "skipped", "failed", "missing"] },
688
+ "status": { "$ref": "#/$defs/checklistStatus" },
689
+ "eligibility": { "$ref": "#/$defs/eligibility" },
690
+ "selectedEvidenceRefs": {
691
+ "type": "array",
692
+ "uniqueItems": true,
693
+ "items": { "$ref": "#/$defs/digest" }
694
+ },
695
+ "findings": {
696
+ "type": "array",
697
+ "items": { "$ref": "#/$defs/findingChecklist" }
698
+ },
699
+ "limitations": {
700
+ "type": "array",
701
+ "items": { "$ref": "#/$defs/limitation" }
702
+ }
703
+ }
704
+ }
705
+ }
706
+ }