@ztothez/design-engineering 2.0.0

package/dist/src/audit/rules/mock-production-path.js

@@ -0,0 +1,39 @@
+import { isTestOrStory, lineNumberForOffset } from "./helpers.js";
+const mockPatterns = [
+    /\bsetMock[A-Z][A-Za-z0-9_]*/,
+    /\b(?:autonomous|production|backend)\s+mock\b/i,
+    /\bmock\s+(?:fallback|report|response|result|data)\b/i,
+    /\bfake\s+(?:loading|progress|response|result|data)\b/i,
+    /\bsimulat(?:e|ed|ing)\s+(?:loading|progress|request|response|result)\b/i,
+];
+export const mockProductionPathRule = {
+    id: "ZTDE-SLOP-001",
+    evaluate(file) {
+        if (isTestOrStory(file.relativePath)) {
+            return [];
+        }
+        const match = mockPatterns
+            .map((pattern) => pattern.exec(file.content))
+            .find((candidate) => candidate !== null);
+        if (!match || match.index === undefined) {
+            return [];
+        }
+        const hasDisclosureContract = /data-ztothez-design-(?:data-mode|interface-trust|result-origin)/.test(file.content) &&
+            /\b(?:demo|fallback|simulated)\b/i.test(file.content);
+        if (hasDisclosureContract)
+            return [];
+        return [
+            {
+                ruleId: this.id,
+                severity: "error",
+                confidence: "high",
+                file: file.relativePath,
+                line: lineNumberForOffset(file.content, match.index),
+                message: "A mock or simulated behavior path is present in production source.",
+                evidence: [`Matched production-source text: ${JSON.stringify(match[0])}.`],
+                remediation: "Remove the mock path, isolate it behind an explicit demo fixture, or label the resulting data and behavior as simulated in the interface.",
+            },
+        ];
+    },
+};
+//# sourceMappingURL=mock-production-path.js.map

package/dist/src/audit/rules/mock-production-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-production-path.js","sourceRoot":"","sources":["../../../../src/audit/rules/mock-production-path.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,YAAY,GAAG;IACnB,6BAA6B;IAC7B,+CAA+C;IAC/C,sDAAsD;IACtD,uDAAuD;IACvD,yEAAyE;CAC1E,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAc;IAC/C,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI;QACX,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,YAAY;aACvB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC5C,IAAI,CAAC,CAAC,SAAS,EAAgC,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,qBAAqB,GACzB,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACpF,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,qBAAqB;YAAE,OAAO,EAAE,CAAC;QAErC,OAAO;YACL;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACpD,OAAO,EAAE,oEAAoE;gBAC7E,QAAQ,EAAE,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1E,WAAW,EACT,2IAA2I;aAC9I;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/network-state.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const networkStateRule: AuditRule;

package/dist/src/audit/rules/network-state.js

@@ -0,0 +1,39 @@
+import { isTestOrStory, lineNumberForOffset } from "./helpers.js";
+const networkPattern = /\b(?:fetch|axios\.(?:get|post|put|patch|delete))\s*\(/;
+const loadingPattern = /\b(?:isLoading|loading|pending|running|busy|status)\b/i;
+const errorPattern = /\b(?:catch|error|failed|failure)\b/i;
+export const networkStateRule = {
+    id: "ZTDE-STATE-001",
+    evaluate(file) {
+        if (isTestOrStory(file.relativePath)) {
+            return [];
+        }
+        const networkMatch = networkPattern.exec(file.content);
+        if (!networkMatch || networkMatch.index === undefined) {
+            return [];
+        }
+        const missing = [];
+        if (!loadingPattern.test(file.content)) {
+            missing.push("an observable loading or pending state");
+        }
+        if (!errorPattern.test(file.content)) {
+            missing.push("an error or recovery path");
+        }
+        if (missing.length === 0) {
+            return [];
+        }
+        return [
+            {
+                ruleId: this.id,
+                severity: "warning",
+                confidence: "medium",
+                file: file.relativePath,
+                line: lineNumberForOffset(file.content, networkMatch.index),
+                message: `Network behavior lacks ${missing.join(" and ")}.`,
+                evidence: [`Detected network call: ${networkMatch[0].trim()}.`],
+                remediation: "Expose pending state, preserve relevant user input, and provide a visible error with an actionable retry or recovery path.",
+            },
+        ];
+    },
+};
+//# sourceMappingURL=network-state.js.map

package/dist/src/audit/rules/network-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-state.js","sourceRoot":"","sources":["../../../../src/audit/rules/network-state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAC/E,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAChF,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAE3D,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,EAAE,EAAE,gBAAgB;IACpB,QAAQ,CAAC,IAAI;QACX,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;gBAC3D,OAAO,EAAE,0BAA0B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;gBAC3D,QAAQ,EAAE,CAAC,0BAA0B,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC/D,WAAW,EACT,4HAA4H;aAC/H;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/operational-claim.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const operationalClaimRule: AuditRule;

package/dist/src/audit/rules/operational-claim.js

@@ -0,0 +1,94 @@
+import ts from "typescript";
+import { isTestOrStory, nodeLocation, walk } from "./helpers.js";
+const claimPattern = /^(?:live|online|connected|operational|production)$|\b(?:api|backend|connection|endpoint|environment|service|status|system)\s*(?::|-)?\s*(?:live|online|connected|operational|production)\b/i;
+const bindingAttributes = new Set([
+    "data-ztothez-design-claim-source",
+    "data-ztothez-design-state-binding",
+    "data-ztothez-design-data-mode",
+    "data-ztothez-design-connection",
+]);
+function openingAttributes(node) {
+    if (ts.isJsxElement(node))
+        return node.openingElement.attributes;
+    if (ts.isJsxSelfClosingElement(node))
+        return node.attributes;
+    return undefined;
+}
+function hasBinding(node) {
+    let current = node.parent;
+    while (current) {
+        const attributes = openingAttributes(current);
+        if (attributes?.properties.some((property) => ts.isJsxAttribute(property) && bindingAttributes.has(property.name.getText()))) {
+            return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+function isStaticCondition(node) {
+    let current = node;
+    while (ts.isParenthesizedExpression(current))
+        current = current.expression;
+    return (current.kind === ts.SyntaxKind.TrueKeyword ||
+        current.kind === ts.SyntaxKind.FalseKeyword ||
+        current.kind === ts.SyntaxKind.NullKeyword ||
+        ts.isStringLiteral(current) ||
+        ts.isNumericLiteral(current));
+}
+function hasRuntimeCondition(node) {
+    let child = node;
+    let current = node.parent;
+    while (current) {
+        if (ts.isConditionalExpression(current) &&
+            (current.whenTrue === child || current.whenFalse === child) &&
+            !isStaticCondition(current.condition)) {
+            return true;
+        }
+        if (ts.isBinaryExpression(current) &&
+            current.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken &&
+            current.right === child &&
+            !isStaticCondition(current.left)) {
+            return true;
+        }
+        child = current;
+        current = current.parent;
+    }
+    return false;
+}
+export const operationalClaimRule = {
+    id: "ZTDE-TRUST-001",
+    evaluate(file) {
+        if (!file.sourceFile || isTestOrStory(file.relativePath))
+            return [];
+        const findings = [];
+        walk(file.sourceFile, (node) => {
+            if (!ts.isJsxText(node))
+                return;
+            const claim = node.text.replace(/\s+/g, " ").trim();
+            if (!claim || !claimPattern.test(claim) || hasBinding(node))
+                return;
+            const runtimeConditioned = hasRuntimeCondition(node);
+            findings.push({
+                ruleId: this.id,
+                severity: runtimeConditioned ? "info" : "error",
+                confidence: runtimeConditioned ? "medium" : "high",
+                file: file.relativePath,
+                ...nodeLocation(file, node),
+                message: runtimeConditioned
+                    ? "Runtime-conditioned operational status claim has no explicit source annotation."
+                    : "Literal operational status claim has no declared runtime source binding.",
+                evidence: [
+                    `Unbound rendered claim: ${JSON.stringify(claim.slice(0, 120))}.`,
+                    runtimeConditioned
+                        ? "The claim is rendered only within a non-constant conditional branch."
+                        : "No runtime conditional or source-binding attribute was detected.",
+                ],
+                remediation: runtimeConditioned
+                    ? "When the claim is consequential, declare its source with data-ztothez-design-claim-source or data-ztothez-design-state-binding. Otherwise retain this as a static-verifier limitation."
+                    : "Derive the claim from runtime state and declare its source with data-ztothez-design-claim-source or data-ztothez-design-state-binding.",
+            });
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=operational-claim.js.map

package/dist/src/audit/rules/operational-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational-claim.js","sourceRoot":"","sources":["../../../../src/audit/rules/operational-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,YAAY,GAAG,6LAA6L,CAAC;AACnN,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,kCAAkC;IAClC,mCAAmC;IACnC,+BAA+B;IAC/B,gCAAgC;CACjC,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;IACjE,IAAI,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC/C,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,IACE,UAAU,EAAE,UAAU,CAAC,IAAI,CACzB,CAAC,QAAQ,EAAE,EAAE,CACX,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAChF,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC3E,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;QAC1C,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,YAAY;QAC3C,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;QAC1C,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC;QAC3B,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC/C,OAAO,OAAO,EAAE,CAAC;QACf,IACE,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC;YACnC,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;YAC3D,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAC9B,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,uBAAuB;YACpE,OAAO,CAAC,KAAK,KAAK,KAAK;YACvB,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,OAAO,CAAC;QAChB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAc;IAC7C,EAAE,EAAE,gBAAgB;IACpB,QAAQ,CAAC,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YACpE,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;gBAC/C,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;gBAClD,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC3B,OAAO,EAAE,kBAAkB;oBACzB,CAAC,CAAC,iFAAiF;oBACnF,CAAC,CAAC,0EAA0E;gBAC9E,QAAQ,EAAE;oBACR,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG;oBACjE,kBAAkB;wBAChB,CAAC,CAAC,sEAAsE;wBACxE,CAAC,CAAC,kEAAkE;iBACvE;gBACD,WAAW,EAAE,kBAAkB;oBAC7B,CAAC,CAAC,wLAAwL;oBAC1L,CAAC,CAAC,wIAAwI;aAC7I,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/placeholder-interaction.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const placeholderInteractionRule: AuditRule;

package/dist/src/audit/rules/placeholder-interaction.js

@@ -0,0 +1,46 @@
+import ts from "typescript";
+import { isTestOrStory, nodeLocation, walk } from "./helpers.js";
+function attributeValue(attributes, name) {
+    const attribute = attributes.properties.find((property) => ts.isJsxAttribute(property) && property.name.getText() === name);
+    if (!attribute?.initializer) {
+        return undefined;
+    }
+    if (ts.isStringLiteral(attribute.initializer)) {
+        return attribute.initializer.text;
+    }
+    return undefined;
+}
+export const placeholderInteractionRule = {
+    id: "ZTDE-SLOP-002",
+    evaluate(file) {
+        if (!file.sourceFile || isTestOrStory(file.relativePath)) {
+            return [];
+        }
+        const findings = [];
+        walk(file.sourceFile, (node) => {
+            if (!ts.isJsxOpeningElement(node) && !ts.isJsxSelfClosingElement(node)) {
+                return;
+            }
+            if (node.tagName.getText() !== "a") {
+                return;
+            }
+            const href = attributeValue(node.attributes, "href");
+            if (href !== "#" && href !== "" && !href?.toLowerCase().startsWith("javascript:")) {
+                return;
+            }
+            const location = nodeLocation(file, node);
+            findings.push({
+                ruleId: this.id,
+                severity: "error",
+                confidence: "high",
+                file: file.relativePath,
+                ...location,
+                message: `Anchor uses a non-functional href value: ${JSON.stringify(href)}.`,
+                evidence: ["The anchor cannot navigate to a product destination."],
+                remediation: "Provide a real route or URL. If the action is not navigation, use a button with a complete event handler.",
+            });
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=placeholder-interaction.js.map

package/dist/src/audit/rules/placeholder-interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder-interaction.js","sourceRoot":"","sources":["../../../../src/audit/rules/placeholder-interaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEjE,SAAS,cAAc,CACrB,UAA4B,EAC5B,IAAY;IAEZ,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAC1C,CAAC,QAAQ,EAA+B,EAAE,CACxC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAClE,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAc;IACnD,EAAE,EAAE,eAAe;IACnB,QAAQ,CAAC,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClF,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,GAAG,QAAQ;gBACX,OAAO,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;gBAC5E,QAAQ,EAAE,CAAC,sDAAsD,CAAC;gBAClE,WAAW,EACT,2GAA2G;aAC9G,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/audit/rules/raw-design-values.d.ts

@@ -0,0 +1,2 @@
+import type { AuditRule } from "../types.js";
+export declare const rawDesignValuesRule: AuditRule;

package/dist/src/audit/rules/raw-design-values.js

@@ -0,0 +1,97 @@
+import { isTestOrStory, lineNumberForOffset } from "./helpers.js";
+const rawColorPattern = /#[0-9a-fA-F]{3,8}\b|\brgba?\([^)]*\)|\bhsla?\([^)]*\)/g;
+const rawDimensionPattern = /(?<![-\w])(?:margin|padding|gap|inset|top|right|bottom|left|width|height|minWidth|minHeight|maxWidth|maxHeight|min-width|min-height|max-width|max-height|borderRadius|border-radius|fontSize|font-size|lineHeight|line-height)\b\s*[:=]\s*["']?(-?\d+(?:[.]\d+)?(?:px|rem|em|ch|vh|vw))\b/gi;
+const rawDurationPattern = /\b(?:transitionDuration|animationDuration|transition-duration|animation-duration|duration)\b\s*[:=]\s*["']?(\d+(?:[.]\d+)?(?:ms|s))\b/gi;
+const rawShadowPattern = /\b(?:boxShadow|box-shadow)\b\s*[:=]\s*["']?([^;"'\n}]+)/gi;
+const rawFontPattern = /\b(?:fontFamily|font-family)\b\s*[:=]\s*["']([^"'\n]+)["']/gi;
+function isTokenFile(relativePath) {
+    return /(?:^|\/)(?:tokens?|theme|palettes?|colors?)(?:[.-]|\/)/i.test(relativePath);
+}
+function isGeneratedMediaSource(content) {
+    return /CanvasRenderingContext|\bctx\.(?:fillStyle|strokeStyle)|\.getContext\(["']2d["']\)|create(?:Linear|Radial)Gradient/.test(content);
+}
+function isStandaloneFallbackDocument(content) {
+    return /<!doctype\s+html/i.test(content) && /<style(?:\s|>)/i.test(content);
+}
+function isWithinLibraryOutputSelector(content, index) {
+    const lineStart = content.lastIndexOf("\n", index) + 1;
+    const selectorStart = content.lastIndexOf("[&", index);
+    if (selectorStart < lineStart)
+        return false;
+    let depth = 0;
+    for (let offset = selectorStart; offset < index; offset += 1) {
+        if (content[offset] === "[")
+            depth += 1;
+        if (content[offset] === "]")
+            depth -= 1;
+    }
+    return depth > 0;
+}
+function isIntrinsicAccessibilityGeometry(rawValue) {
+    const normalized = rawValue.toLowerCase().replace(/[\s"']/g, "");
+    return /^(?:min-width|min-height):(44|48)px$/.test(normalized) || normalized === "min-width:320px";
+}
+function cssCommentRanges(content) {
+    return [...content.matchAll(/\/\*[\s\S]*?\*\//g)].map((match) => ({
+        start: match.index ?? 0,
+        end: (match.index ?? 0) + match[0].length,
+    }));
+}
+export const rawDesignValuesRule = {
+    id: "ZTDE-DESIGN-001",
+    evaluate(file, policy) {
+        if (isTokenFile(file.relativePath) ||
+            isTestOrStory(file.relativePath) ||
+            isGeneratedMediaSource(file.content) ||
+            isStandaloneFallbackDocument(file.content)) {
+            return [];
+        }
+        const commentRanges = file.extension === ".css" ? cssCommentRanges(file.content) : [];
+        const candidateMatches = [
+            ...file.content.matchAll(rawColorPattern),
+            ...file.content.matchAll(rawDimensionPattern),
+            ...file.content.matchAll(rawDurationPattern),
+            ...file.content.matchAll(rawShadowPattern),
+            ...file.content.matchAll(rawFontPattern),
+        ].sort((first, second) => (first.index ?? 0) - (second.index ?? 0));
+        const matches = candidateMatches.filter((match) => {
+            if (match.index === undefined) {
+                return false;
+            }
+            if (commentRanges.some((range) => match.index !== undefined && match.index >= range.start && match.index < range.end)) {
+                return false;
+            }
+            if (isWithinLibraryOutputSelector(file.content, match.index) ||
+                isIntrinsicAccessibilityGeometry(match[0])) {
+                return false;
+            }
+            if (file.extension !== ".css") {
+                return true;
+            }
+            const lineStart = file.content.lastIndexOf("\n", match.index) + 1;
+            const lineEnd = file.content.indexOf("\n", match.index);
+            const line = file.content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+            if (/^--[a-zA-Z0-9_-]+\s*:/.test(line) || /^@media\b/.test(line)) {
+                return false;
+            }
+            return !/\b(?:box-shadow|font-family)\s*:\s*[^;\n}]*var\(/i.test(match[0]);
+        });
+        if (matches.length < policy.rawColorWarningCount) {
+            return [];
+        }
+        const first = matches[0];
+        return [
+            {
+                ruleId: this.id,
+                severity: "warning",
+                confidence: "medium",
+                file: file.relativePath,
+                line: lineNumberForOffset(file.content, first.index ?? 0),
+                message: `${matches.length} raw visual values appear outside an identifiable token definition file.`,
+                evidence: matches.slice(0, 5).map((match) => `Raw value: ${match[0]}.`),
+                remediation: "Move recurring interface colors, dimensions, durations, shadows, and font declarations into semantic tokens. Keep genuinely data-driven canvas, chart, generated-media, and one-off intrinsic geometry values local and document those exceptions.",
+            },
+        ];
+    },
+};
+//# sourceMappingURL=raw-design-values.js.map

package/dist/src/audit/rules/raw-design-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-design-values.js","sourceRoot":"","sources":["../../../../src/audit/rules/raw-design-values.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,eAAe,GAAG,wDAAwD,CAAC;AACjF,MAAM,mBAAmB,GAAG,6RAA6R,CAAC;AAC1T,MAAM,kBAAkB,GAAG,yIAAyI,CAAC;AACrK,MAAM,gBAAgB,GAAG,2DAA2D,CAAC;AACrF,MAAM,cAAc,GAAG,8DAA8D,CAAC;AAEtF,SAAS,WAAW,CAAC,YAAoB;IACvC,OAAO,yDAAyD,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,oHAAoH,CAAC,IAAI,CAC9H,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe;IACnD,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,aAAa,GAAG,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,MAAM,GAAG,aAAa,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,gCAAgC,CAAC,QAAgB;IACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,sCAAsC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,iBAAiB,CAAC;AACrG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,EAAE,EAAE,iBAAiB;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;QACnB,IACE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;YAChC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,gBAAgB,GAAG;YACvB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACzC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAC7C,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC5C,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC1C,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;SACzC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,aAAa,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAC9F,EACD,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,6BAA6B,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACxD,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC1C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACxF,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,OAAO;YACL;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBACzD,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,0EAA0E;gBACpG,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;gBACvE,WAAW,EACT,oPAAoP;aACvP;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/audit/scanner.d.ts

@@ -0,0 +1,2 @@
+import type { AuditPolicy, AuditReport } from "./types.js";
+export declare function auditRepository(targetDirectory: string, policyOverrides?: Partial<AuditPolicy>): Promise<AuditReport>;

package/dist/src/audit/scanner.js

@@ -0,0 +1,215 @@
+import { readFile, readdir, realpath, stat } from "node:fs/promises";
+import { extname, join, relative, sep } from "node:path";
+import ts from "typescript";
+import { createAuditPolicy } from "./policy.js";
+import { sourceRules } from "./rules/index.js";
+const AUDIT_REPORT_VERSION = "1.0.0";
+const severityRank = {
+    error: 0,
+    warning: 1,
+    info: 2,
+};
+function portablePath(path) {
+    return path.split(sep).join("/");
+}
+function scriptKind(extension) {
+    switch (extension) {
+        case ".js":
+        case ".mjs":
+            return ts.ScriptKind.JS;
+        case ".jsx":
+            return ts.ScriptKind.JSX;
+        case ".ts":
+            return ts.ScriptKind.TS;
+        case ".tsx":
+            return ts.ScriptKind.TSX;
+        default:
+            return undefined;
+    }
+}
+async function packageScriptFindings(rootDirectory, policy) {
+    let packageContent;
+    try {
+        packageContent = await readFile(join(rootDirectory, "package.json"), "utf8");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+    let packageData;
+    try {
+        packageData = JSON.parse(packageContent);
+    }
+    catch {
+        return [
+            {
+                ruleId: "ZTDE-REPO-001",
+                severity: "error",
+                confidence: "high",
+                file: "package.json",
+                message: "package.json is not valid JSON.",
+                evidence: ["The repository manifest could not be parsed."],
+                remediation: "Repair package.json before running build or verification commands.",
+            },
+        ];
+    }
+    const scripts = packageData && typeof packageData === "object" && "scripts" in packageData
+        ? packageData.scripts
+        : undefined;
+    const missingScripts = policy.requiredPackageScripts.filter((name) => typeof scripts?.[name] !== "string" || scripts[name].trim() === "");
+    const missingGroups = policy.requiredPackageScriptGroups.filter((group) => !group.some((name) => typeof scripts?.[name] === "string" && scripts[name].trim() !== ""));
+    if (missingScripts.length === 0 && missingGroups.length === 0) {
+        return [];
+    }
+    const missingLabels = [
+        ...missingScripts,
+        ...missingGroups.map((group) => group.join(" or ")),
+    ];
+    return [
+        {
+            ruleId: "ZTDE-REPO-001",
+            severity: "warning",
+            confidence: "high",
+            file: "package.json",
+            message: `Repository is missing required verification scripts: ${missingLabels.join(", ")}.`,
+            evidence: [
+                ...missingScripts.map((name) => `Missing npm script: ${name}.`),
+                ...missingGroups.map((group) => `Missing verification script alternative: ${group.join(" or ")}.`),
+            ],
+            remediation: "Add commands that exercise the repository's actual build, static checks, and automated tests, or configure the audit policy for a non-JavaScript project.",
+        },
+    ];
+}
+function sortFindings(findings) {
+    return findings.sort((left, right) => {
+        return (severityRank[left.severity] - severityRank[right.severity] ||
+            left.file.localeCompare(right.file) ||
+            (left.line ?? 0) - (right.line ?? 0) ||
+            left.ruleId.localeCompare(right.ruleId));
+    });
+}
+export async function auditRepository(targetDirectory, policyOverrides = {}) {
+    const policy = createAuditPolicy(policyOverrides);
+    const rootDirectory = await realpath(targetDirectory);
+    const rootStats = await stat(rootDirectory);
+    if (!rootStats.isDirectory()) {
+        throw new Error("Audit target must be a directory");
+    }
+    const findings = await packageScriptFindings(rootDirectory, policy);
+    const skippedFiles = [];
+    let filesScanned = 0;
+    let bytesScanned = 0;
+    let scanStopped = false;
+    async function scanDirectory(currentDirectory) {
+        if (scanStopped) {
+            return;
+        }
+        const entries = (await readdir(currentDirectory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            if (scanStopped) {
+                break;
+            }
+            const absolutePath = join(currentDirectory, entry.name);
+            const relativePath = portablePath(relative(rootDirectory, absolutePath));
+            if (entry.isSymbolicLink()) {
+                skippedFiles.push({ file: relativePath, reason: "symbolic link" });
+                continue;
+            }
+            if (entry.isDirectory()) {
+                if (!policy.ignoredDirectories.includes(entry.name)) {
+                    await scanDirectory(absolutePath);
+                }
+                continue;
+            }
+            if (!entry.isFile()) {
+                skippedFiles.push({ file: relativePath, reason: "not a regular file" });
+                continue;
+            }
+            const extension = extname(entry.name).toLowerCase();
+            if (!policy.sourceExtensions.includes(extension)) {
+                continue;
+            }
+            if (filesScanned >= policy.maxFiles) {
+                findings.push({
+                    ruleId: "ZTDE-SCAN-001",
+                    severity: "error",
+                    confidence: "high",
+                    file: ".",
+                    message: `Audit stopped after reaching the ${policy.maxFiles}-file limit.`,
+                    evidence: ["The report does not cover every eligible source file."],
+                    remediation: "Narrow the audit target or explicitly raise the policy limit.",
+                });
+                scanStopped = true;
+                break;
+            }
+            const fileStats = await stat(absolutePath);
+            if (fileStats.size > policy.maxFileBytes) {
+                skippedFiles.push({
+                    file: relativePath,
+                    reason: `exceeds ${policy.maxFileBytes}-byte per-file limit`,
+                });
+                continue;
+            }
+            if (bytesScanned + fileStats.size > policy.maxTotalBytes) {
+                findings.push({
+                    ruleId: "ZTDE-SCAN-001",
+                    severity: "error",
+                    confidence: "high",
+                    file: relativePath,
+                    message: `Audit stopped before exceeding the ${policy.maxTotalBytes}-byte total read limit.`,
+                    evidence: ["The report does not cover every eligible source file."],
+                    remediation: "Narrow the audit target or explicitly raise the policy limit.",
+                });
+                scanStopped = true;
+                break;
+            }
+            const content = await readFile(absolutePath, "utf8");
+            const kind = scriptKind(extension);
+            const auditFile = {
+                absolutePath,
+                relativePath,
+                extension,
+                content,
+                lines: content.split(/\r?\n/),
+                sourceFile: kind === undefined
+                    ? undefined
+                    : ts.createSourceFile(relativePath, content, ts.ScriptTarget.Latest, true, kind),
+            };
+            filesScanned += 1;
+            bytesScanned += fileStats.size;
+            for (const rule of sourceRules) {
+                findings.push(...rule.evaluate(auditFile, policy));
+            }
+        }
+    }
+    await scanDirectory(rootDirectory);
+    const sortedFindings = sortFindings(findings);
+    const summary = {
+        errors: sortedFindings.filter((finding) => finding.severity === "error").length,
+        warnings: sortedFindings.filter((finding) => finding.severity === "warning").length,
+        info: sortedFindings.filter((finding) => finding.severity === "info").length,
+    };
+    return {
+        version: AUDIT_REPORT_VERSION,
+        target: rootDirectory,
+        generatedAt: new Date().toISOString(),
+        filesScanned,
+        bytesScanned,
+        skippedFiles,
+        findings: sortedFindings,
+        summary,
+        passed: summary.errors === 0,
+        evidenceBoundary: {
+            verifierLimitations: [
+                "Static source patterns cannot prove rendered placement, runtime state, backend availability, or whether an interaction succeeds.",
+                "Medium-confidence findings require repository-context review before remediation or suppression.",
+            ],
+            humanReviewRequired: [
+                "A qualified reviewer must evaluate domain fit, architectural trade-offs, task coherence, and any accepted static-rule exception.",
+            ],
+        },
+    };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/src/audit/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/audit/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU/C,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,MAAM,YAAY,GAAkC;IAClD,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAC3B,KAAK,KAAK;YACR,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAC3B;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,aAAqB,EACrB,MAAmB;IAEnB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL;gBACE,MAAM,EAAE,eAAe;gBACvB,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,QAAQ,EAAE,CAAC,8CAA8C,CAAC;gBAC1D,WAAW,EAAE,oEAAoE;aAClF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,SAAS,IAAI,WAAW;QACxE,CAAC,CAAE,WAAW,CAAC,OAA+C;QAC9D,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAC7E,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,2BAA2B,CAAC,MAAM,CAC7D,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAC7E,CACJ,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,GAAG,cAAc;QACjB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KACpD,CAAC;IAEF,OAAO;QACL;YACE,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,wDAAwD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5F,QAAQ,EAAE;gBACR,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,IAAI,GAAG,CAAC;gBAC/D,GAAG,aAAa,CAAC,GAAG,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,4CAA4C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAC7E;aACF;YACD,WAAW,EACT,2JAA2J;SAC9J;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,OAAO,CACL,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YACnC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,eAAuB,EACvB,kBAAwC,EAAE;IAE1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAmB,MAAM,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,UAAU,aAAa,CAAC,gBAAwB;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM;YACR,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;YAEzE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YAED,IAAI,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,MAAM;oBAClB,IAAI,EAAE,GAAG;oBACT,OAAO,EAAE,oCAAoC,MAAM,CAAC,QAAQ,cAAc;oBAC1E,QAAQ,EAAE,CAAC,uDAAuD,CAAC;oBACnE,WAAW,EAAE,+DAA+D;iBAC7E,CAAC,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzC,YAAY,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,WAAW,MAAM,CAAC,YAAY,sBAAsB;iBAC7D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,YAAY,GAAG,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzD,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,MAAM;oBAClB,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,sCAAsC,MAAM,CAAC,aAAa,yBAAyB;oBAC5F,QAAQ,EAAE,CAAC,uDAAuD,CAAC;oBACnE,WAAW,EAAE,+DAA+D;iBAC7E,CAAC,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,SAAS,GAAoB;gBACjC,YAAY;gBACZ,YAAY;gBACZ,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7B,UAAU,EACR,IAAI,KAAK,SAAS;oBAChB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;aACrF,CAAC;YAEF,YAAY,IAAI,CAAC,CAAC;YAClB,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;IAEnC,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;QAC/E,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;QACnF,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KAC7E,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,YAAY;QACZ,YAAY;QACZ,YAAY;QACZ,QAAQ,EAAE,cAAc;QACxB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5B,gBAAgB,EAAE;YAChB,mBAAmB,EAAE;gBACnB,kIAAkI;gBAClI,iGAAiG;aAClG;YACD,mBAAmB,EAAE;gBACnB,kIAAkI;aACnI;SACF;KACF,CAAC;AACJ,CAAC"}