@decantr/verifier - npm Package Compare versions

Comparing version 3.9.4 to 3.10.0

package.json

@@ -7,3 +7,3 @@ {
   "dependencies": {
-    "@decantr/core": "3.9.4",
+    "@decantr/core": "3.10.0",
     "@decantr/essence-spec": "3.8.1",
@@ -13,3 +13,3 @@ "entities": "^8.0.0",
   },
-  "description": "Shared verification, typed findings, graph anchors, Project Health, and evidence schemas for Decantr",
+  "description": "UI authority discovery, task context, verification, Project Health, and evidence contracts for Decantr",
   "devDependencies": {
@@ -88,3 +88,3 @@ "ajv": "^8.20.0",
   "types": "dist/index.d.ts",
-  "version": "3.9.4"
+  "version": "3.10.0"
 }

README.md

@@ -6,4 +6,10 @@ # @decantr/verifier
 
-Shared Decantr verification, critique, and report-schema engine used by the CLI, MCP server, and future CI/hosted verification surfaces.
+Shared local discovery, verification, critique, and report-schema engine used by the Decantr CLI, MCP server, and CI adapters.
 
+## Release Boundary
+
+Decantr 3.10.0 is the current published stable line. Its independent UI authority axes, route and non-route task context, compatible route-backed task capsules, adoption truth, governance deltas, and report schemas are shipped contracts, but the release is not quantitatively adoption-proven.
+
+The verifier models routes, layouts, components, stories, overlays, flows, packages, and runtime states as independent UI surfaces and reports selected-app, surface-authority, topology, taskability, component-inventory, styling-authority, and runtime-evidence axes separately. These shipped APIs do not establish that Decantr improves model outcomes; only a separate controlled A/B program can support that claim.
+
 ## Install
@@ -15,7 +21,7 @@
 
-## What It Exports
+## Compatible 3.x Exports
 
 - `auditProject()` for project-level Decantr audits
 - `auditBuiltDist()` for built-output runtime verification against emitted HTML, assets, and route hints
-- `discoverProject()` for shared read-only Brownfield discovery of workspace/app scope, package manager, framework, language, source-declared routes, taskable routes, component inventory, styling authority, Decantr presence, and inherited assistant-rule files. Formal TanStack source routes outrank generated trees; nested React Router objects resolve lazy implementation files; Vue Router objects are recognized; pathname fallbacks carry medium confidence. Angular discovery selects the configured app entry, follows bootstrap-reachable TypeScript imports to router roots, resolves nested/lazy route arrays and implementation files, excludes test/fixture source, separates lazy route scopes from rendered pages, inventories `@Component` classes, and reports authority/completeness independently from aggregate confidence.
+- `discoverProject()` for shared read-only Brownfield discovery of workspace/app scope, package manager, framework, language, source-declared routes, taskable routes, component inventory, styling authority, Decantr presence, and inherited assistant-rule files. Formal framework routes outrank generated trees, and Angular discovery begins at the selected production bootstrap/router graph while excluding test and fixture source.
 - `scanProject()` for read-only Brownfield reconnaissance that emits `scan-report.v2` by default using the shared discovery substrate
@@ -32,3 +38,3 @@ - `auditComponentReuse()` for the first AST-derived component reuse drift slice, focused on AI reimplementing common UI primitives instead of importing project-owned components, plus local import references that the typed graph can turn into source-to-source impact edges
 - `createProjectAdoptionTruthV1()` for one read-only, discovery-backed project truth; `createProjectIdentityV1()` provides the clone-independent workspace-relative identity shared by task capsules, CI v3, MCP, and local baselines, while `createStableProjectIdentityV1()` derives the same identity directly from a selected project root
-- `createTaskCapsuleV1()` for structured project, graph, ranked read-target, authority, impact, finding, official-guidance, stop-condition, and exact verification-command context under deterministic 12,000 canonical UTF-8 byte / 4,000 estimated-token limits using conservative `tokenEstimateV1 = ceil(bytes / 3)` accounting; task-request truncation, omitted counts, canonical byte/token measurements, and downstream digests must all derive from this final canonical result
+- `createTaskCapsuleV1()` for the shipped attached-route contract: structured project, graph, ranked read-target, authority, impact, finding, official-guidance, stop-condition, and exact verification-command context under deterministic 12,000 canonical UTF-8 byte / 4,000 estimated-token limits using conservative `tokenEstimateV1 = ceil(bytes / 3)` accounting; task-request truncation, omitted counts, canonical byte/token measurements, and downstream digests must all derive from this final canonical result
 - `createGovernanceDeltaV1()` and `fingerprintFindingOccurrenceV1()` for Git-scope-independent debt comparison with deterministic new, inherited, resolved, and unclassified finding occurrences plus explicit incomplete-proof gates
@@ -49,2 +55,3 @@ - `resolveGraphAnchorForFinding()` and `anchorFindingsToGraph()` for attaching verifier/Project Health findings to typed Contract graph nodes when a graph snapshot exists
 - project source audits ignore test, spec, story, fixture, and mock files for production drift warnings such as localhost endpoints and unsafe rendering patterns
+- broad project-owned Brownfield inline-style/accessibility signals and server-only localhost fallbacks remain advisory; client-reachable localhost, accepted obligations, host/browser tests, and source-corroborated security evidence retain stronger severity. Generic minified framework-bundle marker volume is not proof by itself.
 - project audits emit `COMP001` / `import-existing-component` findings when a production source file locally redeclares a primitive such as `Button`, `Card`, or `Dialog` while an exported reusable primitive already exists under common component paths
@@ -71,2 +78,13 @@ - project audits emit `COMP010` / `replace-raw-control-with-local-component` findings when production JSX renders generic raw controls such as `<button>` or text-like `<input>` while a project-owned primitive already exists; specialized inputs such as file, hidden, checkbox, radio, color, range, and Dropzone `getInputProps()` controls are not treated as generic `Input` drift
 
+## Published 3.10 Exports
+
+- `buildUISurfaceDiscovery()` and `UISurfaceDiscovery` for the `ui-surfaces.v1` model: eight surface kinds, exact `ready` / `limited` / `blocked` / `unsupported` readiness, and independently visible authority axes
+- `resolveUISurfaceTaskContext()` for target resolution by route, exact surface ID, component name, `kind:name`, or `file:<path>`; ambiguous and unknown targets return no read set, and non-route static evidence remains limited unless runtime reachability is proven
+- `discoverUIEvidenceAdapters()` for selected-app Storybook, Figma Code Connect, design-token, project-test, runtime, visual, and accessibility evidence; configured or collected evidence does not prove freshness, pass state, task coverage, runtime behavior, or publication success
+- `classifyProjectSourceScope()` for separation of production, test, story, fixture, mock, generated, build-output, package, and runtime evidence
+- Next App/Pages Router discovery evaluates root or `src/` middleware/proxy policy and reachable local helpers separately from file-route declaration. Statically identified 4xx-conditioned routes remain observable but non-taskable; unresolved path-dependent policy degrades authority and fails closed.
+- Candidate styling discovery follows ordered production stylesheet imports through local files and workspace package exports. Task read sets preserve that cascade order, and Next API route handlers are excluded from the UI component inventory.
+
+These APIs ship in 3.10.0. Their schemas remain explicit about authority and limitations; publication does not turn them into model-value evidence.
+
 ## Example
@@ -122,3 +140,3 @@
 
-These contracts define deterministic evidence shapes; they do not by themselves prove the Decantr 3.9 quantitative gates. Human qualification remains fail-closed until the frozen route corpus, two-person finding adjudication, public 3.8.3 replay, final 3.9 replay, and adoption/Studio filesystem evidence are complete. Stable 3.9.4 publication may use the explicit sole-maintainer release gate with human finding claims waived; that does not make the release human-qualified or adoption-proven.
+These contracts define deterministic evidence shapes; they do not prove product value by themselves. Stable 3.10.0 is product-qualified, not human-qualified or adoption-proven. A separate frozen 40-task, two-model, two-arm, repeated A/B protocol gates only a measured model-improvement claim. Development-corpus results may tune implementation but cannot grant that confirmatory claim; qualification failures, unsupported targets, missing evaluators, build failures, and model substitutions remain visible in its denominator.
 
@@ -136,2 +154,3 @@ ## Security And Permissions
 - hosted, CLI, MCP, and Studio consumers should treat the published schemas as the supported contract surface
+- `ui-surfaces.v1` and `ui-surface-task-context.v1` are stable 3.10 APIs, but their authority state and limitations must not be paraphrased into stronger readiness claims
 
@@ -138,0 +157,0 @@ ## License

schema/scan-report.v2.json

@@ -275,2 +275,3 @@ {
         "componentEvidence",
+        "uiSurfaces",
         "limitations"
@@ -334,2 +335,5 @@ ],
         },
+        "uiSurfaces": {
+          "$ref": "#/$defs/uiSurfaces"
+        },
         "limitations": {
@@ -356,2 +360,155 @@ "$ref": "#/$defs/stringArray"
   "$defs": {
+    "uiAxis": {
+      "type": "object",
+      "required": ["status", "confidence", "evidence", "limitations", "blocksReady"],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": ["proven", "partial", "unresolved", "not_applicable", "unsupported"]
+        },
+        "confidence": {
+          "$ref": "#/$defs/confidenceLevel"
+        },
+        "evidence": {
+          "$ref": "#/$defs/stringArray"
+        },
+        "limitations": {
+          "$ref": "#/$defs/stringArray"
+        },
+        "blocksReady": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
+    "uiSurfaces": {
+      "type": "object",
+      "required": ["schemaVersion", "status", "primaryMode", "counts", "axes", "evidenceAdapters", "reasons"],
+      "properties": {
+        "schemaVersion": {
+          "const": "ui-surfaces.v1"
+        },
+        "status": {
+          "type": "string",
+          "enum": ["ready", "limited", "blocked", "unsupported"]
+        },
+        "primaryMode": {
+          "type": "string",
+          "enum": ["application", "design-system", "component-library", "unknown"]
+        },
+        "counts": {
+          "type": "object",
+          "required": ["file", "route", "layout", "component", "story", "overlay", "flow", "package", "runtime-state"],
+          "properties": {
+            "file": { "type": "integer", "minimum": 0 },
+            "route": { "type": "integer", "minimum": 0 },
+            "layout": { "type": "integer", "minimum": 0 },
+            "component": { "type": "integer", "minimum": 0 },
+            "story": { "type": "integer", "minimum": 0 },
+            "overlay": { "type": "integer", "minimum": 0 },
+            "flow": { "type": "integer", "minimum": 0 },
+            "package": { "type": "integer", "minimum": 0 },
+            "runtime-state": { "type": "integer", "minimum": 0 }
+          },
+          "additionalProperties": false
+        },
+        "axes": {
+          "type": "object",
+          "required": ["selectedApp", "surfaceAuthority", "topologyCompleteness", "taskability", "componentInventory", "stylingAuthority", "runtimeEvidence"],
+          "properties": {
+            "selectedApp": { "$ref": "#/$defs/uiAxis" },
+            "surfaceAuthority": { "$ref": "#/$defs/uiAxis" },
+            "topologyCompleteness": { "$ref": "#/$defs/uiAxis" },
+            "taskability": { "$ref": "#/$defs/uiAxis" },
+            "componentInventory": { "$ref": "#/$defs/uiAxis" },
+            "stylingAuthority": { "$ref": "#/$defs/uiAxis" },
+            "runtimeEvidence": { "$ref": "#/$defs/uiAxis" }
+          },
+          "additionalProperties": false
+        },
+        "evidenceAdapters": {
+          "$ref": "#/$defs/uiEvidenceAdapters"
+        },
+        "reasons": {
+          "$ref": "#/$defs/stringArray"
+        }
+      },
+      "additionalProperties": false
+    },
+    "uiEvidenceFile": {
+      "type": "object",
+      "required": ["file", "role", "scope"],
+      "properties": {
+        "file": {
+          "type": "string"
+        },
+        "role": {
+          "type": "string",
+          "enum": ["configuration", "source", "artifact"]
+        },
+        "scope": {
+          "type": "string",
+          "enum": ["production", "package", "story", "example", "test", "fixture", "generated", "build-output", "supporting", "runtime-evidence"]
+        }
+      },
+      "additionalProperties": false
+    },
+    "uiEvidenceAdapter": {
+      "type": "object",
+      "required": ["kind", "status", "confidence", "files", "evidence", "limitations"],
+      "properties": {
+        "kind": {
+          "type": "string",
+          "enum": ["storybook", "figma-code-connect", "design-tokens", "project-tests", "runtime", "visual", "accessibility"]
+        },
+        "status": {
+          "type": "string",
+          "enum": ["absent", "configured", "available"]
+        },
+        "confidence": {
+          "$ref": "#/$defs/confidenceLevel"
+        },
+        "files": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/uiEvidenceFile"
+          }
+        },
+        "evidence": {
+          "$ref": "#/$defs/stringArray"
+        },
+        "limitations": {
+          "$ref": "#/$defs/stringArray"
+        }
+      },
+      "additionalProperties": false
+    },
+    "uiEvidenceAdapters": {
+      "type": "object",
+      "required": ["storybook", "figmaCodeConnect", "designTokens", "projectTests", "runtime", "visual", "accessibility"],
+      "properties": {
+        "storybook": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "figmaCodeConnect": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "designTokens": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "projectTests": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "runtime": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "visual": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        },
+        "accessibility": {
+          "$ref": "#/$defs/uiEvidenceAdapter"
+        }
+      },
+      "additionalProperties": false
+    },
     "confidenceLevel": {
@@ -358,0 +515,0 @@ "type": "string",

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

3015256

9.55%

Lines of code

29492

8.79%

Number of lines in readme file

153

14.18%

Worsened metrics

Number of low supply chain risk alerts

16

33.33%

Dependency changes

• + Added

  @decantr/content@3.10.0
  (transitive)

• + Added

  @decantr/core@3.10.0
  (transitive)

• - Removed

  @decantr/content@3.9.4
  (transitive)

• - Removed

  @decantr/core@3.9.4
  (transitive)

• Updated

  @decantr/core@3.10.0