@ztothez/design-engineering 2.0.0

package/dist/src/audit/policy.js

@@ -0,0 +1,45 @@
+export const DEFAULT_AUDIT_POLICY = {
+    componentLineWarning: 400,
+    mixedResponsibilitiesMinLines: 200,
+    rawColorWarningCount: 3,
+    maxFiles: 5_000,
+    maxFileBytes: 2 * 1024 * 1024,
+    maxTotalBytes: 50 * 1024 * 1024,
+    ignoredDirectories: [
+        ".git",
+        ".next",
+        ".nuxt",
+        ".output",
+        ".svelte-kit",
+        ".turbo",
+        ".vercel",
+        "build",
+        "coverage",
+        "dist",
+        "archive",
+        "archives",
+        "backups",
+        "knowledge-base",
+        "legacy",
+        "node_modules",
+        "public",
+        "vendor",
+        "venv",
+        ".venv",
+    ],
+    sourceExtensions: [".css", ".js", ".jsx", ".mjs", ".ts", ".tsx"],
+    requiredPackageScripts: ["build", "test"],
+    requiredPackageScriptGroups: [["lint", "typecheck"]],
+};
+export function createAuditPolicy(overrides = {}) {
+    return {
+        ...DEFAULT_AUDIT_POLICY,
+        ...overrides,
+        ignoredDirectories: overrides.ignoredDirectories ?? DEFAULT_AUDIT_POLICY.ignoredDirectories,
+        sourceExtensions: overrides.sourceExtensions ?? DEFAULT_AUDIT_POLICY.sourceExtensions,
+        requiredPackageScripts: overrides.requiredPackageScripts ?? DEFAULT_AUDIT_POLICY.requiredPackageScripts,
+        requiredPackageScriptGroups: overrides.requiredPackageScriptGroups ??
+            DEFAULT_AUDIT_POLICY.requiredPackageScriptGroups,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/audit/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/audit/policy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,oBAAoB,EAAE,GAAG;IACzB,6BAA6B,EAAE,GAAG;IAClC,oBAAoB,EAAE,CAAC;IACvB,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC7B,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,kBAAkB,EAAE;QAClB,MAAM;QACN,OAAO;QACP,OAAO;QACP,SAAS;QACT,aAAa;QACb,QAAQ;QACR,SAAS;QACT,OAAO;QACP,UAAU;QACV,MAAM;QACN,SAAS;QACT,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,QAAQ;QACR,MAAM;QACN,OAAO;KACR;IACD,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IAChE,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,YAAkC,EAAE;IACpE,OAAO;QACL,GAAG,oBAAoB;QACvB,GAAG,SAAS;QACZ,kBAAkB,EAChB,SAAS,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,kBAAkB;QACzE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,gBAAgB;QACrF,sBAAsB,EACpB,SAAS,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,sBAAsB;QACjF,2BAA2B,EACzB,SAAS,CAAC,2BAA2B;YACrC,oBAAoB,CAAC,2BAA2B;KACnD,CAAC;AACJ,CAAC"}

package/dist/src/audit/report.d.ts

@@ -0,0 +1,2 @@
+import type { AuditReport } from "./types.js";
+export declare function formatAuditReport(report: AuditReport): string;

package/dist/src/audit/report.js

@@ -0,0 +1,32 @@
+function findingLocation(finding) {
+    const location = finding.line
+        ? `${finding.file}:${finding.line}${finding.column ? `:${finding.column}` : ""}`
+        : finding.file;
+    return `\`${location}\``;
+}
+export function formatAuditReport(report) {
+    const lines = [
+        "# ZtotheZ Design Engineering Repository Architecture Audit",
+        "",
+        `- Target: \`${report.target}\``,
+        `- Files scanned: ${report.filesScanned}`,
+        `- Bytes scanned: ${report.bytesScanned}`,
+        `- Result: ${report.passed ? "PASS" : "FAIL"}`,
+        `- Findings: ${report.summary.errors} errors, ${report.summary.warnings} warnings, ${report.summary.info} info`,
+    ];
+    if (report.skippedFiles.length > 0) {
+        lines.push(`- Skipped files: ${report.skippedFiles.length}`);
+    }
+    if (report.findings.length === 0) {
+        lines.push("", "No architecture findings were detected by the configured static rules.");
+    }
+    else {
+        lines.push("", "## Findings");
+        for (const finding of report.findings) {
+            lines.push("", `### ${finding.severity.toUpperCase()} ${finding.ruleId} at ${findingLocation(finding)}`, "", finding.message, "", `Confidence: ${finding.confidence}.`, "", ...finding.evidence.map((evidence) => `- Evidence: ${evidence}`), `- Remediation: ${finding.remediation}`);
+        }
+    }
+    lines.push("", "## Evidence Boundary", "", "### Verifier Limitations", "", ...report.evidenceBoundary.verifierLimitations.map((entry) => `- ${entry}`), "", "### Human Review Required", "", ...report.evidenceBoundary.humanReviewRequired.map((entry) => `- ${entry}`));
+    return lines.join("\n");
+}
+//# sourceMappingURL=report.js.map

package/dist/src/audit/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/audit/report.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,OAAqB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;QAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAChF,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACjB,OAAO,KAAK,QAAQ,IAAI,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,KAAK,GAAG;QACZ,4DAA4D;QAC5D,EAAE;QACF,eAAe,MAAM,CAAC,MAAM,IAAI;QAChC,oBAAoB,MAAM,CAAC,YAAY,EAAE;QACzC,oBAAoB,MAAM,CAAC,YAAY,EAAE;QACzC,aAAa,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;QAC9C,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,QAAQ,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO;KAChH,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wEAAwE,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,EAAE,EACF,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,MAAM,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EACxF,EAAE,EACF,OAAO,CAAC,OAAO,EACf,EAAE,EACF,eAAe,OAAO,CAAC,UAAU,GAAG,EACpC,EAAE,EACF,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,QAAQ,EAAE,CAAC,EAChE,kBAAkB,OAAO,CAAC,WAAW,EAAE,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,sBAAsB,EACtB,EAAE,EACF,0BAA0B,EAC1B,EAAE,EACF,GAAG,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAC3E,EAAE,EACF,2BAA2B,EAC3B,EAAE,EACF,GAAG,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAC5E,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/audit/rules/accessibility-name.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const accessibilityNameRule: AuditRule;

package/dist/src/audit/rules/accessibility-name.js

@@ -0,0 +1,64 @@
+import ts from "typescript";
+import { isTestOrStory, nodeLocation, walk } from "./helpers.js";
+function hasAttribute(attributes, names) {
+    return attributes.properties.some((property) => ts.isJsxAttribute(property) && names.includes(property.name.getText()));
+}
+function nodeProvidesAccessibleText(node) {
+    if (ts.isJsxText(node)) {
+        return node.text.trim().length > 0;
+    }
+    if (ts.isJsxExpression(node) && node.expression) {
+        return !ts.isJsxElement(node.expression) && !ts.isJsxSelfClosingElement(node.expression);
+    }
+    if (ts.isJsxElement(node)) {
+        return node.children.some(nodeProvidesAccessibleText);
+    }
+    return false;
+}
+function hasAccessibleText(element) {
+    return element.children.some((child) => {
+        if (ts.isJsxText(child)) {
+            return child.text.trim().length > 0;
+        }
+        if (ts.isJsxExpression(child) && child.expression) {
+            return !ts.isJsxElement(child.expression) && !ts.isJsxSelfClosingElement(child.expression);
+        }
+        return ts.isJsxElement(child) && child.children.some(nodeProvidesAccessibleText);
+    });
+}
+export const accessibilityNameRule = {
+    id: "ZTDE-A11Y-001",
+    evaluate(file) {
+        if (!file.sourceFile || isTestOrStory(file.relativePath)) {
+            return [];
+        }
+        const findings = [];
+        walk(file.sourceFile, (node) => {
+            if (!ts.isJsxElement(node) || node.openingElement.tagName.getText() !== "button") {
+                return;
+            }
+            const attributes = node.openingElement.attributes;
+            if (hasAttribute(attributes, ["aria-label", "aria-labelledby", "title"]) ||
+                hasAccessibleText(node)) {
+                return;
+            }
+            const containsVisualChild = node.children.some((child) => ts.isJsxElement(child) || ts.isJsxSelfClosingElement(child));
+            if (!containsVisualChild) {
+                return;
+            }
+            const location = nodeLocation(file, node.openingElement);
+            findings.push({
+                ruleId: this.id,
+                severity: "error",
+                confidence: "high",
+                file: file.relativePath,
+                ...location,
+                message: "Icon-only button has no detectable accessible name.",
+                evidence: ["Button contains a visual child but no text, aria-label, aria-labelledby, or title."],
+                remediation: "Add a concise accessible name that describes the button action.",
+            });
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=accessibility-name.js.map

package/dist/src/audit/rules/accessibility-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessibility-name.js","sourceRoot":"","sources":["../../../../src/audit/rules/accessibility-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEjE,SAAS,YAAY,CAAC,UAA4B,EAAE,KAAwB;IAC1E,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/B,CAAC,QAAQ,EAAE,EAAE,CACX,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAiB;IACnD,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClD,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAc;IAC9C,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAClD,IACE,YAAY,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;gBACpE,iBAAiB,CAAC,IAAI,CAAC,EACvB,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,GAAG,QAAQ;gBACX,OAAO,EAAE,qDAAqD;gBAC9D,QAAQ,EAAE,CAAC,oFAAoF,CAAC;gBAChG,WAAW,EAAE,iEAAiE;aAC/E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/component-size.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const componentSizeRule: AuditRule;

package/dist/src/audit/rules/component-size.js

@@ -0,0 +1,27 @@
+import { findLargestComponent } from "./helpers.js";
+export const componentSizeRule = {
+    id: "ZTDE-ARCH-001",
+    evaluate(file, policy) {
+        const component = findLargestComponent(file);
+        if (!component || component.lines <= policy.componentLineWarning) {
+            return [];
+        }
+        return [
+            {
+                ruleId: this.id,
+                severity: "warning",
+                confidence: "high",
+                file: file.relativePath,
+                line: component.line,
+                column: component.column,
+                message: `${component.name} spans ${component.lines} lines, exceeding the ${policy.componentLineWarning}-line review threshold.`,
+                evidence: [
+                    "The measured function contains JSX.",
+                    `Component span: ${component.lines} lines.`,
+                ],
+                remediation: "Review responsibility boundaries and extract cohesive domain, orchestration, or presentation units. Do not split solely to satisfy the threshold.",
+            },
+        ];
+    },
+};
+//# sourceMappingURL=component-size.js.map

package/dist/src/audit/rules/component-size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-size.js","sourceRoot":"","sources":["../../../../src/audit/rules/component-size.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM;QACnB,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,UAAU,SAAS,CAAC,KAAK,yBAAyB,MAAM,CAAC,oBAAoB,yBAAyB;gBAChI,QAAQ,EAAE;oBACR,qCAAqC;oBACrC,mBAAmB,SAAS,CAAC,KAAK,SAAS;iBAC5C;gBACD,WAAW,EACT,mJAAmJ;aACtJ;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/credential-placeholder.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const credentialPlaceholderRule: AuditRule;

package/dist/src/audit/rules/credential-placeholder.js

@@ -0,0 +1,83 @@
+import ts from "typescript";
+import { isTestOrStory, nodeLocation, walk } from "./helpers.js";
+const sensitiveNames = new Set([
+    "apikey",
+    "accesstoken",
+    "authtoken",
+    "clientsecret",
+    "credential",
+    "credentials",
+    "password",
+    "privatekey",
+    "secret",
+    "token",
+]);
+function normalizedName(node) {
+    const value = ts.isIdentifier(node) || ts.isPrivateIdentifier(node)
+        ? node.text
+        : ts.isStringLiteral(node) || ts.isNumericLiteral(node)
+            ? node.text
+            : undefined;
+    return value?.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function literalValue(node) {
+    if (!node)
+        return undefined;
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return node.text;
+    return undefined;
+}
+function sensitiveAssignment(node) {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)) {
+        const name = normalizedName(node.name);
+        const value = literalValue(node.initializer);
+        if (name && sensitiveNames.has(name) && value?.trim())
+            return { name, value, location: node.name };
+    }
+    if (ts.isPropertyAssignment(node)) {
+        const name = normalizedName(node.name);
+        const value = literalValue(node.initializer);
+        if (name && sensitiveNames.has(name) && value?.trim())
+            return { name, value, location: node.name };
+    }
+    if (ts.isBinaryExpression(node) &&
+        node.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+        const target = ts.isPropertyAccessExpression(node.left) ? node.left.name : node.left;
+        const name = normalizedName(target);
+        const value = literalValue(node.right);
+        if (name && sensitiveNames.has(name) && value?.trim())
+            return { name, value, location: target };
+    }
+    return undefined;
+}
+export const credentialPlaceholderRule = {
+    id: "ZTDE-SEC-001",
+    evaluate(file) {
+        if (!file.sourceFile || isTestOrStory(file.relativePath))
+            return [];
+        const findings = [];
+        const seen = new Set();
+        walk(file.sourceFile, (node) => {
+            const assignment = sensitiveAssignment(node);
+            if (!assignment || seen.has(assignment.location.getStart(file.sourceFile)))
+                return;
+            seen.add(assignment.location.getStart(file.sourceFile));
+            const location = nodeLocation(file, assignment.location);
+            findings.push({
+                ruleId: this.id,
+                severity: "error",
+                confidence: "high",
+                file: file.relativePath,
+                ...location,
+                message: "A credential-like field contains a hard-coded non-empty string literal.",
+                evidence: [
+                    `Sensitive field ${assignment.name} is assigned a ${assignment.value.length}-character literal.`,
+                    "The value is intentionally redacted from audit output.",
+                ],
+                remediation: "Remove the literal. Load credentials from an approved runtime secret source and represent unavailable credentials as an explicit configuration state.",
+            });
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=credential-placeholder.js.map

package/dist/src/audit/rules/credential-placeholder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-placeholder.js","sourceRoot":"","sources":["../../../../src/audit/rules/credential-placeholder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,aAAa;IACb,WAAW;IACX,cAAc;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,IAAa;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,IAAI;QACX,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACrD,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,KAAK,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,IAA+B;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,IACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACrD,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACrF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,EAAE,EAAE,cAAc;IAClB,QAAQ,CAAC,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAAE,OAAO;YACnF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,GAAG,QAAQ;gBACX,OAAO,EAAE,yEAAyE;gBAClF,QAAQ,EAAE;oBACR,mBAAmB,UAAU,CAAC,IAAI,kBAAkB,UAAU,CAAC,KAAK,CAAC,MAAM,qBAAqB;oBAChG,wDAAwD;iBACzD;gBACD,WAAW,EACT,uJAAuJ;aAC1J,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/helpers.d.ts

@@ -0,0 +1,16 @@
+import ts from "typescript";
+import type { AuditSourceFile } from "../types.js";
+export type ComponentSpan = {
+    name: string;
+    line: number;
+    column: number;
+    lines: number;
+};
+export declare function nodeLocation(file: AuditSourceFile, node: ts.Node): {
+    line: number;
+    column: number;
+};
+export declare function walk(node: ts.Node, visitor: (child: ts.Node) => void): void;
+export declare function findLargestComponent(file: AuditSourceFile): ComponentSpan | undefined;
+export declare function lineNumberForOffset(content: string, offset: number): number;
+export declare function isTestOrStory(relativePath: string): boolean;

package/dist/src/audit/rules/helpers.js

@@ -0,0 +1,64 @@
+import ts from "typescript";
+export function nodeLocation(file, node) {
+    if (!file.sourceFile) {
+        return { line: 1, column: 1 };
+    }
+    const location = file.sourceFile.getLineAndCharacterOfPosition(node.getStart(file.sourceFile));
+    return { line: location.line + 1, column: location.character + 1 };
+}
+export function walk(node, visitor) {
+    visitor(node);
+    node.forEachChild((child) => walk(child, visitor));
+}
+function containsJsx(node) {
+    let found = false;
+    walk(node, (child) => {
+        if (ts.isJsxElement(child) ||
+            ts.isJsxSelfClosingElement(child) ||
+            ts.isJsxFragment(child)) {
+            found = true;
+        }
+    });
+    return found;
+}
+function componentName(node) {
+    if (ts.isFunctionDeclaration(node) && node.name) {
+        return node.name.text;
+    }
+    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
+        ts.isVariableDeclaration(node.parent) &&
+        ts.isIdentifier(node.parent.name)) {
+        return node.parent.name.text;
+    }
+    return "default component";
+}
+export function findLargestComponent(file) {
+    if (!file.sourceFile) {
+        return undefined;
+    }
+    const components = [];
+    walk(file.sourceFile, (node) => {
+        const isFunction = ts.isFunctionDeclaration(node) ||
+            ts.isFunctionExpression(node) ||
+            ts.isArrowFunction(node);
+        if (!isFunction || !containsJsx(node)) {
+            return;
+        }
+        const start = file.sourceFile.getLineAndCharacterOfPosition(node.getStart(file.sourceFile));
+        const end = file.sourceFile.getLineAndCharacterOfPosition(node.getEnd());
+        components.push({
+            name: componentName(node),
+            line: start.line + 1,
+            column: start.character + 1,
+            lines: end.line - start.line + 1,
+        });
+    });
+    return components.sort((left, right) => right.lines - left.lines)[0];
+}
+export function lineNumberForOffset(content, offset) {
+    return content.slice(0, offset).split("\n").length;
+}
+export function isTestOrStory(relativePath) {
+    return /(?:^|\/)(?:__tests__|fixtures?|stories)(?:\/|$)|\.(?:spec|test|stories)\.[^.]+$/i.test(relativePath);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/src/audit/rules/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../../src/audit/rules/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAW5B,MAAM,UAAU,YAAY,CAC1B,IAAqB,EACrB,IAAa;IAEb,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,OAAiC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QACnB,IACE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;YACtB,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;YACjC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EACvB,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,IACE,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3D,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QACrC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,MAAM,UAAU,GACd,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC9B,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAC7B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAW,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,UAAW,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;YACzB,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;YACpB,MAAM,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;YAC3B,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,kFAAkF,CAAC,IAAI,CAC5F,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/src/audit/rules/index.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const sourceRules: readonly AuditRule[];

package/dist/src/audit/rules/index.js

@@ -0,0 +1,23 @@
+import { accessibilityNameRule } from "./accessibility-name.js";
+import { componentSizeRule } from "./component-size.js";
+import { credentialPlaceholderRule } from "./credential-placeholder.js";
+import { interactiveIntegrityRule } from "./interactive-integrity.js";
+import { mixedResponsibilitiesRule } from "./mixed-responsibilities.js";
+import { mockProductionPathRule } from "./mock-production-path.js";
+import { networkStateRule } from "./network-state.js";
+import { operationalClaimRule } from "./operational-claim.js";
+import { placeholderInteractionRule } from "./placeholder-interaction.js";
+import { rawDesignValuesRule } from "./raw-design-values.js";
+export const sourceRules = [
+    componentSizeRule,
+    mixedResponsibilitiesRule,
+    credentialPlaceholderRule,
+    mockProductionPathRule,
+    placeholderInteractionRule,
+    interactiveIntegrityRule,
+    operationalClaimRule,
+    rawDesignValuesRule,
+    networkStateRule,
+    accessibilityNameRule,
+];
+//# sourceMappingURL=index.js.map

package/dist/src/audit/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/audit/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAyB;IAC/C,iBAAiB;IACjB,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,0BAA0B;IAC1B,wBAAwB;IACxB,oBAAoB;IACpB,mBAAmB;IACnB,gBAAgB;IAChB,qBAAqB;CACtB,CAAC"}

package/dist/src/audit/rules/interactive-integrity.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const interactiveIntegrityRule: AuditRule;

package/dist/src/audit/rules/interactive-integrity.js

@@ -0,0 +1,111 @@
+import ts from "typescript";
+import { isTestOrStory, nodeLocation, walk } from "./helpers.js";
+function attribute(attributes, name) {
+    return attributes.properties.find((property) => ts.isJsxAttribute(property) && property.name.getText() === name);
+}
+function literalAttribute(attributes, name) {
+    const match = attribute(attributes, name);
+    return match?.initializer && ts.isStringLiteral(match.initializer)
+        ? match.initializer.text.toLowerCase()
+        : undefined;
+}
+function hasAnyAttribute(attributes, names) {
+    return attributes.properties.some((property) => ts.isJsxSpreadAttribute(property) ||
+        (ts.isJsxAttribute(property) && names.includes(property.name.getText())));
+}
+function insideForm(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isJsxElement(current) && current.openingElement.tagName.getText() === "form")
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+function openingNode(node) {
+    if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node))
+        return node;
+    return undefined;
+}
+export const interactiveIntegrityRule = {
+    id: "ZTDE-SLOP-003",
+    evaluate(file) {
+        if (!file.sourceFile || isTestOrStory(file.relativePath))
+            return [];
+        const findings = [];
+        walk(file.sourceFile, (node) => {
+            const opening = openingNode(node);
+            if (!opening)
+                return;
+            const tag = opening.tagName.getText();
+            const attributes = opening.attributes;
+            const location = nodeLocation(file, opening);
+            if (tag === "button") {
+                const type = literalAttribute(attributes, "type");
+                const intentionallyUnavailable = hasAnyAttribute(attributes, ["disabled", "aria-disabled"]);
+                const hasHandler = hasAnyAttribute(attributes, [
+                    "onClick",
+                    "onPointerUp",
+                    "onMouseUp",
+                    "formAction",
+                ]);
+                const submitsForm = type === "submit" || type === "reset" || (type === undefined && insideForm(opening));
+                if (!intentionallyUnavailable && !hasHandler && !submitsForm) {
+                    findings.push({
+                        ruleId: this.id,
+                        severity: "error",
+                        confidence: "high",
+                        file: file.relativePath,
+                        ...location,
+                        message: "Button has no detectable action, form behavior, or intentional disabled state.",
+                        evidence: ["No event handler, formAction, submit/reset behavior, disabled state, or spread props were found."],
+                        remediation: "Implement the action, bind form behavior, or render a non-interactive element until the action exists.",
+                    });
+                }
+                return;
+            }
+            const role = literalAttribute(attributes, "role");
+            const hasClick = hasAnyAttribute(attributes, ["onClick", "onPointerUp", "onMouseUp"]);
+            const hasKeyboard = hasAnyAttribute(attributes, ["onKeyDown", "onKeyUp", "onKeyPress"]);
+            const hasTabStop = hasAnyAttribute(attributes, ["tabIndex"]);
+            if (role === "button" && (!hasClick || !hasKeyboard || !hasTabStop)) {
+                findings.push({
+                    ruleId: this.id,
+                    severity: "error",
+                    confidence: "high",
+                    file: file.relativePath,
+                    ...location,
+                    message: "Custom button semantics are incomplete.",
+                    evidence: [
+                        `Detected role=button with click=${hasClick}, keyboard=${hasKeyboard}, tab stop=${hasTabStop}.`,
+                    ],
+                    remediation: "Use a native button. If a custom control is unavoidable, provide click, Enter or Space keyboard behavior, and tabIndex=0.",
+                });
+                return;
+            }
+            // A custom JSX component may render an accessible link or control internally. Without an
+            // explicit role, static inspection cannot safely infer its resulting DOM semantics.
+            const isIntrinsicElement = /^[a-z][a-z0-9]*$/.test(tag);
+            if (!isIntrinsicElement)
+                return;
+            const nativeInteractiveTags = new Set(["input", "option", "select", "summary", "textarea"]);
+            const isAnchorWithHref = tag === "a" && hasAnyAttribute(attributes, ["href"]);
+            if (nativeInteractiveTags.has(tag) || isAnchorWithHref)
+                return;
+            if (role !== "button" && hasClick && !hasKeyboard) {
+                findings.push({
+                    ruleId: this.id,
+                    severity: "warning",
+                    confidence: "medium",
+                    file: file.relativePath,
+                    ...location,
+                    message: "A non-control element has pointer behavior without detectable keyboard semantics.",
+                    evidence: [`${tag} declares a pointer handler without a keyboard handler or button role.`],
+                    remediation: "Use a native interactive element or add the complete keyboard and semantic contract.",
+                });
+            }
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=interactive-integrity.js.map

package/dist/src/audit/rules/interactive-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive-integrity.js","sourceRoot":"","sources":["../../../../src/audit/rules/interactive-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAIjE,SAAS,SAAS,CAAC,UAA4B,EAAE,IAAY;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/B,CAAC,QAAQ,EAA+B,EAAE,CACxC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA4B,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE;QACtC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,UAA4B,EAAE,KAAwB;IAC7E,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/B,CAAC,QAAQ,EAAE,EAAE,CACX,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QACjC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACjG,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE7C,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,wBAAwB,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;gBAC5F,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE;oBAC7C,SAAS;oBACT,aAAa;oBACb,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzG,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC7D,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,MAAM;wBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;wBACvB,GAAG,QAAQ;wBACX,OAAO,EAAE,gFAAgF;wBACzF,QAAQ,EAAE,CAAC,kGAAkG,CAAC;wBAC9G,WAAW,EACT,wGAAwG;qBAC3G,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;YACtF,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7D,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpE,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,MAAM;oBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;oBACvB,GAAG,QAAQ;oBACX,OAAO,EAAE,yCAAyC;oBAClD,QAAQ,EAAE;wBACR,mCAAmC,QAAQ,cAAc,WAAW,cAAc,UAAU,GAAG;qBAChG;oBACD,WAAW,EACT,2HAA2H;iBAC9H,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,yFAAyF;YACzF,oFAAoF;YACpF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,kBAAkB;gBAAE,OAAO;YAEhC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YAC5F,MAAM,gBAAgB,GAAG,GAAG,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9E,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,gBAAgB;gBAAE,OAAO;YAE/D,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClD,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,QAAQ;oBACpB,IAAI,EAAE,IAAI,CAAC,YAAY;oBACvB,GAAG,QAAQ;oBACX,OAAO,EAAE,mFAAmF;oBAC5F,QAAQ,EAAE,CAAC,GAAG,GAAG,wEAAwE,CAAC;oBAC1F,WAAW,EAAE,sFAAsF;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/mixed-responsibilities.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const mixedResponsibilitiesRule: AuditRule;

package/dist/src/audit/rules/mixed-responsibilities.js

@@ -0,0 +1,39 @@
+import { findLargestComponent } from "./helpers.js";
+const effectPatterns = [
+    { label: "network requests", pattern: /\b(?:fetch|axios\.(?:get|post|put|patch|delete))\s*\(/ },
+    { label: "local storage", pattern: /\b(?:localStorage|sessionStorage)\s*\./ },
+    { label: "browser database access", pattern: /\bindexedDB\s*\./ },
+    { label: "download orchestration", pattern: /\bURL\.createObjectURL\s*\(/ },
+];
+export const mixedResponsibilitiesRule = {
+    id: "ZTDE-ARCH-002",
+    evaluate(file, policy) {
+        const component = findLargestComponent(file);
+        if (!component || component.lines < policy.mixedResponsibilitiesMinLines) {
+            return [];
+        }
+        const effects = effectPatterns
+            .filter(({ pattern }) => pattern.test(file.content))
+            .map(({ label }) => label);
+        if (effects.length === 0) {
+            return [];
+        }
+        return [
+            {
+                ruleId: this.id,
+                severity: "warning",
+                confidence: "medium",
+                file: file.relativePath,
+                line: component.line,
+                column: component.column,
+                message: `${component.name} combines a large rendering surface with direct side-effect orchestration.`,
+                evidence: [
+                    `Component span: ${component.lines} lines.`,
+                    `Detected: ${effects.join(", ")}.`,
+                ],
+                remediation: "Move network, persistence, and export policy behind focused hooks or services while keeping user-visible state in the owning feature.",
+            },
+        ];
+    },
+};
+//# sourceMappingURL=mixed-responsibilities.js.map

package/dist/src/audit/rules/mixed-responsibilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mixed-responsibilities.js","sourceRoot":"","sources":["../../../../src/audit/rules/mixed-responsibilities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,cAAc,GAAG;IACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAC/F,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,wCAAwC,EAAE;IAC7E,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACjE,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,6BAA6B,EAAE;CAC5E,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM;QACnB,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACzE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,cAAc;aAC3B,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,4EAA4E;gBACtG,QAAQ,EAAE;oBACR,mBAAmB,SAAS,CAAC,KAAK,SAAS;oBAC3C,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACnC;gBACD,WAAW,EACT,uIAAuI;aAC1I;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/mock-production-path.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const mockProductionPathRule: AuditRule;