@zxyycom/vibe-check 0.0.1

package/src/package-checks/file-metrics/execution.ts

@@ -0,0 +1,233 @@
+import type { CheckExecutionContext, CheckMessage, CheckResult } from "../../check/check.ts";
+import {
+  reconcileFindingWaivers,
+  type FindingWaiverReconciliation
+} from "../../finding-waivers/reconciliation.ts";
+import { collectProjectFileSets, requireProjectFileSet } from "../project-files/collection.ts";
+import { settleFindings } from "../code-quality-findings/policy.ts";
+import { measureFileMetrics, type FileMeasurementResult } from "./measurement.ts";
+import type { FileMetricsExactInputSet } from "./measurement-model.ts";
+import type {
+  FileMetricsFindingWaiver,
+  ResolvedFileMetricsCodeAreaOptions,
+  ResolvedFileMetricsOptions
+} from "./options.ts";
+import { isValidResolvedFileMetricsOptions } from "./options-validation.ts";
+import {
+  buildFileRecordCandidates,
+  fileMetricsWaiverAuditRecord,
+  fileMetricsWaiverIdentity,
+  type FileRecordCandidate
+} from "./records.ts";
+import type { FileMetricsFinalData } from "./final-data.ts";
+
+export const FILE_METRICS_CHECK_DEFINITION = {
+  checkId: "file-metrics",
+  displayName: "File metrics"
+} as const;
+
+/** `file-metrics` whole-Check unavailable outcome 的稳定 reason code。 */
+export type FileMetricsUnavailableReasonCode =
+  | "external-dependency-unavailable"
+  | "external-execution-failed"
+  | "external-result-invalid"
+  | "invalid-options"
+  | "source-unavailable";
+
+interface CollectedFileMetricsScope extends FileMetricsExactInputSet {
+  readonly areaIdsByPath: ReadonlyMap<string, readonly string[]>;
+}
+
+/** 使用 resolved area policy 和 scanner selection 执行一次完整的 file-metrics measurement。 */
+export async function executeFileMetrics(
+  context: CheckExecutionContext<ResolvedFileMetricsOptions>
+): Promise<CheckResult<FileMetricsFinalData>> {
+  if (!isValidResolvedFileMetricsOptions(context.options)) return unavailable("invalid-options");
+
+  let collectedScope: CollectedFileMetricsScope;
+  try {
+    collectedScope = collectAreaScope(context.project.root, context.options.codeAreas);
+  } catch {
+    return unavailable("source-unavailable");
+  }
+  if (collectedScope.approvedExactPaths.length === 0) {
+    return noEligibleInputResult(context);
+  }
+  const measurement = await measureFileMetrics(collectedScope, context.options.scanner);
+  if (measurement.kind !== "complete") return measurementFailureResult(measurement);
+  const candidates = buildFileRecordCandidates(measurement.metrics, {
+    areaIdsByPath: collectedScope.areaIdsByPath,
+    codeAreas: context.options.codeAreas
+  });
+  if (candidates === undefined) return unavailable("external-result-invalid");
+  const reconciliation = reconcileFileMetricWaivers(candidates, context.options.findingWaivers);
+  for (const finding of reconciliation.findings) {
+    const data =
+      finding.disposition === "waived"
+        ? Object.freeze({
+            ...finding.finding.data,
+            blocking: false,
+            waiver: Object.freeze({ reason: finding.waiver.reason })
+          })
+        : finding.finding.data;
+    context.records.report({ id: finding.finding.id }, data);
+  }
+  reportWaiverAuditRecords(context, reconciliation);
+  const settlement = settleFindings(
+    reconciliation.findings.map(({ disposition, finding }) => ({
+      actionable: disposition !== "waived",
+      blocking: finding.data.blocking
+    }))
+  );
+  return appendWaiverMessages(settlement, reconciliation);
+}
+
+function noEligibleInputResult(
+  context: CheckExecutionContext<ResolvedFileMetricsOptions>
+): CheckResult<FileMetricsFinalData> {
+  const reconciliation = reconcileFileMetricWaivers([], context.options.findingWaivers);
+  reportWaiverAuditRecords(context, reconciliation);
+  return appendWaiverMessages(
+    Object.freeze({ status: "not-applicable", reason: { code: "no-eligible-input" } }),
+    reconciliation
+  );
+}
+
+function reconcileFileMetricWaivers(
+  candidates: readonly FileRecordCandidate[],
+  waivers: readonly FileMetricsFindingWaiver[]
+): FindingWaiverReconciliation<FileRecordCandidate> {
+  return reconcileFindingWaivers({
+    findings: candidates,
+    identify: ({ data }) => ({ metric: data.metric, path: data.path }),
+    waivers
+  });
+}
+
+function reportWaiverAuditRecords(
+  context: CheckExecutionContext<ResolvedFileMetricsOptions>,
+  reconciliation: FindingWaiverReconciliation<FileRecordCandidate>
+): void {
+  for (const audit of reconciliation.waiverAudits) {
+    const record = fileMetricsWaiverAuditRecord(audit);
+    if (record !== undefined) context.records.report({ id: record.id }, record.data);
+  }
+}
+
+function appendWaiverMessages(
+  settlement: CheckResult<FileMetricsFinalData>,
+  reconciliation: FindingWaiverReconciliation<FileRecordCandidate>
+): CheckResult<FileMetricsFinalData> {
+  const waiverMessages: CheckMessage[] = [];
+  for (const audit of reconciliation.waiverAudits) {
+    const identity = fileMetricsWaiverIdentity(audit.waiver);
+    switch (audit.status) {
+      case "applied":
+        waiverMessages.push(
+          Object.freeze({
+            code: "finding-waived",
+            level: "info",
+            message: `File metric finding for ${identity.path} was waived: ${audit.waiver.reason}`
+          })
+        );
+        break;
+      case "unused":
+        waiverMessages.push(
+          Object.freeze({
+            code: "unused-finding-waiver",
+            level: "warning",
+            message: `Configured file-metrics finding waiver for ${identity.path} matched no finding; remove it or update its identity. Reason: ${audit.waiver.reason}`
+          })
+        );
+        break;
+      case "overmatched":
+        waiverMessages.push(
+          Object.freeze({
+            code: "overmatched-finding-waiver",
+            level: "warning",
+            message: `Configured file-metrics finding waiver for ${identity.path} matched ${audit.matchCount} findings and was not applied; narrow its identity. Reason: ${audit.waiver.reason}`
+          })
+        );
+        break;
+    }
+  }
+  if (waiverMessages.length === 0) return settlement;
+  return Object.freeze({
+    ...settlement,
+    messages: Object.freeze([...(settlement.messages ?? []), ...waiverMessages])
+  });
+}
+
+function collectAreaScope(
+  rootDir: string,
+  codeAreas: Readonly<Record<string, ResolvedFileMetricsCodeAreaOptions>>
+): CollectedFileMetricsScope {
+  const areaIdsByPath = new Map<string, string[]>();
+  const filesByArea = collectProjectFileSets(
+    rootDir,
+    Object.fromEntries(Object.entries(codeAreas).map(([areaId, area]) => [areaId, area.files]))
+  );
+  for (const [areaId] of Object.entries(codeAreas)) {
+    for (const path of requireProjectFileSet(filesByArea, areaId)) {
+      const areaIds = areaIdsByPath.get(path);
+      if (areaIds === undefined) areaIdsByPath.set(path, [areaId]);
+      else areaIds.push(areaId);
+    }
+  }
+
+  const normalizedMembership = new Map<string, readonly string[]>();
+  for (const [path, areaIds] of areaIdsByPath) {
+    normalizedMembership.set(path, Object.freeze(areaIds.sort(compareText)));
+  }
+  return Object.freeze({
+    approvedExactPaths: Object.freeze([...normalizedMembership.keys()].sort(compareText)),
+    areaIdsByPath: normalizedMembership,
+    rootDir
+  });
+}
+
+function measurementFailureResult(
+  measurement: Exclude<FileMeasurementResult, { kind: "complete" }>
+): CheckResult<FileMetricsFinalData> {
+  switch (measurement.kind) {
+    case "execution-failed":
+      return unavailable("external-execution-failed");
+    case "invalid-result":
+      return unavailable("external-result-invalid");
+    case "unavailable":
+      return unavailable("external-dependency-unavailable");
+  }
+  const exhaustiveMeasurement: never = measurement;
+  return exhaustiveMeasurement;
+}
+
+function unavailable(code: FileMetricsUnavailableReasonCode): CheckResult<FileMetricsFinalData> {
+  return Object.freeze({
+    status: "unavailable",
+    reason: { code },
+    messages: Object.freeze([
+      Object.freeze({ code, level: "error" as const, message: unavailableMessage(code) })
+    ])
+  });
+}
+
+function unavailableMessage(code: FileMetricsUnavailableReasonCode): string {
+  switch (code) {
+    case "invalid-options":
+      return "fileMetrics options are invalid; recreate the Check with fileMetrics(options) or restore its complete resolved options.";
+    case "source-unavailable":
+      return "File metrics could not collect its configured project files; check the project root, file permissions, and selected file source.";
+    case "external-dependency-unavailable":
+      return "The configured SCC command is unavailable or incompatible; install SCC 3.7.0 or configure a compatible executable.";
+    case "external-execution-failed":
+      return "SCC did not complete successfully; run the configured command directly and inspect its environment.";
+    case "external-result-invalid":
+      return "SCC output could not form a trusted complete result; check the executable version and CSV compatibility.";
+  }
+}
+
+function compareText(left: string, right: string): number {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}

package/src/package-checks/file-metrics/final-data.ts

@@ -0,0 +1,10 @@
+import type { FindingSummary } from "../code-quality-findings/policy.ts";
+import { parseFindingSummaryData } from "../final-data-parsing.ts";
+
+/** `file-metrics` 在 passed/failed outcome 中发布的主数据。 */
+export type FileMetricsFinalData = FindingSummary;
+
+/** 验证并脱离一份 `file-metrics` canonical final-data object。 */
+export function parseFileMetricsData(data: unknown): FileMetricsFinalData {
+  return parseFindingSummaryData(data, "fileMetrics");
+}

package/src/package-checks/file-metrics/measurement-model.ts

@@ -0,0 +1,10 @@
+export interface FileMetric {
+  readonly codeLines: number;
+  readonly decisionTokens: Readonly<{ readonly source: "scc"; readonly value: number | null }>;
+  readonly path: string;
+}
+
+export interface FileMetricsExactInputSet {
+  readonly approvedExactPaths: readonly string[];
+  readonly rootDir: string;
+}

package/src/package-checks/file-metrics/measurement.ts

@@ -0,0 +1,52 @@
+import { acceptExactInputMeasurements } from "../project-files/exact-input-measurement.ts";
+import type { FileMetric, FileMetricsExactInputSet } from "./measurement-model.ts";
+import type { ResolvedFileMetricsScannerOptions } from "./options.ts";
+import { checkScc } from "./scc/availability.ts";
+import { scanWithScc } from "./scc/scanner.ts";
+
+export type FileMeasurementResult = Readonly<
+  | { kind: "complete"; metrics: readonly FileMetric[] }
+  | { kind: "execution-failed" }
+  | { kind: "invalid-result" }
+  | { kind: "unavailable" }
+>;
+
+export async function measureFileMetrics(
+  exactInputs: FileMetricsExactInputSet,
+  scanner: ResolvedFileMetricsScannerOptions
+): Promise<FileMeasurementResult> {
+  if (exactInputs.approvedExactPaths.length === 0) {
+    return Object.freeze({ kind: "complete", metrics: Object.freeze([]) });
+  }
+  const scannerAvailability = await checkScc(exactInputs.rootDir, scanner);
+  if (!scannerAvailability.available) {
+    return Object.freeze({ kind: "unavailable" });
+  }
+  return runFileScanner(exactInputs, scanner);
+}
+
+function runFileScanner(
+  exactInputs: FileMetricsExactInputSet,
+  scanner: ResolvedFileMetricsScannerOptions
+): FileMeasurementResult {
+  const scanResult = scanWithScc({
+    cwd: exactInputs.rootDir,
+    scanner,
+    includePaths: exactInputs.approvedExactPaths
+  });
+  if (!scanResult.ok) {
+    return Object.freeze({
+      kind: scanResult.reason === "execution" ? "execution-failed" : "invalid-result"
+    });
+  }
+  const acceptedMeasurements = acceptExactInputMeasurements(
+    scanResult.measurements,
+    exactInputs.approvedExactPaths
+  );
+  return acceptedMeasurements.ok
+    ? Object.freeze({
+        kind: "complete",
+        metrics: Object.freeze([...acceptedMeasurements.payloads])
+      })
+    : Object.freeze({ kind: "invalid-result" });
+}

package/src/package-checks/file-metrics/options-resolution.ts

@@ -0,0 +1,213 @@
+import {
+  hasRequiredAndOptionalRecordKeys,
+  snapshotClosedArray,
+  snapshotClosedRecord
+} from "../../data-boundary/closed-values.ts";
+import {
+  resolveProjectFileSelection,
+  snapshotDefaultProjectFileSelection
+} from "../project-files/configuration.ts";
+import {
+  DEFAULT_FINDING_POLICY,
+  resolveFindingPolicy,
+  type FindingPolicy
+} from "../code-quality-findings/policy.ts";
+import { isNormalizedProjectRelativePath } from "../host-environment/path.ts";
+import type {
+  FileMetricsFindingIdentity,
+  FileMetricsFindingWaiver,
+  ResolvedFileMetricsCodeAreaOptions,
+  ResolvedFileMetricsOptions
+} from "./options.ts";
+import { isValidResolvedFileMetricsOptions } from "./options-validation.ts";
+
+const DEFAULT_EXECUTABLE = "scc";
+const DEFAULT_MAXIMUM_CODE_LINES = 360;
+const DEFAULT_ALLOWANCE_MAXIMUM_CODE_LINES = 600;
+const DEFAULT_ALLOWANCE_MAXIMUM_DECISION_TOKENS = 12;
+
+interface PolicyRecordKeys {
+  readonly optional?: readonly string[];
+  readonly required?: readonly string[];
+}
+
+/** 校验 constructor input，并将所有可省略 policy 物化为完整、冻结的 Check options。 */
+export function resolveFileMetricsOptions(
+  authoredOptions: unknown
+): ResolvedFileMetricsOptions | undefined {
+  const input = snapshotPolicyRecord(authoredOptions, {
+    optional: ["codeAreas", "findingPolicy", "findingWaivers", "scanner"]
+  });
+  if (input === undefined) return undefined;
+
+  const findingPolicy = resolveFindingPolicy(input.findingPolicy, DEFAULT_FINDING_POLICY);
+  if (findingPolicy === undefined) return undefined;
+  const codeAreas = resolveCodeAreas(input.codeAreas, findingPolicy);
+  const findingWaivers = resolveFindingWaivers(input.findingWaivers);
+  const scanner = resolveScanner(input.scanner);
+  if (codeAreas === undefined || findingWaivers === undefined || scanner === undefined)
+    return undefined;
+
+  const options = Object.freeze({ codeAreas, findingWaivers, scanner });
+  return isValidResolvedFileMetricsOptions(options) ? options : undefined;
+}
+
+function resolveFindingWaivers(value: unknown): readonly FileMetricsFindingWaiver[] | undefined {
+  if (value === undefined) return Object.freeze([]);
+  const candidates = snapshotClosedArray(value);
+  if (candidates === undefined) return undefined;
+  const waivers: FileMetricsFindingWaiver[] = [];
+  const seenIdentities = new Set<string>();
+  for (const candidate of candidates) {
+    const waiver = resolveFindingWaiver(candidate);
+    if (waiver === undefined) return undefined;
+    const identityKey = `${waiver.identity.metric}\u0000${waiver.identity.path}`;
+    if (seenIdentities.has(identityKey)) return undefined;
+    seenIdentities.add(identityKey);
+    waivers.push(waiver);
+  }
+  return Object.freeze(waivers);
+}
+
+function resolveFindingWaiver(value: unknown): FileMetricsFindingWaiver | undefined {
+  const waiver = snapshotPolicyRecord(value, { required: ["identity", "reason"] });
+  if (waiver === undefined || !isNonEmptyString(waiver.reason)) return undefined;
+  const identity = resolveFindingIdentity(waiver.identity);
+  return identity === undefined ? undefined : Object.freeze({ identity, reason: waiver.reason });
+}
+
+function resolveFindingIdentity(value: unknown): FileMetricsFindingIdentity | undefined {
+  const identity = snapshotPolicyRecord(value, { required: ["metric", "path"] });
+  return identity === undefined ||
+    identity.metric !== "code-lines" ||
+    !isNormalizedProjectRelativePath(identity.path)
+    ? undefined
+    : Object.freeze({ metric: "code-lines", path: identity.path });
+}
+
+function resolveCodeAreas(
+  value: unknown,
+  defaultFindingPolicy: FindingPolicy
+): ResolvedFileMetricsOptions["codeAreas"] | undefined {
+  if (value === undefined) return Object.freeze({ project: defaultCodeArea(defaultFindingPolicy) });
+  const areas = snapshotClosedRecord(value);
+  if (areas === undefined || Object.keys(areas).length === 0) return undefined;
+
+  const resolvedEntries: Array<readonly [string, ResolvedFileMetricsCodeAreaOptions]> = [];
+  for (const [areaId, candidate] of Object.entries(areas)) {
+    if (!isNonEmptyString(areaId)) return undefined;
+    const area = resolveCodeArea(candidate, defaultFindingPolicy);
+    if (area === undefined) return undefined;
+    resolvedEntries.push([areaId, area]);
+  }
+  return Object.freeze(Object.fromEntries(resolvedEntries));
+}
+
+function defaultCodeArea(findingPolicy: FindingPolicy): ResolvedFileMetricsCodeAreaOptions {
+  return Object.freeze({
+    codeLines: defaultCodeLines(),
+    files: snapshotDefaultProjectFileSelection(),
+    findingPolicy
+  });
+}
+
+function resolveCodeArea(
+  value: unknown,
+  defaultFindingPolicy: FindingPolicy
+): ResolvedFileMetricsCodeAreaOptions | undefined {
+  const area = snapshotPolicyRecord(value, {
+    optional: ["codeLines", "findingPolicy"],
+    required: ["files"]
+  });
+  if (area === undefined) return undefined;
+  const files = resolveProjectFileSelection(area.files);
+  const findingPolicy = resolveFindingPolicy(area.findingPolicy, defaultFindingPolicy);
+  const codeLines = resolveCodeLines(area.codeLines);
+  return files === undefined || findingPolicy === undefined || codeLines === undefined
+    ? undefined
+    : Object.freeze({ codeLines, files, findingPolicy });
+}
+
+function resolveCodeLines(
+  value: unknown
+): ResolvedFileMetricsCodeAreaOptions["codeLines"] | undefined {
+  if (value === undefined) return defaultCodeLines();
+  const codeLines = snapshotPolicyRecord(value, {
+    optional: ["lowDecisionTokenAllowance", "maximum"]
+  });
+  if (codeLines === undefined) return undefined;
+  const maximum = codeLines.maximum ?? DEFAULT_MAXIMUM_CODE_LINES;
+  const lowDecisionTokenAllowance = resolveAllowance(codeLines.lowDecisionTokenAllowance);
+  if (
+    !isPositiveSafeInteger(maximum) ||
+    lowDecisionTokenAllowance === undefined ||
+    lowDecisionTokenAllowance.maximumCodeLines <= maximum
+  ) {
+    return undefined;
+  }
+  return Object.freeze({ lowDecisionTokenAllowance, maximum });
+}
+
+function defaultCodeLines(): ResolvedFileMetricsCodeAreaOptions["codeLines"] {
+  return Object.freeze({
+    lowDecisionTokenAllowance: Object.freeze({
+      maximumCodeLines: DEFAULT_ALLOWANCE_MAXIMUM_CODE_LINES,
+      maximumDecisionTokens: DEFAULT_ALLOWANCE_MAXIMUM_DECISION_TOKENS
+    }),
+    maximum: DEFAULT_MAXIMUM_CODE_LINES
+  });
+}
+
+function resolveAllowance(
+  value: unknown
+): ResolvedFileMetricsCodeAreaOptions["codeLines"]["lowDecisionTokenAllowance"] | undefined {
+  if (value === undefined) return defaultCodeLines().lowDecisionTokenAllowance;
+  const allowance = snapshotPolicyRecord(value, {
+    optional: ["maximumCodeLines", "maximumDecisionTokens"]
+  });
+  if (allowance === undefined) return undefined;
+  const maximumCodeLines = allowance.maximumCodeLines ?? DEFAULT_ALLOWANCE_MAXIMUM_CODE_LINES;
+  const maximumDecisionTokens =
+    allowance.maximumDecisionTokens ?? DEFAULT_ALLOWANCE_MAXIMUM_DECISION_TOKENS;
+  if (
+    !isPositiveSafeInteger(maximumCodeLines) ||
+    !isNonNegativeSafeInteger(maximumDecisionTokens)
+  ) {
+    return undefined;
+  }
+  return Object.freeze({ maximumCodeLines, maximumDecisionTokens });
+}
+
+function resolveScanner(value: unknown): ResolvedFileMetricsOptions["scanner"] | undefined {
+  if (value === undefined) return Object.freeze({ executable: DEFAULT_EXECUTABLE });
+  const scanner = snapshotPolicyRecord(value, { optional: ["executable"] });
+  if (scanner === undefined) return undefined;
+  const executable = scanner.executable ?? DEFAULT_EXECUTABLE;
+  return isNonEmptyString(executable) ? Object.freeze({ executable }) : undefined;
+}
+
+function snapshotPolicyRecord(
+  value: unknown,
+  keys: PolicyRecordKeys
+): Readonly<Record<string, unknown>> | undefined {
+  const record = snapshotClosedRecord(value);
+  return record !== undefined &&
+    hasRequiredAndOptionalRecordKeys(record, {
+      optional: keys.optional ?? [],
+      required: keys.required ?? []
+    })
+    ? record
+    : undefined;
+}
+
+function isPositiveSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+function isNonNegativeSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0;
+}

package/src/package-checks/file-metrics/options-validation.ts

@@ -0,0 +1,104 @@
+import { snapshotClosedArray, snapshotClosedRecord } from "../../data-boundary/closed-values.ts";
+import { validProjectFileSelection } from "../project-files/configuration.ts";
+import { validFindingPolicy } from "../code-quality-findings/policy.ts";
+import { isNormalizedProjectRelativePath } from "../host-environment/path.ts";
+import type { ResolvedFileMetricsOptions } from "./options.ts";
+
+/** 验证 constructor 产物或普通对象组合形成的完整 file-metrics options。 */
+export function isValidResolvedFileMetricsOptions(
+  resolvedOptions: unknown
+): resolvedOptions is ResolvedFileMetricsOptions {
+  const options = exactRecord(resolvedOptions, ["codeAreas", "findingWaivers", "scanner"]);
+  return (
+    options !== undefined &&
+    isValidCodeAreas(options.codeAreas) &&
+    isValidFindingWaivers(options.findingWaivers) &&
+    isValidScanner(options.scanner)
+  );
+}
+
+function isValidFindingWaivers(value: unknown): boolean {
+  const waivers = snapshotClosedArray(value);
+  if (waivers === undefined) return false;
+  const identities = new Set<string>();
+  for (const candidate of waivers) {
+    const waiver = exactRecord(candidate, ["identity", "reason"]);
+    const identity =
+      waiver === undefined ? undefined : exactRecord(waiver.identity, ["metric", "path"]);
+    if (
+      waiver === undefined ||
+      identity === undefined ||
+      identity.metric !== "code-lines" ||
+      !isNormalizedProjectRelativePath(identity.path) ||
+      !isNonEmptyString(waiver.reason)
+    ) {
+      return false;
+    }
+    const identityKey = `${identity.metric}\u0000${identity.path}`;
+    if (identities.has(identityKey)) return false;
+    identities.add(identityKey);
+  }
+  return true;
+}
+
+function isValidCodeAreas(value: unknown): boolean {
+  const codeAreas = snapshotClosedRecord(value);
+  if (codeAreas === undefined || Object.keys(codeAreas).length === 0) return false;
+  return Object.entries(codeAreas).every(
+    ([areaId, candidate]) => areaId.length > 0 && isValidCodeArea(candidate)
+  );
+}
+
+function isValidCodeArea(value: unknown): boolean {
+  const area = exactRecord(value, ["codeLines", "files", "findingPolicy"]);
+  return (
+    area !== undefined &&
+    validProjectFileSelection(area.files) &&
+    validFindingPolicy(area.findingPolicy) &&
+    isValidCodeLinePolicy(area.codeLines)
+  );
+}
+
+function isValidCodeLinePolicy(value: unknown): boolean {
+  const policy = exactRecord(value, ["lowDecisionTokenAllowance", "maximum"]);
+  if (policy === undefined || !isPositiveSafeInteger(policy.maximum)) return false;
+  const allowance = exactRecord(policy.lowDecisionTokenAllowance, [
+    "maximumCodeLines",
+    "maximumDecisionTokens"
+  ]);
+  return (
+    allowance !== undefined &&
+    isPositiveSafeInteger(allowance.maximumCodeLines) &&
+    allowance.maximumCodeLines > policy.maximum &&
+    isNonNegativeSafeInteger(allowance.maximumDecisionTokens)
+  );
+}
+
+function isValidScanner(value: unknown): boolean {
+  const scanner = exactRecord(value, ["executable"]);
+  return scanner !== undefined && isNonEmptyString(scanner.executable);
+}
+
+function exactRecord(
+  value: unknown,
+  keys: readonly string[]
+): Readonly<Record<string, unknown>> | undefined {
+  const record = snapshotClosedRecord(value);
+  return record !== undefined &&
+    Object.keys(record).length === keys.length &&
+    keys.every((key) => Object.hasOwn(record, key))
+    ? record
+    : undefined;
+}
+
+function isPositiveSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+function isNonNegativeSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0;
+}