Sign In

@decantr/verifier

Package Overview
Dependencies
Maintainers
1
Versions
45
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@decantr/verifier - npm Package Compare versions

Comparing version
3.10.0
 to
3.11.0
+285
schema/change-assurance-report.v1.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://decantr.ai/schemas/change-assurance-report.v1.json",
"title": "Decantr Change Assurance Report v1",
"type": "object",
"required": [
"$schema",
"version",
"generatedAt",
"status",
"project",
"comparisonScope",
"changeBase",
"authority",
"surfaces",
"findings",
"limitations",
"summary"
],
"properties": {
"$schema": { "const": "https://decantr.ai/schemas/change-assurance-report.v1.json" },
"version": { "const": "1.0.0" },
"generatedAt": { "type": "string", "format": "date-time" },
"status": { "enum": ["pass", "attention", "not_proven"] },
"project": {
"type": "object",
"required": ["projectRoot", "workspaceRoot", "selectedAppRoot", "framework", "selection"],
"properties": {
"projectRoot": { "type": "string", "minLength": 1 },
"workspaceRoot": { "type": "string", "minLength": 1 },
"selectedAppRoot": { "$ref": "#/$defs/relativePath" },
"framework": { "type": "string", "minLength": 1 },
"selection": {
"type": "object",
"required": ["strategy", "evidence"],
"properties": {
"strategy": {
"enum": ["explicit", "current-directory", "changed-files"]
},
"evidence": { "$ref": "#/$defs/stringArray" }
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"comparisonScope": { "$ref": "#/$defs/comparisonScope" },
"changeBase": { "$ref": "#/$defs/changeBase" },
"authority": {
"type": "object",
"required": ["readiness", "axes", "routeAuthority", "routeCompleteness", "confidence"],
"properties": {
"readiness": { "enum": ["ready", "limited", "blocked", "unsupported"] },
"axes": { "type": "object" },
"routeAuthority": { "enum": ["proven", "inferred", "unresolved"] },
"routeCompleteness": { "enum": ["complete", "partial", "unknown"] },
"confidence": {
"type": "object",
"required": ["level", "score", "reasons"],
"properties": {
"level": { "enum": ["high", "medium", "low"] },
"score": { "type": "number", "minimum": 0, "maximum": 100 },
"reasons": { "$ref": "#/$defs/stringArray" }
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"surfaces": {
"type": "object",
"required": [
"changedFiles",
"productionFiles",
"ignoredFiles",
"uiFiles",
"unresolvedFiles",
"impactedSurfaces",
"routeAuthorityFanOut",
"stylingAuthorityFanOut"
],
"properties": {
"changedFiles": { "$ref": "#/$defs/relativePathArray" },
"productionFiles": { "$ref": "#/$defs/relativePathArray" },
"ignoredFiles": {
"type": "array",
"items": {
"type": "object",
"required": ["file", "scope"],
"properties": {
"file": { "$ref": "#/$defs/relativePath" },
"scope": {
"enum": [
"production",
"package",
"story",
"example",
"test",
"fixture",
"generated",
"build-output",
"supporting"
]
}
},
"additionalProperties": false
}
},
"uiFiles": { "$ref": "#/$defs/relativePathArray" },
"unresolvedFiles": { "$ref": "#/$defs/relativePathArray" },
"impactedSurfaces": { "type": "array", "items": { "type": "object" } },
"routeAuthorityFanOut": { "type": "boolean" },
"stylingAuthorityFanOut": { "type": "boolean" }
},
"additionalProperties": false
},
"findings": {
"type": "array",
"maxItems": 20,
"items": {
"type": "object",
"required": ["occurrence", "evidence", "suggestedFix", "repair"],
"properties": {
"occurrence": { "$ref": "#/$defs/occurrence" },
"evidence": { "$ref": "#/$defs/stringArray" },
"suggestedFix": { "type": "string", "minLength": 1 },
"repair": { "type": ["object", "null"] }
},
"additionalProperties": false
}
},
"limitations": { "$ref": "#/$defs/stringArray" },
"summary": {
"type": "object",
"required": [
"changedFileCount",
"productionFileCount",
"ignoredFileCount",
"uiFileCount",
"unresolvedFileCount",
"impactedSurfaceCount",
"totalFindingCount",
"shownFindingCount",
"truncatedFindingCount"
],
"properties": {
"changedFileCount": { "$ref": "#/$defs/count" },
"productionFileCount": { "$ref": "#/$defs/count" },
"ignoredFileCount": { "$ref": "#/$defs/count" },
"uiFileCount": { "$ref": "#/$defs/count" },
"unresolvedFileCount": { "$ref": "#/$defs/count" },
"impactedSurfaceCount": { "$ref": "#/$defs/count" },
"totalFindingCount": { "$ref": "#/$defs/count" },
"shownFindingCount": { "$ref": "#/$defs/count" },
"truncatedFindingCount": { "$ref": "#/$defs/count" }
},
"additionalProperties": false
}
},
"additionalProperties": false,
"$defs": {
"count": { "type": "integer", "minimum": 0 },
"nullableString": { "type": ["string", "null"] },
"stringArray": { "type": "array", "items": { "type": "string" } },
"relativePath": {
"type": "string",
"minLength": 1,
"pattern": "^(?:\\.|(?!/)(?![A-Za-z]:/)(?!.*(?:^|/)\\.\\.(?:/|$))[^\\\\]+)$"
},
"relativePathArray": {
"type": "array",
"uniqueItems": true,
"items": { "$ref": "#/$defs/relativePath" }
},
"comparisonScope": {
"type": "object",
"required": ["kind", "identity"],
"properties": {
"kind": { "enum": ["working_tree", "commit_range", "pull_request", "unknown"] },
"identity": { "$ref": "#/$defs/nullableString" }
},
"additionalProperties": false
},
"changeBase": {
"type": "object",
"required": [
"identity",
"hash",
"baseRef",
"headRef",
"mergeBase",
"completeness",
"changedFiles",
"changedRoutes",
"impactedNodeIds",
"unresolvedFiles",
"limitations"
],
"properties": {
"identity": { "$ref": "#/$defs/nullableString" },
"hash": { "$ref": "#/$defs/nullableString" },
"baseRef": { "$ref": "#/$defs/nullableString" },
"headRef": { "$ref": "#/$defs/nullableString" },
"mergeBase": { "$ref": "#/$defs/nullableString" },
"completeness": { "enum": ["complete", "incomplete"] },
"changedFiles": { "$ref": "#/$defs/relativePathArray" },
"changedRoutes": { "$ref": "#/$defs/stringArray" },
"impactedNodeIds": { "$ref": "#/$defs/stringArray" },
"unresolvedFiles": { "$ref": "#/$defs/relativePathArray" },
"limitations": { "$ref": "#/$defs/stringArray" }
},
"additionalProperties": false
},
"location": {
"type": "object",
"required": ["line"],
"properties": {
"line": { "type": "integer", "minimum": 1 },
"column": { "type": "integer", "minimum": 1 },
"endLine": { "type": "integer", "minimum": 1 },
"endColumn": { "type": "integer", "minimum": 1 }
},
"additionalProperties": false
},
"annotation": {
"type": "object",
"required": ["path", "startLine", "startColumn", "endLine", "endColumn"],
"properties": {
"path": { "anyOf": [{ "$ref": "#/$defs/relativePath" }, { "type": "null" }] },
"startLine": { "type": ["integer", "null"], "minimum": 1 },
"startColumn": { "type": ["integer", "null"], "minimum": 1 },
"endLine": { "type": ["integer", "null"], "minimum": 1 },
"endColumn": { "type": ["integer", "null"], "minimum": 1 }
},
"additionalProperties": false
},
"occurrence": {
"type": "object",
"required": [
"code",
"ruleId",
"source",
"category",
"severity",
"message",
"authorityLane",
"graphAnchor",
"repairId",
"repairTarget",
"annotation",
"file",
"route",
"target",
"location"
],
"properties": {
"code": { "type": "string", "minLength": 1 },
"ruleId": { "type": "string", "minLength": 1 },
"source": { "const": "change-assurance" },
"category": { "type": "string", "minLength": 1 },
"severity": { "enum": ["error", "warn", "info"] },
"message": { "type": "string", "minLength": 1 },
"authorityLane": {
"enum": [
"production-source",
"local-law",
"style-bridge",
"essence-contract",
"official-guidance",
"unknown"
]
},
"graphAnchor": { "type": ["object", "null"] },
"repairId": { "$ref": "#/$defs/nullableString" },
"repairTarget": { "$ref": "#/$defs/nullableString" },
"annotation": { "$ref": "#/$defs/annotation" },
"file": { "anyOf": [{ "$ref": "#/$defs/relativePath" }, { "type": "null" }] },
"route": { "$ref": "#/$defs/nullableString" },
"target": { "$ref": "#/$defs/nullableString" },
"location": { "anyOf": [{ "$ref": "#/$defs/location" }, { "type": "null" }] }
},
"additionalProperties": false
}
}
}
+3
-2
package.json

@@ -12,3 +12,3 @@ {

},
"description": "UI authority discovery, task context, verification, Project Health, and evidence contracts for Decantr",
"description": "Changed-UI assurance, authority discovery, task context, Project Health, and evidence contracts for Decantr",
"devDependencies": {

@@ -28,2 +28,3 @@ "ajv": "^8.20.0",

"./schema/authority-resolution.v2.json": "./schema/authority-resolution.v2.json",
"./schema/change-assurance-report.v1.json": "./schema/change-assurance-report.v1.json",
"./schema/decantr-ci-report.v1.json": "./schema/decantr-ci-report.v1.json",

@@ -88,3 +89,3 @@ "./schema/decantr-ci-report.v2.json": "./schema/decantr-ci-report.v2.json",

"types": "dist/index.d.ts",
"version": "3.10.0"
"version": "3.11.0"
}
+35
-4
README.md

@@ -10,3 +10,3 @@ # @decantr/verifier

Decantr 3.10.0 is the current published stable line. Its independent UI authority axes, route and non-route task context, compatible route-backed task capsules, adoption truth, governance deltas, and report schemas are shipped contracts, but the release is not quantitatively adoption-proven.
Decantr 3.11.0 is the current stable line. It adds Changed-UI Assurance to the independent UI authority axes, route and non-route task context, compatible route-backed task capsules, adoption truth, governance deltas, and report schemas. The release is not quantitatively adoption-proven.

@@ -23,2 +23,4 @@ The verifier models routes, layouts, components, stories, overlays, flows, packages, and runtime states as independent UI surfaces and reports selected-app, surface-authority, topology, taskability, component-inventory, styling-authority, and runtime-evidence axes separately. These shipped APIs do not establish that Decantr improves model outcomes; only a separate controlled A/B program can support that claim.

- `verifyUIChanges()` for zero-write, Git-scoped UI assurance with fail-closed app selection and at most three consequential findings by default
- `resolveChangedUISurfaces()` for mapping staged, unstaged, deleted, renamed, untracked, commit-range, or unborn-branch files to one selected app and its affected UI surfaces
- `auditProject()` for project-level Decantr audits

@@ -76,4 +78,13 @@ - `auditBuiltDist()` for built-output runtime verification against emitted HTML, assets, and route hints

## Published 3.10 Exports
## Published 3.11 Exports
- `verifyUIChanges()`, `resolveChangedUISurfaces()`, and `CHANGE_ASSURANCE_V1_SCHEMA_URL`
- `ChangeAssuranceReportV1` plus typed status, finding, Git scope, selection, surface, and limitation contracts
- `AUTH001`, `AUTH010`, `COMP001`, `COMP010`, and `TOKEN010` assurance findings with source and repair targets
- shared consumption by CLI bare verify, explicit CI v3, and MCP `decantr_verify` action `changes`
The default finding limit is three and the maximum explicit limit is twenty. Primitive-reuse checks are strongest for JSX/TSX; template parity for Angular, Vue, and other frameworks remains limited in 3.11.
## Published 3.10 Foundation
- `buildUISurfaceDiscovery()` and `UISurfaceDiscovery` for the `ui-surfaces.v1` model: eight surface kinds, exact `ready` / `limited` / `blocked` / `unsupported` readiness, and independently visible authority axes

@@ -97,2 +108,3 @@ - `resolveUISurfaceTaskContext()` for target resolution by route, exact surface ID, component name, `kind:name`, or `file:<path>`; ambiguous and unknown targets return no read set, and non-route static evidence remains limited unless runtime reachability is proven

scanProject,
verifyUIChanges,
type ProjectHealthReport,

@@ -102,2 +114,19 @@ } from '@decantr/verifier';

const scan = await scanProject(process.cwd());
const changedUI = verifyUIChanges({
projectRoot: process.cwd(),
comparisonScope: { kind: 'working_tree', identity: 'git:working-tree' },
changeBase: {
identity: 'git:working-tree:head',
hash: 'sha256:<caller-computed>',
baseRef: 'HEAD',
headRef: '<head-sha>',
mergeBase: '<head-sha>',
completeness: 'complete',
changedFiles: ['src/pages/overview.tsx'],
changedRoutes: [],
impactedNodeIds: [],
unresolvedFiles: [],
limitations: [],
},
});
const audit = await auditProject(process.cwd());

@@ -115,2 +144,3 @@ const assertions = createContractAssertions(process.cwd(), audit);

- `@decantr/verifier/schema/adoption-truth.v1.json`
- `@decantr/verifier/schema/change-assurance-report.v1.json`
- `@decantr/verifier/schema/task-capsule.v1.json`

@@ -141,7 +171,7 @@ - `@decantr/verifier/schema/governance-delta.v1.json`

These contracts define deterministic evidence shapes; they do not prove product value by themselves. Stable 3.10.0 is product-qualified, not human-qualified or adoption-proven. A separate frozen 40-task, two-model, two-arm, repeated A/B protocol gates only a measured model-improvement claim. Development-corpus results may tune implementation but cannot grant that confirmatory claim; qualification failures, unsupported targets, missing evaluators, build failures, and model substitutions remain visible in its denominator.
These contracts define deterministic evidence shapes; they do not prove product value by themselves. Stable 3.11.0 is product-qualified, not human-qualified or adoption-proven. A separate frozen 40-task, two-model, two-arm, repeated A/B protocol gates only a measured model-improvement claim. Development-corpus results may tune implementation but cannot grant that confirmatory claim; qualification failures, unsupported targets, missing evaluators, build failures, and model substitutions remain visible in its denominator.
## Security And Permissions
The verifier is a local library. It reads selected project source, Decantr context, read-only scan files, and built `dist`/`.next` output when callers request project or runtime audits. `scanProject()` returns relative evidence and does not write artifacts, install dependencies, build projects, execute scripts, or open pull requests. `probePublishedSite()` fetches HTML metadata over HTTP(S) only and does not execute JavaScript or capture screenshots. Built-output runtime audit starts a temporary loopback static server and fetches from that local server. The verifier does not write files, spawn processes, emit telemetry, or upload source by itself. See [security permissions](https://decantr.ai/reference/security-permissions.md).
The verifier is a local library. It reads selected project source, direct workspace-package component authority, Decantr context, read-only scan files, and built `dist`/`.next` output when callers request project or runtime audits. `verifyUIChanges()` accepts caller-provided Git scope and never writes. `scanProject()` returns relative evidence and does not write artifacts, install dependencies, build projects, execute scripts, or open pull requests. `probePublishedSite()` fetches HTML metadata over HTTP(S) only and does not execute JavaScript or capture screenshots. Built-output runtime audit starts a temporary loopback static server and fetches from that local server. The verifier does not write files, spawn processes, emit telemetry, or upload source by itself. See [security permissions](https://decantr.ai/reference/security-permissions.md).

@@ -156,2 +186,3 @@ ## Compatibility

- `ui-surfaces.v1` and `ui-surface-task-context.v1` are stable 3.10 APIs, but their authority state and limitations must not be paraphrased into stronger readiness claims
- `change-assurance-report.v1` is the stable 3.11 changed-UI wire contract; consumers must preserve `not_proven` and explicit limitations

@@ -158,0 +189,0 @@ ## License

+2
-1
schema/decantr-ci-report.v3.json

@@ -46,3 +46,4 @@ {

"adoptionTruth": { "$ref": "https://decantr.ai/schemas/adoption-truth.v1.json" },
"governanceDelta": { "$ref": "https://decantr.ai/schemas/governance-delta.v1.json" }
"governanceDelta": { "$ref": "https://decantr.ai/schemas/governance-delta.v1.json" },
"changeAssurance": { "$ref": "https://decantr.ai/schemas/change-assurance-report.v1.json" }
},

@@ -49,0 +50,0 @@ "additionalProperties": false

dist/index.d.ts

Sorry, the diff of this file is too big to display

dist/index.js

Sorry, the diff of this file is too big to display

dist/index.js.map

Sorry, the diff of this file is too big to display