import { describe, expect, it } from 'vitest';
import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
import { rm } from 'node:fs/promises';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { auditBuiltDist, auditProject, critiqueFile, critiqueSource, extractRouteHintsFromEssence } from '../src/index.js';

function createProjectRoot(): string {
  return mkdtempSync(join(tmpdir(), 'decantr-verifier-'));
}

function validV4Essence(): Record<string, unknown> {
  return {
    version: '4.0.0',
    dna: {
      theme: { id: 'existing', mode: 'auto', shape: 'rounded' },
      spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
      typography: { scale: 'system', heading_weight: 600, body_weight: 400 },
      color: { palette: 'existing', accent_count: 1, cvd_preference: 'auto' },
      radius: { philosophy: 'rounded', base: 8 },
      elevation: { system: 'existing', max_levels: 3 },
      motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
      accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: false },
      personality: ['observed brownfield app'],
    },
    blueprint: {
      shell: 'observed-existing-shell',
      features: [],
      sections: [
        {
          id: 'app',
          role: 'primary',
          shell: 'observed-existing-shell',
          features: [],
          description: 'Existing app',
          pages: [{ id: 'home', route: '/', layout: ['existing-surface'] }],
        },
      ],
      routes: { '/': { section: 'app', page: 'home' } },
    },
    meta: {
      archetype: 'observed-brownfield',
      target: 'react',
      platform: { type: 'spa', routing: 'history' },
      guard: { mode: 'guided', dna_enforcement: 'warn', blueprint_enforcement: 'warn' },
    },
  };
}

describe('verifier', () => {
  it('audits project contract and reports missing review packs', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          features: [],
          sections: [
            {
              id: 'marketing',
              role: 'public',
              shell: 'sidebar-main',
              features: [],
              description: 'Marketing surface',
              pages: [{ id: 'home', route: '/', layout: ['hero'] }],
            },
          ],
          routes: { '/': { section: 'marketing', page: 'home' } },
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'hash' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));

      const report = await auditProject(projectRoot);
      expect(report.valid).toBe(true);
      expect(report.summary.reviewPackPresent).toBe(false);
      expect(report.summary.runtimeAuditChecked).toBe(false);
      expect(report.runtimeAudit.distPresent).toBe(false);
      expect(report.findings.some(finding => finding.id === 'review-pack-file-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'pack-manifest-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-dist-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('recognizes Next build output when dist is absent', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, '.next', 'server', 'app'), { recursive: true });
      mkdirSync(join(projectRoot, '.next', 'static', 'chunks'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '3.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          pages: [{ id: 'home', route: '/', layout: ['hero'] }],
          features: [],
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'next', routing: 'pathname' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(join(projectRoot, '.next', 'BUILD_ID'), 'next-build\n');
      writeFileSync(join(projectRoot, '.next', 'build-manifest.json'), '{}\n');
      writeFileSync(
        join(projectRoot, '.next', 'server', 'app', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width"/><title>Next App</title></head><body></body></html>\n',
      );
      writeFileSync(join(projectRoot, '.next', 'static', 'chunks', 'app.js'), 'console.log("next");\n');

      const report = await auditProject(projectRoot);
      expect(report.summary.runtimeAuditChecked).toBe(true);
      expect(report.runtimeAudit.distPresent).toBe(true);
      expect(report.runtimeAudit.indexPresent).toBe(true);
      expect(report.runtimeAudit.assetCount).toBe(1);
      expect(report.findings.some(finding => finding.id === 'runtime-dist-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'runtime-index-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not require a Vite-style root mount for Next static document output', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', '_next', 'static'), { recursive: true });
      writeFileSync(join(projectRoot, 'package.json'), JSON.stringify({
        dependencies: { next: '^16.0.0', react: '^19.0.0', 'react-dom': '^19.0.0' },
      }, null, 2));
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify(validV4Essence(), null, 2));
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width"/><title>Next App</title><script src="/_next/static/app.js"></script></head><body><main>Rendered by Next</main></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', '_next', 'static', 'app.js'), 'console.log("next");\n');

      const report = await auditProject(projectRoot);

      expect(report.summary.runtimeAuditChecked).toBe(true);
      expect(report.runtimeAudit.rootDocumentOk).toBe(true);
      expect(report.findings.some((finding) => finding.id === 'runtime-root-document-invalid')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports missing or invalid essence contracts during project audit', async () => {
    const missingEssenceRoot = createProjectRoot();
    const invalidJsonRoot = createProjectRoot();
    const invalidSchemaRoot = createProjectRoot();
    try {
      const missingEssenceReport = await auditProject(missingEssenceRoot);
      expect(missingEssenceReport.valid).toBe(false);
      expect(missingEssenceReport.findings.some(finding => finding.id === 'essence-missing')).toBe(true);

      writeFileSync(join(invalidJsonRoot, 'decantr.essence.json'), '{ not-valid-json }\n');
      const invalidJsonReport = await auditProject(invalidJsonRoot);
      expect(invalidJsonReport.valid).toBe(false);
      expect(invalidJsonReport.findings.some(finding => finding.id === 'essence-parse-error')).toBe(true);

      writeFileSync(join(invalidSchemaRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: 'yes', skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          features: [],
          sections: [
            {
              id: 'marketing',
              role: 'public',
              shell: 'sidebar-main',
              features: [],
              description: 'Marketing surface',
              pages: [{ id: 'home', route: '/', layout: ['hero'] }],
            },
          ],
          routes: { '/': { section: 'marketing', page: 'home' } },
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'hash' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      const invalidSchemaReport = await auditProject(invalidSchemaRoot);
      expect(invalidSchemaReport.valid).toBe(false);
      expect(invalidSchemaReport.findings.some(finding => finding.id === 'essence-validation')).toBe(true);
    } finally {
      await rm(missingEssenceRoot, { recursive: true, force: true });
      await rm(invalidJsonRoot, { recursive: true, force: true });
      await rm(invalidSchemaRoot, { recursive: true, force: true });
    }
  });

  it('reports incomplete execution pack manifests during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, '.decantr', 'context'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          features: [],
          sections: [
            {
              id: 'marketing',
              role: 'public',
              shell: 'sidebar-main',
              features: [],
              description: 'Marketing surface',
              pages: [{ id: 'home', route: '/', layout: ['hero'] }],
            },
          ],
          routes: { '/': { section: 'marketing', page: 'home' } },
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'hash' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(join(projectRoot, '.decantr', 'context', 'pack-manifest.json'), JSON.stringify({
        $schema: 'https://decantr.ai/schemas/pack-manifest.v1.json',
        version: '1.0.0',
        generatedAt: '2026-04-09T00:00:00.000Z',
        scaffold: null,
        review: null,
        sections: [],
        pages: [],
        mutations: [],
      }, null, 2));

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'scaffold-pack-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'review-pack-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'mutation-packs-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports manifest-referenced pack files that are missing on disk', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, '.decantr', 'context'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify(validV4Essence(), null, 2));
      writeFileSync(join(projectRoot, '.decantr', 'context', 'pack-manifest.json'), JSON.stringify({
        $schema: 'https://decantr.ai/schemas/pack-manifest.v1.json',
        version: '1.0.0',
        generatedAt: '2026-05-14T00:00:00.000Z',
        scaffold: { id: 'scaffold', markdown: 'scaffold-pack.md', json: 'scaffold-pack.json' },
        review: { id: 'review', markdown: 'review-pack.md', json: 'review-pack.json' },
        sections: [],
        pages: [
          {
            id: 'home',
            markdown: 'page-home-pack.md',
            json: 'page-home-pack.json',
            sectionId: 'app',
            sectionRole: 'primary',
          },
        ],
        mutations: [],
      }, null, 2));
      writeFileSync(join(projectRoot, '.decantr', 'context', 'scaffold-pack.md'), '# Scaffold\n');
      writeFileSync(join(projectRoot, '.decantr', 'context', 'scaffold-pack.json'), '{}\n');
      writeFileSync(join(projectRoot, '.decantr', 'context', 'review-pack.md'), '# Review\n');
      writeFileSync(join(projectRoot, '.decantr', 'context', 'review-pack.json'), JSON.stringify({
        data: { focusAreas: ['route-topology'], routes: [] },
        antiPatterns: [],
        successChecks: [],
      }, null, 2));

      const report = await auditProject(projectRoot);

      const finding = report.findings.find((entry) => entry.id === 'pack-manifest-referenced-files-missing');
      expect(finding).toBeTruthy();
      expect(finding?.evidence.join('\n')).toContain('.decantr/context/page-home-pack.md');
      expect(finding?.evidence.join('\n')).toContain('.decantr/context/page-home-pack.json');
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not score contract-only critiques against Decantr treatments or decorators', () => {
    const report = critiqueSource({
      filePath: 'Button.tsx',
      code: 'export function Button() { return <button className="btn btn-primary">Save</button>; }',
      adoptionMode: 'contract-only',
    });

    expect(report.findings.some((finding) => finding.id === 'treatment-usage-missing')).toBe(false);
    expect(report.findings.some((finding) => finding.id === 'theme-consistency-weak')).toBe(false);
    expect(report.scores.find((score) => score.category === 'Styling Authority')?.details).toContain(
      'Contract-only/style-bridge adoption',
    );
  });

  it('does not recurse indefinitely while auditing Brownfield TSX source', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'app', 'intelligence'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify(validV4Essence(), null, 2));
      writeFileSync(
        join(projectRoot, 'app', 'intelligence', 'intelligence-handoff-builder.tsx'),
        `
          'use client';
          import { useEffect, useMemo, useState } from 'react';

          const handoffDispositions = [
            { id: 'ready', label: 'Ready', copy: 'Push to the next step' },
            { id: 'hold', label: 'Hold', copy: 'Keep refining' },
          ];

          function buildQuery(params: Record<string, string>) {
            const urlParams = new URLSearchParams({
              ...params,
              disposition: handoffDispositions.find((entry) => entry.id === params.mode)?.label ?? 'Ready',
            });
            return urlParams.toString();
          }

          export function IntelligenceHandoffBuilder() {
            const [goal, setGoal] = useState('');
            const selectedDisposition = handoffDispositions.find((entry) => entry.id === 'ready') ?? handoffDispositions[0];
            const readinessChecks = useMemo(() => [
              { id: 'goal', ready: goal.trim().length > 8 },
              { id: 'handoff', ready: selectedDisposition.label.length > 0 },
            ], [goal, selectedDisposition.label]);
            const activeCheck = readinessChecks.find((entry) => !entry.ready) ?? readinessChecks[0];

            useEffect(() => {
              const handleKeyDown = (event: KeyboardEvent) => {
                if (event.key === 'Enter') {
                  window.location.assign('/handoff?' + buildQuery({
                    goal,
                    mode: selectedDisposition.id,
                    active: activeCheck.id,
                  }));
                }
              };
              window.addEventListener('keydown', handleKeyDown);
              return () => window.removeEventListener('keydown', handleKeyDown);
            }, [activeCheck.id, goal, selectedDisposition.id, selectedDisposition.label]);

            return <button onClick={() => setGoal(goal + '!')}>{selectedDisposition.copy}</button>;
          }
        `,
      );

      await expect(auditProject(projectRoot)).resolves.toBeTruthy();
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('audits built dist output and reports runtime title failures', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          sections: [
            {
              id: 'main',
              role: 'primary',
              pages: [{ id: 'home', route: '/dashboard', layout: ['hero'] }],
            },
          ],
          features: [],
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'pathname' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html><head></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/dashboard");\n');

      const report = await auditProject(projectRoot);
      expect(report.summary.runtimeAuditChecked).toBe(true);
      expect(report.runtimeAudit.distPresent).toBe(true);
      expect(report.runtimeAudit.indexPresent).toBe(true);
      expect(report.runtimeAudit.passed).toBe(false);
      expect(report.runtimeAudit.routeHintsCoverageOk).toBe(true);
      expect(report.runtimeAudit.routeDocumentsCoverageOk).toBe(true);
      expect(report.runtimeAudit.fullRouteCoverageOk).toBe(true);
      expect(report.runtimeAudit.langOk).toBe(false);
      expect(report.runtimeAudit.viewportOk).toBe(false);
      expect(report.runtimeAudit.jsAssetBytes).toBeGreaterThan(0);
      expect(report.runtimeAudit.totalAssetBytes).toBeGreaterThan(0);
      expect(report.findings.some(finding => finding.id === 'runtime-title-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-lang-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-viewport-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-route-document-hardening-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports missing runtime index documents during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          sections: [
            {
              id: 'main',
              role: 'primary',
              pages: [{ id: 'home', route: '/dashboard', layout: ['hero'] }],
            },
          ],
          features: [],
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'pathname' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));

      const report = await auditProject(projectRoot);
      expect(report.runtimeAudit.distPresent).toBe(true);
      expect(report.runtimeAudit.indexPresent).toBe(false);
      expect(report.findings.some(finding => finding.id === 'runtime-index-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports broken built runtime baselines when the entry document omits assets, mount roots, and route surfaces', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          sections: [
            {
              id: 'main',
              role: 'primary',
              pages: [{ id: 'home', route: '/dashboard', layout: ['hero'] }],
            },
          ],
          features: [],
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'pathname' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><title>Broken App</title></head><body><main>Fallback shell only</main></body></html>\n',
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'runtime-root-document-invalid')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-assets-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-route-hints-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-route-documents-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-route-document-hardening-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports referenced asset fetch failures during runtime verification', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          sections: [
            {
              id: 'main',
              role: 'primary',
              pages: [{ id: 'home', route: '/dashboard', layout: ['hero'] }],
            },
          ],
          features: [],
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'pathname' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Asset Failure</title><link rel="stylesheet" href="/assets/app.css"><link rel="stylesheet" href="/assets/missing.css"></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script><script type="module" src="/assets/missing.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.css'), '.app{color:#111;}\n');
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/dashboard");\n');
      writeFileSync(join(projectRoot, 'dist', 'assets', 'missing.js'), '');

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'runtime-assets-fetch-failed')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports oversized built JavaScript bundles', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html><head><title>Large App</title><link rel="stylesheet" href="/assets/app.css"></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.css'), `.app{color:#111;}\n${'y'.repeat(200_000)}`);
      writeFileSync(
        join(projectRoot, 'dist', 'assets', 'app.js'),
        `console.log("/dashboard");\n${'x'.repeat(1_400_000)}`,
      );

      const report = await auditProject(projectRoot);
      expect(report.runtimeAudit.largestAssetPath).toBe('/assets/app.js');
      expect(report.runtimeAudit.largestAssetBytes).toBeGreaterThan(350_000);
      expect(report.runtimeAudit.jsAssetBytes).toBeGreaterThan(350_000);
      expect(report.runtimeAudit.cssAssetBytes).toBeGreaterThan(150_000);
      expect(report.runtimeAudit.totalAssetBytes).toBeGreaterThan(1_500_000);
      expect(report.findings.some(finding => finding.id === 'runtime-js-bundle-large')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-css-bundle-large')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-total-assets-large')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports document hardening risks in the built root document', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            features: [],
            sections: [
              {
                id: 'marketing',
                role: 'public',
                shell: 'sidebar-main',
                features: [],
                description: 'Marketing surface',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            routes: { '/': { section: 'marketing', page: 'home' } },
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>Secure-ish App</title><link rel="stylesheet" href="http://cdn.example.com/widget.css"><link rel="stylesheet" href="https://cdn.example.com/widget-safe.css" integrity="sha384-stylehash"><script>window.__BOOTSTRAP__ = true;</script><script src="http://cdn.example.com/widget.js"></script><script src="https://cdn.example.com/widget-safe.js" integrity="sha384-scripthash"></script></head><body onload="bootLegacy()"><a href="https://external.example.com" target="_blank">Docs</a><iframe src="http://legacy.example.com/embed" title="Legacy analytics"></iframe><img srcset="http://cdn.example.com/hero@2x.jpg 2x, https://cdn.example.com/hero.jpg 1x" alt="Legacy hero"><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'assets', 'app.js'),
        'eval("boot()"); document.write("<p>unsafe</p>"); fetch("http://legacy.example.com/api"); const devBase = "http://localhost:3000/api"; const leaked = "SUPABASE_SERVICE_ROLE_KEY"; const stripe = "sk_live_1234567890"; console.log("/");\n',
      );

      const report = await auditProject(projectRoot);
      expect(report.runtimeAudit.charsetOk).toBe(false);
      expect(report.runtimeAudit.cspSignalOk).toBe(false);
      expect(report.runtimeAudit.inlineScriptCount).toBe(1);
      expect(report.runtimeAudit.inlineEventHandlerCount).toBe(1);
      expect(report.runtimeAudit.externalScriptsWithoutIntegrityCount).toBe(1);
      expect(report.runtimeAudit.externalScriptsWithIntegrityMissingCrossoriginCount).toBe(1);
      expect(report.runtimeAudit.externalStylesheetsWithoutIntegrityCount).toBe(1);
      expect(report.runtimeAudit.externalStylesheetsWithIntegrityMissingCrossoriginCount).toBe(1);
      expect(report.runtimeAudit.externalScriptsWithInsecureTransportCount).toBe(1);
      expect(report.runtimeAudit.externalStylesheetsWithInsecureTransportCount).toBe(1);
      expect(report.runtimeAudit.externalMediaSourcesWithInsecureTransportCount).toBe(1);
      expect(report.runtimeAudit.externalBlankLinksWithoutRelCount).toBe(1);
      expect(report.runtimeAudit.externalIframesWithoutSandboxCount).toBe(1);
      expect(report.runtimeAudit.externalIframesWithInsecureTransportCount).toBe(1);
      expect(report.runtimeAudit.jsEvalSignalCount).toBe(1);
      expect(report.runtimeAudit.jsHtmlInjectionSignalCount).toBe(1);
      expect(report.runtimeAudit.jsInsecureTransportSignalCount).toBe(2);
      expect(report.runtimeAudit.jsSecretSignalCount).toBe(2);
      expect(report.findings.some(finding => finding.id === 'runtime-charset-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-inline-scripts-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-inline-event-handlers-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-scripts-without-integrity')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-scripts-crossorigin-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-stylesheets-without-integrity')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-stylesheets-crossorigin-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-scripts-insecure-transport')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-stylesheets-insecure-transport')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-media-insecure-transport')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-links-noopener-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-iframes-sandbox-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-external-iframes-insecure-transport')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-js-dynamic-code-signals')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-js-html-injection-signals')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-js-insecure-transport-signals')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-js-secret-signals')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-csp-signal-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('suppresses built-js risk markers when source files are present but do not corroborate them', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      mkdirSync(join(projectRoot, 'src'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'carbon-neon', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                shell: 'sidebar-main',
                features: [],
                description: 'Workspace',
                pages: [{ id: 'agents', route: '/agents', layout: ['hero'] }],
              },
            ],
            features: [],
            routes: {
              '/agents': { section: 'workspace', page: 'agents' },
            },
          },
          meta: {
            archetype: 'agent-marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'hash' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'App.tsx'),
        'export function App() { return <main id="main-content">ok</main>; }\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>App</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'assets', 'app.js'),
        'const vendorNoise = "innerHTML http://www.w3.org/2000/svg http://www.w3.org/1999/xlink localhost"; console.log("/agents");\n',
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'runtime-js-html-injection-signals')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'runtime-js-insecure-transport-signals')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports partial runtime route coverage when only some compiled routes survive the build output', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [
                  { id: 'home', route: '/', layout: ['hero'] },
                  { id: 'dashboard', route: '/dashboard', layout: ['hero'] },
                  { id: 'settings', route: '/settings', layout: ['hero'] },
                ],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Partial Routes</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/"); console.log("/dashboard");\n');
      writeFileSync(join(projectRoot, 'dist', 'dashboard'), '<!doctype html><html><body><p>bad route shell</p></body></html>\n');

      const report = await auditProject(projectRoot);
      expect(report.runtimeAudit.routeHintsChecked).toEqual(['/', '/dashboard', '/settings']);
      expect(report.runtimeAudit.routeHintsMatched).toBe(2);
      expect(report.runtimeAudit.routeHintsCoverageOk).toBe(false);
      expect(report.runtimeAudit.routeDocumentsPassed).toBe(2);
      expect(report.runtimeAudit.routeDocumentsCoverageOk).toBe(false);
      expect(report.runtimeAudit.fullRouteCoverageOk).toBe(false);
      expect(report.findings.some(finding => finding.id === 'runtime-route-hints-partial')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-route-documents-partial')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports auth-specific runtime route failures when gateway and primary routes do not return valid documents', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Auth Routes</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/login"); console.log("/dashboard");\n');
      writeFileSync(join(projectRoot, 'dist', 'login'), '<!doctype html><html><body><p>broken login route</p></body></html>\n');
      writeFileSync(join(projectRoot, 'dist', 'dashboard'), '<!doctype html><html><body><p>broken dashboard route</p></body></html>\n');

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'runtime-auth-gateway-routes-failed')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'runtime-auth-primary-routes-failed')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('aggregates source-level risk findings during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          'use client';

          export function Home() {
            const leaked = "sk_live_1234567890";
            const serviceRole = import.meta.env.VITE_SUPABASE_SERVICE_ROLE_KEY;
            localStorage.setItem('auth_token', token);
            document.cookie = \`auth_token=\${token}; path=/\`;
            fetch('/api/me', { headers: { Authorization: \`Bearer \${token}\` } });
            return (
              <form>
                <button>Save</button>
                <a href="#">Broken</a>
                <img src="/hero.png" />
                <div dangerouslySetInnerHTML={{ __html: html }} style={{ color: '#ff00ff' }} />
                <input type="password" />
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-inline-styles-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-security-risk-patterns-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-placeholder-route-targets-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-storage-writes-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-cookie-writes-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-header-writes-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-signals-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-signals-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-accessibility-issues-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-interaction-safety-issues-present')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-input-hints-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not report server-only auth headers as client-side header writes', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'app', 'dashboard', 'settings'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '3.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', 'dashboard', 'settings', 'actions.ts'),
        `
          'use server';

          export async function updateProfile(session: { access_token: string }) {
            const headers: Record<string, string> = {};
            headers.Authorization = \`Bearer \${session.access_token}\`;
            await fetch('/api/profile', { method: 'PATCH', headers });
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-header-writes-present')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('treats escaped JSON-LD script injection as a reviewed structured-data exception', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'components'), { recursive: true });
      writeFileSync(join(projectRoot, 'decantr.essence.json'), JSON.stringify({
        version: '4.0.0',
        dna: {
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
          typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
          color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
          radius: { philosophy: 'rounded', base: 8 },
          elevation: { system: 'layered', max_levels: 3 },
          motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
          accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
          personality: ['professional'],
        },
        blueprint: {
          shell: 'sidebar-main',
          features: [],
          sections: [
            {
              id: 'marketing',
              role: 'public',
              shell: 'sidebar-main',
              features: [],
              description: 'Marketing surface',
              pages: [{ id: 'home', route: '/', layout: ['hero'] }],
            },
          ],
          routes: { '/': { section: 'marketing', page: 'home' } },
        },
        meta: {
          archetype: 'marketing',
          target: 'react',
          platform: { type: 'spa', routing: 'hash' },
          guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
        },
      }, null, 2));
      writeFileSync(
        join(projectRoot, 'src', 'components', 'JsonLd.tsx'),
        `
          export function JsonLd({ data }: { data: unknown }) {
            return (
              <script
                type="application/ld+json"
                dangerouslySetInnerHTML={{
                  __html: JSON.stringify(data).replace(/</g, '\\\\u003c'),
                }}
              />
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-security-risk-patterns-present')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports insecure source transport endpoints before runtime review', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            features: [],
            sections: [
              {
                id: 'marketing',
                role: 'public',
                shell: 'sidebar-main',
                features: [],
                description: 'Marketing surface',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            routes: { '/': { section: 'marketing', page: 'home' } },
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            fetch('http://legacy.example.com/api/profile');
            const realtime = new WebSocket('ws://legacy.example.com/live');
            return <main id="main">Home {String(realtime.readyState)}</main>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-security-risk-patterns-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports local css runtime stubs and atoms.css fallbacks in source audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'lib'), { recursive: true });
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'carbon-neon', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['operational'],
          },
          blueprint: {
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                shell: 'sidebar-main',
                features: [],
                description: 'Workspace',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
            routes: {
              '/': { section: 'workspace', page: 'home' },
            },
          },
          meta: {
            archetype: 'agent-marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'hash' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'lib', 'css.js'),
        '/** Lightweight @decantr/css atom runtime for scaffold builds. */\nexport function css(...parts) { return parts.filter(Boolean).join(" "); }\n',
      );
      writeFileSync(join(projectRoot, 'src', 'styles', 'atoms.css'), '._flex{display:flex}\n');

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-local-css-runtime-stub-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('allows Decantr CSS-variable writes and dynamic geometry in inline style audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'clean', mode: 'light', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['polished'],
          },
          blueprint: {
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                shell: 'top-nav-main',
                features: [],
                description: 'Workspace',
                pages: [{ id: 'home', route: '/', layout: ['card-grid'] }],
              },
            ],
            features: [],
            routes: {
              '/': { section: 'workspace', page: 'home' },
            },
          },
          meta: {
            archetype: 'marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'history' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'AllowedStyles.tsx'),
        `
          export function AllowedStyles({ index, pos, scale }) {
            return (
              <main>
                <div style={{ ['--d-stagger-index' as never]: index } as React.CSSProperties} />
                <div style={{ left: \`\${pos.x}%\`, top: \`\${pos.y}%\`, transform: \`translate(\${pos.x}px, \${pos.y}px) scale(\${scale})\` }} />
              </main>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-inline-styles-present')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('still reports static inline visual styles in source audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'clean', mode: 'light', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['polished'],
          },
          blueprint: {
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                shell: 'top-nav-main',
                features: [],
                description: 'Workspace',
                pages: [{ id: 'home', route: '/', layout: ['card-grid'] }],
              },
            ],
            features: [],
            routes: {
              '/': { section: 'workspace', page: 'home' },
            },
          },
          meta: {
            archetype: 'marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'history' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'StaticStyles.tsx'),
        `
          export function StaticStyles() {
            return <main><div style={{ padding: '1rem', color: 'red' }} /></main>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-inline-styles-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports localhost-style source endpoints before runtime review', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            features: [],
            sections: [
              {
                id: 'marketing',
                role: 'public',
                shell: 'sidebar-main',
                features: [],
                description: 'Marketing surface',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            routes: { '/': { section: 'marketing', page: 'home' } },
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            const apiBase = 'http://localhost:3000/api';
            const streamBase = 'ws://127.0.0.1:4000/live';
            return <main id="main">{apiBase + streamBase}</main>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-localhost-endpoints-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not treat colocated test files as production source-audit drift', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify(validV4Essence(), null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'route.test.ts'),
        `
          export async function exercisesDevEndpoints() {
            document.write('<p>fixture</p>');
            eval('fixture()');
            return fetch('http://localhost:3000/api/test');
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return <main id="main">Production surface</main>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(
        report.findings.some(finding => finding.id === 'source-security-risk-patterns-present'),
      ).toBe(false);
      expect(
        report.findings.some(finding => finding.id === 'source-localhost-endpoints-present'),
      ).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports auth forms that default to GET semantics during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'supplementary',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Login.tsx'),
        `
          export function Login() {
            return (
              <form>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-security-risk-patterns-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing skip navigation signals when the essence contract requires skip nav', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return <main id="main-content">Hello</main>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-skip-nav-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag skip navigation when the source tree includes a skip link signal', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return (
              <>
                <a href="#main-content" className="skip-nav">Skip to content</a>
                <main id="main-content">Hello</main>
              </>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-skip-nav-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing main landmarks when skip navigation is required but no main target is present', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return (
              <>
                <a href="#main-content" className="skip-nav">Skip to content</a>
                <div id="main-content">Hello</div>
              </>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-skip-nav-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-main-landmark-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag main landmarks when skip navigation targets a main region', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return (
              <>
                <a href="#main-content" className="skip-nav">Skip to content</a>
                <section role="main" id="main-content">Hello</section>
              </>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-main-landmark-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags skip-link targets that do not match the main landmark id', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return (
              <>
                <a href="#main-content" className="skip-nav">Skip to content</a>
                <main id="primary-content">Hello</main>
              </>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-skip-nav-target-mismatch')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag skip-link targets when the main landmark id matches', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'pages'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'pages', 'Home.tsx'),
        `
          export function Home() {
            return (
              <>
                <a href="#main-content" className="skip-nav">Skip to content</a>
                <main id="main-content">Hello</main>
              </>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-skip-nav-target-mismatch')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing focus-visible style signals when the essence contract requires visible keyboard focus', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(join(projectRoot, 'src', 'styles', 'global.css'), 'button { outline: none; }\n');

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'style-focus-visible-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag focus-visible styles when the project CSS defines a focus-visible treatment', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'styles', 'global.css'),
        ':focus-visible { outline: 2px solid var(--d-primary); outline-offset: 2px; }\n',
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'style-focus-visible-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing reduced-motion style signals when the essence contract requires reduced motion', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'styles', 'global.css'),
        ':focus-visible { outline: 2px solid var(--d-primary); outline-offset: 2px; }\n',
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'style-reduced-motion-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag reduced-motion styles when the project CSS defines a reduce-motion path', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [{ id: 'home', route: '/', layout: ['hero'] }],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'styles', 'global.css'),
        `
          :focus-visible { outline: 2px solid var(--d-primary); outline-offset: 2px; }
          @media (prefers-reduced-motion: reduce) {
            * { animation: none !important; transition: none !important; }
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'style-reduced-motion-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports missing auth topology surfaces from the essence contract', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-gateway-section-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'auth-entry-route-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'auth-primary-section-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'auth-primary-routes-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports gateway sections whose pages do not declare explicit routes', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-gateway-routes-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports suspicious auth route placement in gateway and primary sections', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'entry', route: '/dashboard', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-gateway-routes-look-protected')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'auth-gateway-routes-not-auth-like')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'auth-primary-routes-look-auth-only')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'auth-primary-routes-not-app-like')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports overlapping auth routes between gateway and primary sections', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'login-app', route: '/login', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-gateway-primary-route-overlap')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag app-like primary routes such as /agents as missing post-auth destinations', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'carbon-neon', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['operational'],
          },
          blueprint: {
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                shell: 'centered',
                features: ['auth'],
                description: 'Auth entry',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'agents',
                role: 'primary',
                shell: 'sidebar-main',
                features: ['auth'],
                description: 'Agent workspace',
                pages: [{ id: 'agents', route: '/agents', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
            routes: {
              '/login': { section: 'gateway', page: 'login' },
              '/agents': { section: 'agents', page: 'agents' },
            },
          },
          meta: {
            archetype: 'agent-marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'hash' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-primary-routes-not-app-like')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag marketplace primary routes as missing post-auth destinations', async () => {
    const projectRoot = createProjectRoot();
    try {
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'clean', mode: 'light', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['marketplace'],
          },
          blueprint: {
            sections: [
              {
                id: 'auth-full',
                role: 'gateway',
                shell: 'centered',
                features: ['auth'],
                description: 'Auth entry',
                pages: [{ id: 'login', route: '/login', layout: ['auth-form'] }],
              },
              {
                id: 'listing-browser',
                role: 'primary',
                shell: 'top-nav-main',
                features: ['search', 'filters'],
                description: 'Marketplace discovery',
                pages: [
                  { id: 'browse', route: '/browse', layout: ['search-filter-bar', 'card-grid'] },
                  { id: 'listing-detail', route: '/listings/:id', layout: ['detail-header'] },
                  { id: 'search', route: '/search', layout: ['search-filter-bar'] },
                ],
              },
            ],
            features: ['auth', 'search', 'filters'],
            routes: {
              '/login': { section: 'auth-full', page: 'login' },
              '/browse': { section: 'listing-browser', page: 'browse' },
              '/listings/:id': { section: 'listing-browser', page: 'listing-detail' },
              '/search': { section: 'listing-browser', page: 'search' },
            },
          },
          meta: {
            archetype: 'two-sided-marketplace',
            target: 'react',
            platform: { type: 'spa', routing: 'history' },
            guard: { mode: 'strict', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'auth-primary-routes-not-app-like')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag missing auth guard signals when the source tree shows route protection behavior', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'ProtectedRoute.tsx'),
        `
          export function ProtectedRoute({ user, children }: { user: unknown; children: React.ReactNode }) {
            if (!user) {
              return redirect('/login');
            }
            return <>{children}</>;
          }

          export async function signOutUser() {
            await auth.signOut();
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth exit redirect gaps when logout returns users to an anonymous route', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      mkdirSync(join(projectRoot, 'lib'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'middleware.ts'),
        `
          export function middleware(request: { auth?: { user?: unknown } }) {
            if (!request.auth?.user) {
              return redirect('/login');
            }
            return NextResponse.next();
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'lib', 'auth.ts'),
        `
          export async function logout() {
            await auth.signOut();
            return redirect('/login');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth exit flows that redirect away without tearing down the session', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      mkdirSync(join(projectRoot, 'lib'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'UserMenu.tsx'),
        `
          export function UserMenu() {
            async function handleLogout() {
              return redirect('/login');
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth exit teardown gaps when logout explicitly signs out the session', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      mkdirSync(join(projectRoot, 'lib'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'lib', 'auth.ts'),
        `
          export async function logout() {
            await auth.signOut();
            return redirect('/login');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-teardown-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags client-managed auth persistence that is never cleared during project sign-out flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Session.tsx'),
        `
          export function SessionActions({ token }) {
            localStorage.setItem('auth_token', token);
            document.cookie = \`auth_token=\${token}; path=/\`;
            fetch('/api/me', { headers: { Authorization: \`Bearer \${token}\` } });

            async function handleLogout() {
              await auth.signOut();
              return redirect('/login');
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-storage-teardown-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-cookie-teardown-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-header-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags client data caches that are never cleared during project sign-out flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Session.tsx'),
        `
          import { useQueryClient } from '@tanstack/react-query';

          export function SessionActions() {
            const queryClient = useQueryClient();
            const { data: session } = useSession();

            async function handleLogout() {
              await auth.signOut();
              return redirect('/login');
            }

            if (!session) {
              return null;
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-cache-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth refresh timers that are never torn down during project sign-out flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Session.tsx'),
        `
          export function SessionActions() {
            const { data: session } = useSession();

            setInterval(() => auth.refreshSession(), 60_000);

            async function handleLogout() {
              await auth.signOut();
              return redirect('/login');
            }

            if (!session) {
              return null;
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-refresh-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags realtime channels that are never torn down during project sign-out flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Session.tsx'),
        `
          export function SessionActions() {
            const realtime = new WebSocket('wss://example.com/live');
            const { data: session } = useSession();

            async function handleLogout() {
              await auth.signOut();
              return redirect('/login');
            }

            if (!session) {
              return null;
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-realtime-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags cross-tab auth coordination that is never torn down during project sign-out flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Session.tsx'),
        `
          export function SessionActions() {
            const authChannel = new BroadcastChannel('auth');
            window.addEventListener('storage', syncSession);
            const { data: session } = useSession();

            async function handleLogout() {
              await auth.signOut();
              return redirect('/login');
            }

            if (!session) {
              return null;
            }

            return <button onClick={handleLogout}>Logout</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-coordination-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected session-aware surfaces that never branch on unauthenticated state during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-handling-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected session-aware surfaces that branch on auth loss but never return users to an anonymous route during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return null;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-redirect-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected session-aware surfaces that render protected shells inside loading branches during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <DashboardShell path="/dashboard" pendingSession={session} />;
            }

            if (!session) {
              return redirect('/login');
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth/session loading branches that return nothing during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return null;
            }

            if (!session) {
              return redirect('/login');
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-blank-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth/session loading branches that redirect to anonymous routes during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return redirect('/login');
            }

            if (!session) {
              return redirect('/login');
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-anonymous-redirect')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still render protected shells during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <DashboardShell path="/dashboard" />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected-looking unauthenticated shell renders even without explicit route props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <DashboardShell />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected-looking unauthenticated child renders even without explicit route props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <DashboardSummary />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still return outlet-like protected content during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Outlet />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that pass auth-scoped props into generic components during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <SummaryPanel currentUser={session?.user} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that pass auth-scoped props into generic components during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <SummaryPanel currentUser={session?.user} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still interpolate auth-scoped data into generic jsx during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <section>{session?.user?.email}</section>;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still interpolate auth-scoped data into generic jsx during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <section>{session?.user?.email}</section>;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route links inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <a href="/dashboard">Continue to dashboard</a>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected route links inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <a href="/dashboard">Continue to dashboard</a>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route actions inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <button onClick={() => navigate('/dashboard')}>Continue to dashboard</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected route actions inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <button onClick={() => navigate('/dashboard')}>Continue to dashboard</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected form actions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <form action="/dashboard">
                    <button type="submit">Continue to dashboard</button>
                  </form>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected form actions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <form action="/dashboard">
                    <button type="submit">Continue to dashboard</button>
                  </form>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected browser redirects inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <button onClick={() => window.location.assign('/dashboard')}>Continue to dashboard</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected browser redirects inside generic markup during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <button onClick={() => window.location.assign('/dashboard')}>Continue to dashboard</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still stash protected hidden redirects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <input type="hidden" name="redirectTo" value="/dashboard" />
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still stash protected hidden redirects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <input type="hidden" name="redirectTo" value="/dashboard" />
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still stash protected redirect metadata during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section data-redirect="/dashboard">
                  <p>Loading account context...</p>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still stash protected redirect metadata during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section data-next="/dashboard">
                  <p>Sign in again.</p>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still pass protected redirect props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard redirectTo="/dashboard" />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still pass protected redirect props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard returnTo="/dashboard" />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still pass protected redirect object props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard state={{ redirectTo: '/dashboard' }} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still pass protected redirect object props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard options={{ returnTo: '/dashboard' }} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still pass protected generic route objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard config={{ to: '/dashboard' }} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still pass protected generic route objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard config={{ path: '/dashboard' }} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still serialize protected route payloads during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={JSON.stringify({ redirectTo: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still serialize protected route payloads during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={JSON.stringify({ path: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still encode protected route payloads with URLSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={new URLSearchParams({ next: '/dashboard' }).toString()} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose raw URLSearchParams next payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={new URLSearchParams({ next: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still encode protected route payloads with URLSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={new URLSearchParams({ path: '/dashboard' }).toString()} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams route payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={new URLSearchParams({ path: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still encode protected route payloads with createSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={createSearchParams({ next: '/dashboard' }).toString()} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still encode protected route payloads with createSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={createSearchParams({ path: '/dashboard' }).toString()} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose raw createSearchParams route payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={createSearchParams({ next: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw createSearchParams path payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={createSearchParams({ path: '/dashboard' })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still encode auth-scoped payloads with JSON.stringify during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={JSON.stringify({ label: session?.user?.email })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still encode auth-scoped payloads with createSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={createSearchParams({ email: currentUser?.email }).toString()} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw createSearchParams auth payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={createSearchParams({ email: currentUser?.email })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose URLSearchParams payload objects in route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ payload: new URLSearchParams({ next: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams route payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: new URLSearchParams({ path: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose direct URLSearchParams auth payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard payload={new URLSearchParams({ email: currentUser?.email })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose raw URLSearchParams auth payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ payload: new URLSearchParams({ email: session?.user?.email }), href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams auth payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: new URLSearchParams({ email: currentUser?.email }), href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose raw URLSearchParams auth payload objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <StatusCard payload={new URLSearchParams({ email: session?.user?.email })} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route props through JSX expressions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Navigate to={'/dashboard'} replace />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ to: '/dashboard', label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose helper-generated protected route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { generatePath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ to: generatePath('/dashboard'), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose helper-prop route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ redirectTo: '/dashboard', label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose nested redirect state arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ state: { redirectTo: '/dashboard' }, label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose serialized redirect payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ payload: JSON.stringify({ redirectTo: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose auth-scoped data arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ label: session?.user?.email, href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose nested auth-scoped data arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ meta: { label: session?.user?.email }, href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose encoded auth-scoped payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ payload: JSON.stringify({ label: session?.user?.email }), href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected helper props through JSX expressions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard redirectTo={\`/dashboard\`} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ href: '/dashboard', label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose helper-generated protected route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createPath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ pathname: createPath({ pathname: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose helper-generated helper-prop route arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { generatePath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ returnTo: generatePath('/dashboard'), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose nested redirect state arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ options: { returnTo: '/dashboard' }, label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose encoded redirect payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: createSearchParams({ path: '/dashboard' }).toString(), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw createSearchParams route payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: createSearchParams({ path: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose raw createSearchParams next payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <QuickNav items={[{ payload: createSearchParams({ next: '/dashboard' }), label: 'Dashboard' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose auth-scoped data arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ label: currentUser?.email, href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose nested auth-scoped data arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ details: { subtitle: currentUser?.email }, href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose encoded auth-scoped payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: createSearchParams({ email: currentUser?.email }).toString(), href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose raw createSearchParams auth payload arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createSearchParams } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();
            const currentUser = session?.user;

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <Sidebar links={[{ payload: createSearchParams({ email: currentUser?.email }), href: '/login' }]} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route objects through pathname props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Navigate to={{ pathname: '/dashboard' }} replace />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected route objects through pathname props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard redirect={{ pathname: '/dashboard' }} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose protected route objects through callback navigation during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <button onClick={() => navigate({ pathname: '/dashboard' })}>Continue</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose protected route objects through callback navigation during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <button onClick={() => navigate({ pathname: '/dashboard' })}>Continue</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose helper-generated protected route props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { generatePath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Navigate to={generatePath('/dashboard')} replace />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose helper-generated protected route props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { generatePath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return <StatusCard redirectTo={generatePath('/dashboard')} />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose helper-generated protected callback destinations during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createPath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return (
                <section>
                  <button onClick={() => navigate(createPath({ pathname: '/dashboard' }))}>Continue</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose helper-generated protected callback destinations during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createPath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <button onClick={() => navigate(createPath({ pathname: '/dashboard' }))}>Continue</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth-loading branches that still expose helper-generated protected route objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { generatePath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Navigate to={{ pathname: generatePath('/dashboard') }} replace />;
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags unauthenticated branches that still expose helper-generated protected route objects through callback navigation during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              { id: 'gateway', role: 'gateway', pages: [{ id: 'login', route: '/login', layout: ['form'] }] },
              { id: 'workspace', role: 'primary', pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }] },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          import { createPath } from 'react-router-dom';

          export function DashboardGate() {
            const { status, data: session } = useSession();

            if (status === 'loading') {
              return <Spinner />;
            }

            if (!session) {
              return (
                <section>
                  <button onClick={() => navigate({ pathname: createPath({ pathname: '/dashboard' }) })}>Continue</button>
                </section>
              );
            }

            return <DashboardShell session={session} path="/dashboard" />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-session-loss-protected-render')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing auth entry signals when auth gateway routes exist but no entry surface is implemented', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-entry-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags protected surfaces that are not colocated with auth checks', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form method="post">
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'middleware.ts'),
        `
          export function middleware(request: { auth?: { user?: unknown } }) {
            if (!request.auth?.user) {
              return redirect('/login');
            }
            return NextResponse.next();
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardPage.tsx'),
        `
          export function DashboardPage() {
            return <a href="/dashboard">Open dashboard</a>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-protected-surface-auth-checks-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag Next App Router surfaces covered by guarded layouts', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'app', '(public)'), { recursive: true });
      mkdirSync(join(projectRoot, 'src', 'app', 'dashboard'), { recursive: true });
      mkdirSync(join(projectRoot, 'src', 'app', 'admin', 'moderation'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '3.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', '(public)', 'nav-header.tsx'),
        `
          export function NavHeader() {
            return <a href="/dashboard">Dashboard</a>;
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', 'dashboard', 'layout.tsx'),
        `
          export default async function DashboardLayout({ children }: { children: React.ReactNode }) {
            const session = await getServerSession();
            if (!session) {
              redirect('/login');
            }
            return <>{children}</>;
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', 'dashboard', 'page.tsx'),
        `
          export default function DashboardPage() {
            return <a href="/dashboard/settings">Settings</a>;
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', 'admin', 'layout.tsx'),
        `
          export default async function AdminLayout({ children }: { children: React.ReactNode }) {
            const session = await getServerSession();
            if (!session) {
              redirect('/login');
            }
            if (!isAdmin(session.user.email)) {
              notFound();
            }
            return <>{children}</>;
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'app', 'admin', 'moderation', 'actions.ts'),
        `
          'use server';

          export async function approveSubmission() {
            await requireAdminRequestContext();
            revalidatePath('/admin/moderation');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-protected-surface-auth-checks-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth guards that redirect to protected destinations during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGuard.tsx'),
        `
          export function DashboardGuard() {
            const { data: session } = useSession();
            if (!session) {
              return redirect('/dashboard');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-protected-redirect')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth flows that trust raw redirect query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            return redirect(searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth flows that trust raw URLSearchParams redirect params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            return redirect(new URLSearchParams(window.location.search).get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth flows that trust aliased raw URLSearchParams redirect params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(window.location.search).get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags link-driven query-param redirects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { Link } from 'react-router-dom';

          export function LoginRedirect({ searchParams }) {
            return <Link to={searchParams.get('next') ?? '/dashboard'}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags link-driven raw URLSearchParams redirects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { Link } from 'react-router-dom';

          export function LoginRedirect() {
            return <Link to={new URLSearchParams(window.location.search).get('next') ?? '/dashboard'}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags link-driven aliased raw URLSearchParams redirects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { Link } from 'react-router-dom';

          export function LoginRedirect() {
            const next = new URLSearchParams(window.location.search).get('next');
            return <Link to={next ?? '/dashboard'}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags browser-native auth redirects sourced from raw URLSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            window.location.assign(new URLSearchParams(window.location.search).get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags aliased browser-native auth redirects sourced from raw URLSearchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(window.location.search).get('next');
            window.location.href = next ?? '/dashboard';
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that alias the URLSearchParams container during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const params = new URLSearchParams(window.location.search);
            const next = params.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that alias a URL object searchParams carrier during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const url = new URL(window.location.href);
            const next = url.searchParams.get('next');
            window.location.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure location search carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const { search } = window.location;
            const next = new URLSearchParams(search).get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure location href URL carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const { href } = window.location;
            const url = new URL(href);
            const next = url.searchParams.get('next');
            window.location.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust globalThis location carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(globalThis.location.search).get('next');
            globalThis.location.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure globalThis location bases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const { location } = globalThis;
            const { href } = location;
            const url = new URL(href);
            const next = url.searchParams.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased location objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const browserLocation = window.location;
            const next = new URLSearchParams(browserLocation.search).get('next');
            browserLocation.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased global location href assignments during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const browserLocation = globalThis.location;
            const url = new URL(browserLocation.href);
            const next = url.searchParams.get('next');
            browserLocation.href = next ?? '/dashboard';
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust document location carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(document.location.search).get('next');
            document.location.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased document location objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const browserLocation = document.location;
            const next = new URLSearchParams(browserLocation.search).get('next');
            browserLocation.href = next ?? '/dashboard';
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust self location carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(self.location.search).get('next');
            self.location.assign(next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased parent location objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const frameLocation = parent.location;
            const next = new URLSearchParams(frameLocation.search).get('next');
            frameLocation.href = next ?? '/dashboard';
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bracketed self location carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const next = new URLSearchParams(self['location']['search']).get('next');
            self['location']['assign'](next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bracketed aliased frame location href assignments during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const frameLocation = parent['location'];
            const next = new URLSearchParams(frameLocation['search']).get('next');
            frameLocation['href'] = next ?? '/dashboard';
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bracketed location access through aliased browser bases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const browser = window;
            const next = new URLSearchParams(browser['location']['search']).get('next');
            browser['location']['assign'](next ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure URL searchParams carriers and alias query keys during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const { searchParams: params } = new URL(window.location.href);
            const queryKey = 'next';
            const next = params.get(queryKey);
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure query redirect params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const query = router.query;
            const { next: redirectTo } = query;
            return redirect(redirectTo ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that destructure query carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const { query: params } = router;
            return redirect(params.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that bracket-read aliased query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const query = router.query;
            const queryKey = 'next';
            const next = query[queryKey];
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that pass aliased query params through route objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const query = router.query;
            const queryKey = 'next';
            const next = query[queryKey];
            return navigate({ pathname: next ?? '/dashboard' });
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags link-driven auth redirects that pass aliased query params through route objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const query = router.query;
            const queryKey = 'next';
            const next = query[queryKey];
            return <Link to={{ pathname: next ?? '/dashboard' }}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust request URL search params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(request) {
            const url = new URL(request.url);
            const next = url.searchParams.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust req URL search params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            return redirect(new URL(req.url).searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust req nextUrl search params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            return redirect(req.nextUrl.searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust aliased req nextUrl search params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            const params = req.nextUrl.searchParams;
            const queryKey = 'next';
            return redirect(params.get(queryKey) ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust bracketed req nextUrl search-param getter calls during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            return redirect(req['nextUrl']['searchParams']['get']('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust req nextUrl aliases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            const nextUrl = req.nextUrl;
            return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that trust destructured req nextUrl aliases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export async function GET(req) {
            const { nextUrl } = req;
            return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that wrap query params in URL constructors during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { NextResponse } from 'next/server';

          export async function GET(req) {
            const next = req.nextUrl.searchParams.get('next');
            return NextResponse.redirect(new URL(next ?? '/dashboard', req.url));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags server auth redirects that wrap query params in URL constructors with aliased req urls during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { NextResponse } from 'next/server';

          export async function GET(req) {
            const requestUrl = req.url;
            const next = req.nextUrl.searchParams.get('next');
            return NextResponse.redirect(new URL(next ?? '/dashboard', requestUrl));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct searchParams props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            return redirect(searchParams.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased indexed searchParams props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect(props) {
            const { searchParams: params } = props;
            const queryKey = 'next';
            return <Link to={{ pathname: params[queryKey] ?? '/dashboard' }}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust parameter-aliased searchParams props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams: params }) {
            return redirect(params.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust optional searchParams getter props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            return redirect(searchParams?.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound searchParams getter helpers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const readRedirect = searchParams.get.bind(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust local arrow helper readers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const readRedirect = (key) => searchParams.get(key);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust object helper methods during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const helpers = {
              readRedirect(key) {
                return searchParams.get(key);
              },
            };

            return redirect(helpers.readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured object helper methods during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const helpers = {
              readRedirect(key) {
                return searchParams.get(key);
              },
            };
            const { readRedirect } = helpers;

            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust nested object helper methods during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const helpers = {
              redirect: {
                readRedirect(key) {
                  return searchParams.get(key);
                },
              },
            };

            return redirect(helpers.redirect.readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured nested helper objects during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const helpers = {
              redirect: {
                readRedirect(key) {
                  return searchParams.get(key);
                },
              },
            };
            const { redirect: redirectHelpers } = helpers;

            return redirect(redirectHelpers.readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust object helper factories during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createRedirectHelpers(searchParams) {
            return {
              readRedirect(key) {
                return searchParams.get(key);
              },
            };
          }

          export function LoginRedirect({ searchParams }) {
            const helpers = createRedirectHelpers(searchParams);
            return redirect(helpers.readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured helper-factory methods during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createRedirectHelpers(searchParams) {
            return {
              readRedirect(key) {
                return searchParams.get(key);
              },
            };
          }

          export function LoginRedirect({ searchParams }) {
            const { readRedirect } = createRedirectHelpers(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust renamed helper-factory params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createRedirectHelpers(params) {
            return {
              readRedirect(key) {
                return params.get(key);
              },
            };
          }

          export function LoginRedirect({ searchParams }) {
            const helpers = createRedirectHelpers(searchParams);
            return redirect(helpers.readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured renamed helper-factory params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createRedirectHelpers(params) {
            return {
              readRedirect(key) {
                return params.get(key);
              },
            };
          }

          export function LoginRedirect({ searchParams }) {
            const { readRedirect } = createRedirectHelpers(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust function helper factories with renamed params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased function helper factories with renamed params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const getRedirectFromQuery = (key) => params.get(key);
            return getRedirectFromQuery;
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures through call wrappers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures through apply wrappers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.apply(null, ['next']) ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures through apply wrappers with aliased args during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            const redirectArgs = ['next'];
            return redirect(readRedirect.apply(null, redirectArgs) ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures through Reflect.apply wrappers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(Reflect.apply(readRedirect, null, ['next']) ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures through Reflect.apply wrappers with aliased args during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            const redirectArgs = ['next'];
            return redirect(Reflect.apply(readRedirect, null, redirectArgs) ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams).bind(null);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with at() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).at(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with at() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).at(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with shift() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).shift();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with shift() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).shift();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with pop() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).pop();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with pop() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).pop();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with find() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).find(Boolean);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with find() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).find(Boolean);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with findLast() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).findLast(Boolean);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with findLast() during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).findLast(Boolean);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over sliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).slice(-1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over sliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).slice(-1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over reversed repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).reverse()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over reversed repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).reverse()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over non-mutating reversed repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toReversed()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating reversed repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toReversed()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over sorted repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).sort()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over sorted repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).sort()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over non-mutating sorted repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toSorted()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating sorted repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toSorted()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over Array.from wrapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Array.from(params.getAll(key))[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over Array.from wrapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Array.from(params.getAll(key))[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over spread wrapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => [...params.getAll(key)][0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over spread wrapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => [...params.getAll(key)][0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over concatenated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).concat()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over concatenated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).concat()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over flattened repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).flat()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over flattened repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).flat()[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over flat-mapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).flatMap((value) => [value])[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over flat-mapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).flatMap((value) => [value])[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over mapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).map((value) => value)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over mapped repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).map((value) => value)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over spliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).splice(0, 1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over spliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).splice(0, 1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over non-mutating spliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toSpliced(0, 1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating spliced repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).toSpliced(0, 1)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over iterated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).values().next().value;
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over iterated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).values().next().value;
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over entry-iterated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).entries().next().value[1];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over entry-iterated repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).entries().next().value[1];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trim();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trim();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust replaced returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].replace(/^\\/+/, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped replaced returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].replace(/^\\/+/, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust replace-all returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].replaceAll('//', '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped replace-all returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].replaceAll('//', '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust substring returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].substring(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped substring returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].substring(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust substr returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].substr(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped substr returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].substr(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust lowercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLowerCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped lowercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLowerCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust uppercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toUpperCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped uppercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toUpperCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust locale-lowercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLocaleLowerCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped locale-lowercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLocaleLowerCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust locale-uppercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLocaleUpperCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped locale-uppercased returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLocaleUpperCase();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust normalized returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].normalize();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped normalized returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].normalize();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust left-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimStart();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped left-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimStart();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust right-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimEnd();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped right-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimEnd();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust legacy-left-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimLeft();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped legacy-left-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimLeft();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust legacy-right-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimRight();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped legacy-right-trimmed returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].trimRight();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust left-padded returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].padStart(12, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped left-padded returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].padStart(12, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust right-padded returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].padEnd(12, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped right-padded returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].padEnd(12, '/');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].repeat(1);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].repeat(1);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust split repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].split('?')[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust stringified repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toString();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust String-wrapped repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => String(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust value-unwrapped repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].valueOf();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust sliced repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].slice(0);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust locale-stringified repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toLocaleString();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust split-joined repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].split('?').join('?');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust matched repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].match(/^[^?]+/)?.[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust matchAll-normalized repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].matchAll(/^[^?]+/g).next().value?.[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust well-formed repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0].toWellFormed();
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust regex-exec repeated-string returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => /^[^?]+/.exec(params.getAll(key)[0])?.[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reduced repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).reduce((_, value) => value);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust nullish-fallback repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key)[0] ?? '/dashboard';
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust ternary repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => key === 'default' ? '/dashboard' : params.getAll(key)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust template-wrapped repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => \`\${params.getAll(key)[0]}\`;
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust tagged-template repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => String.raw\`\${params.getAll(key)[0]}\`;
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => decodeURIComponent(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => window.decodeURIComponent(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const decodeRedirect = window.decodeURIComponent.bind(window);
            return (key) => decodeRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => window.decodeURIComponent.call(window, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global legacy URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const decodeRedirect = window.unescape.bind(window);
            return (key) => decodeRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => window.String(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => String(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const stringifyRedirect = window.String.bind(window);
            return (key) => stringifyRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Reflect.apply(globalThis.String, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured constructor-style browser-global stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { String: StringCtor } = globalThis;
            return (key) => new StringCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound JSON.parse repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const parseRedirect = JSON.parse.bind(JSON);
            return (key) => parseRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust constructor-style browser-global stringified repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => new globalThis.String(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust object-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => new globalThis.Object(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured object-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { Object: ObjectCtor } = globalThis;
            return (key) => ObjectCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct browser-global object repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Object(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global object repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Object.bind(globalThis);
            return (key) => readRedirectValue(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global number repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Number.bind(globalThis);
            return (key) => readRedirectValue(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global number repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Number;
            return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust apply-based browser-global number repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Number;
            return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct browser-global number repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Number(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global number-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => new globalThis.Number(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured browser-global number-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { Number: NumberCtor } = globalThis;
            return (key) => NumberCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global object repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Object;
            return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust apply-based browser-global object repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Object;
            return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected browser-global object repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Object;
            return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected browser-global number repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Number;
            return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global boolean-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => new globalThis.Boolean(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured browser-global boolean-boxed repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { Boolean: BooleanCtor } = globalThis;
            return (key) => BooleanCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct browser-global boolean repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Boolean(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global boolean repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Boolean.bind(globalThis);
            return (key) => readRedirectValue(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global boolean repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Boolean;
            return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.BigInt.bind(globalThis);
            return (key) => readRedirectValue(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.BigInt;
            return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { BigInt: BigIntCtor } = globalThis;
            return (key) => BigIntCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => BigInt(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Symbol.bind(globalThis);
            return (key) => readRedirectValue(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { Symbol: SymbolCtor } = globalThis;
            return (key) => SymbolCtor(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust direct browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Symbol(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust apply-based browser-global boolean repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Boolean;
            return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected browser-global boolean repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Boolean;
            return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.BigInt;
            return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Symbol;
            return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust apply-based browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Symbol;
            return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust apply-based browser-global bigint repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.BigInt;
            return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected browser-global symbol repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const readRedirectValue = globalThis.Symbol;
            return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based JSON.parse repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => JSON.parse.call(JSON, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected JSON.parse repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const parseRedirect = JSON.parse;
            return (key) => {
              const parseArgs = [params.getAll(key)[0]];
              return Reflect.apply(parseRedirect, JSON, parseArgs);
            };
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured JSON.parse repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { parse } = JSON;
            return (key) => parse(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound JSON.stringify repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const stringifyRedirect = JSON.stringify.bind(JSON);
            return (key) => stringifyRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based JSON.stringify repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => JSON.stringify.call(JSON, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected JSON.stringify repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const stringifyRedirect = JSON.stringify;
            return (key) => {
              const stringifyArgs = [params.getAll(key)[0]];
              return Reflect.apply(stringifyRedirect, JSON, stringifyArgs);
            };
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured JSON.stringify repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { stringify } = JSON;
            return (key) => stringify(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound structuredClone repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const cloneRedirect = globalThis.structuredClone.bind(globalThis);
            return (key) => cloneRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapper-based structuredClone repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => globalThis.structuredClone.call(globalThis, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust reflected structuredClone repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const cloneRedirect = globalThis.structuredClone;
            return (key) => {
              const cloneArgs = [params.getAll(key)[0]];
              return Reflect.apply(cloneRedirect, globalThis, cloneArgs);
            };
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured structuredClone repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const { structuredClone: cloneRedirect } = globalThis;
            return (key) => cloneRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust base64-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => atob(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust Buffer-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Buffer.from(params.getAll(key)[0], 'base64').toString('utf8');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased Buffer.from repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const decodeRedirect = Buffer.from;
            return (key) => decodeRedirect(params.getAll(key)[0], 'base64').toString('utf8');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust global-object Buffer.from repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => globalThis.Buffer.from(params.getAll(key)[0], 'base64').toString('utf8');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust Buffer.from call wrappers over repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => Buffer.from.call(Buffer, params.getAll(key)[0], 'base64').toString('utf8');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound Buffer.from repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const decodeRedirect = Buffer.from.bind(Buffer);
            return (key) => decodeRedirect(params.getAll(key)[0], 'base64').toString('utf8');
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global base64-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => window.atob(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound browser-global base64-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            const decodeRedirect = window.atob.bind(window);
            return (key) => decodeRedirect(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust browser-global base64 call wrappers over repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => window.atob.call(window, params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust legacy URI-decoded repeated-query returned helper closures during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => unescape(params.getAll(key)[0]);
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next'));
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust returned helper closures over filtered repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).filter(Boolean)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust wrapped returned helper closures over filtered repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function createReadRedirect(params) {
            return (key) => params.getAll(key).filter(Boolean)[0];
          }

          export function LoginRedirect({ searchParams }) {
            const readRedirect = createReadRedirect(searchParams);
            return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust local function helper readers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          function readRedirect(searchParams, key) {
            return searchParams.get(key);
          }

          export function LoginRedirect({ searchParams }) {
            return redirect(readRedirect(searchParams, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust searchParams getter call wrappers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { get } = searchParams;
            return redirect(get.call(searchParams, 'next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust optional query property carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const query = Object.fromEntries(new URLSearchParams(window.location.search));
            return redirect(query?.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bracketed searchParams getter props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            return redirect(searchParams['get']('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust nested destructured searchParams props during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams: { next } }) {
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bracketed router push transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router, searchParams }) {
            router['push'](searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased router push transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const { push } = useRouter();
            push(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust optional router push transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            router?.push(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust router push call transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            router.push.call(router, searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased router replace apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            const navigate = router.replace;
            navigate.apply(router, [searchParams.get('next') ?? '/dashboard']);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased router apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            const navigate = router.replace;
            const args = [searchParams.get('next') ?? '/dashboard'];
            navigate.apply(router, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust router Reflect.apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            Reflect.apply(router.replace, router, [searchParams.get('next') ?? '/dashboard']);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust router Reflect.apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            const args = [searchParams.get('next') ?? '/dashboard'];
            Reflect.apply(router.replace, router, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound router replace transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect({ searchParams }) {
            const router = useRouter();
            const navigate = router.replace.bind(router);
            navigate(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust history replaceState call transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            history.replaceState.call(history, {}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust history Reflect.apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const args = [{}, '', searchParams.get('next') ?? '/dashboard'];
            Reflect.apply(history.replaceState, history, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust location assign call transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            window.location.assign.call(window.location, searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust location Reflect.apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            Reflect.apply(window.location.assign, window.location, [searchParams.get('next') ?? '/dashboard']);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust window open apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            window.open.apply(window, [searchParams.get('next') ?? '/dashboard', '_self']);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust location Reflect.apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const args = [searchParams.get('next') ?? '/dashboard'];
            Reflect.apply(window.location.assign, window.location, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust window open Reflect.apply transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            Reflect.apply(window.open, window, [searchParams.get('next') ?? '/dashboard', '_self']);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust window open Reflect.apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const args = [searchParams.get('next') ?? '/dashboard', '_self'];
            Reflect.apply(window.open, window, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased history apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const updateHistory = history.replaceState;
            const args = [{}, '', searchParams.get('next') ?? '/dashboard'];
            updateHistory.apply(history, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased location apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const navigate = window.location.assign;
            const args = [searchParams.get('next') ?? '/dashboard'];
            navigate.apply(window.location, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased window open apply argument arrays during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const popup = window.open;
            const args = [searchParams.get('next') ?? '/dashboard', '_self'];
            popup.apply(window, args);
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust history replaceState transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const browserHistory = window.history;
            browserHistory.replaceState({}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased history replaceState transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const updateHistory = history.replaceState;
            updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured history pushState transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { pushState: updateHistory } = window.history;
            updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound history replaceState transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const updateHistory = history.replaceState.bind(history);
            updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured bound history pushState transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { pushState } = window.history;
            const updateHistory = pushState.bind(window.history);
            updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust window.open transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            window.open(searchParams.get('next') ?? '/dashboard', '_self');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased window.open transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const popup = window.open;
            popup(searchParams.get('next') ?? '/dashboard', '_self');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured window.open transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { open: popup } = window;
            popup(searchParams.get('next') ?? '/dashboard', '_self');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased location.assign transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const navigate = window.location.assign;
            navigate(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust optional location assign transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            window.location?.assign(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured location.replace transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { replace: navigate } = window.location;
            navigate(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust bound location.assign transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const navigate = window.location.assign.bind(window.location);
            navigate(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured bound location.replace transitions during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const { replace } = window.location;
            const navigate = replace.bind(window.location);
            navigate(searchParams.get('next') ?? '/dashboard');
            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased useSearchParams hook carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useSearchParams } from 'react-router-dom';

          export function LoginRedirect() {
            const params = useSearchParams();
            return redirect(params.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust tuple-destructured useSearchParams hook carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useSearchParams } from 'react-router-dom';

          export function LoginRedirect() {
            const [params] = useSearchParams();
            return redirect(params.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased useRouter hook query carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect() {
            const appRouter = useRouter();
            return redirect(appRouter.query.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust helper-wrapped query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const next = decodeURIComponent(searchParams.get('next') ?? '/dashboard');
            return redirect(next);
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust repeated query params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            const next = searchParams.getAll('next')[0];
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased useLocation hook carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useLocation } from 'react-router-dom';

          export function LoginRedirect() {
            const routeLocation = useLocation();
            const next = new URLSearchParams(routeLocation.search).get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured useLocation hook search carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useLocation } from 'react-router-dom';

          export function LoginRedirect() {
            const { search } = useLocation();
            const next = new URLSearchParams(search).get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust cloned nextUrl carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const nextUrl = req.nextUrl.clone();
            return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased cloned nextUrl searchParams during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const params = req.nextUrl.clone().searchParams;
            const next = params.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust nextUrl search-string carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const next = new URLSearchParams(req.nextUrl.search).get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust nextUrl href carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const nextUrl = req.nextUrl.clone();
            const next = new URL(nextUrl.href).searchParams.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust stringified nextUrl carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const next = new URL(req.nextUrl.toString()).searchParams.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust String-wrapped nextUrl carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const nextUrl = req.nextUrl.clone();
            const next = new URL(String(nextUrl)).searchParams.get('next');
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust Object.fromEntries query carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const query = Object.fromEntries(req.nextUrl.searchParams);
            return redirect(query.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust destructured Object.fromEntries query carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const { next } = Object.fromEntries(new URLSearchParams(window.location.search));
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased searchParams entries in Object.fromEntries during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const entries = new URLSearchParams(window.location.search).entries();
            const query = Object.fromEntries(entries);
            return redirect(query.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust Array.from wrapped entries in Object.fromEntries during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const entries = Array.from(new URLSearchParams(window.location.search).entries());
            const query = Object.fromEntries(entries);
            return redirect(query.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust spread wrapped searchParams iterables in Object.fromEntries during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const query = Object.fromEntries([...new URLSearchParams(window.location.search)]);
            return redirect(query.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust normalized location search carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const params = new URLSearchParams(window.location.search.slice(1));
            return redirect(params.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust normalized nextUrl search carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function middleware(req) {
            const params = new URLSearchParams(req.nextUrl.search.slice(1));
            return redirect(params.get('next') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust aliased destructured useRouter query carriers during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          import { useRouter } from 'next/router';

          export function LoginRedirect() {
            const { query: params } = useRouter();
            return redirect(params.next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust template-wrapped query aliases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const next = router.query.next;
            return redirect(\`\${next ?? '/dashboard'}\`);
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust template-wrapped searchParams props in JSX during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams: { next } }) {
            return <Link to={\`\${next ?? '/dashboard'}\`}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust snake-case search param keys during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ searchParams }) {
            return redirect(searchParams.get('return_to') ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust snake-case query aliases during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect({ router }) {
            const queryKey = 'redirect_to';
            return <Link to={{ pathname: router.query[queryKey] ?? '/dashboard' }}>Continue</Link>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth redirects that trust snake-case callback URL params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            const queryKey = 'callback_url';
            const next = new URLSearchParams(window.location.search).get(queryKey);
            return redirect(next ?? '/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-open-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth flows that redirect directly to external URLs during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginRedirect.tsx'),
        `
          export function LoginRedirect() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/continue');
            }

            return <button onClick={handleSubmit}>Sign in</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-external-redirect-risk')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags provider authorize URLs without state during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-state-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag provider authorize URLs when state is present during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-state-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags provider code-flow URLs without PKCE during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-pkce-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag provider code-flow URLs when PKCE is present during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123&code_challenge=pkce123&code_challenge_method=S256');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-pkce-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags provider id_token URLs without nonce during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=id_token&state=opaque123');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-nonce-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag provider id_token URLs when nonce is present during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginProvider.tsx'),
        `
          export function LoginProvider() {
            async function handleSubmit() {
              await auth.signIn();
              return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=id_token&state=opaque123&nonce=nonce123');
            }

            return <button onClick={handleSubmit}>Sign in with SSO</button>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-provider-nonce-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback flows that never scrub URL codes during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            return <p>Signing you in…</p>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-url-scrub-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback flows that never handle provider error returns during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            return <p>Signing you in…</p>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-error-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback flows when provider error returns are handled during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const providerError = searchParams.get('error');
            if (providerError) {
              return <p>Authentication failed. Please try again.</p>;
            }

            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-error-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback flows that read provider state without validating it during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const state = searchParams.get('state');
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            return <p data-state={state}>Signing you in…</p>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-state-validation-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback flows when provider state is validated during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const returnedState = searchParams.get('state');
            const expectedState = sessionStorage.getItem('oauth_state');
            if (!returnedState || returnedState !== expectedState) {
              return <p>Authentication failed. Please try again.</p>;
            }

            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-state-validation-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback flows that validate provider state but never clear stored state during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const returnedState = searchParams.get('state');
            const expectedState = sessionStorage.getItem('oauth_state');
            if (!returnedState || returnedState !== expectedState) {
              return <p>Authentication failed. Please try again.</p>;
            }

            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-state-teardown-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback flows when stored provider state is cleared during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const returnedState = searchParams.get('state');
            const expectedState = sessionStorage.getItem('oauth_state');
            if (!returnedState || returnedState !== expectedState) {
              sessionStorage.removeItem('oauth_state');
              return <p>Authentication failed. Please try again.</p>;
            }

            sessionStorage.removeItem('oauth_state');
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-state-teardown-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback failure handling that never routes back to sign-in during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const providerError = searchParams.get('error');
            if (providerError) {
              return <p>Authentication failed. Please try again.</p>;
            }

            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-entry-return-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback failure handling when it routes back to sign-in during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const providerError = searchParams.get('error');
            if (providerError) {
              return <a href="/login">Back to sign in</a>;
            }

            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-entry-return-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback flows that never surface success state or protected transition during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            return <p>Signing you in...</p>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-success-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback flows when they transition into a protected route during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-success-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback exchanges without explicit rejection handling during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-exchange-error-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback exchanges when rejection handling is explicit during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code).catch(() => {
                toast.error('Unable to sign you in.');
              });
            }

            history.replaceState({}, '', '/dashboard');
            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-exchange-error-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback exchange failures that never route back to sign-in during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code).catch(() => {
                toast.error('Unable to sign you in.');
              });
            }

            return <p>Still working…</p>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-entry-return-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback exchange failures when they route back to sign-in during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code).catch(() => {
                history.replaceState({}, '', '/login');
              });
            }

            return <a href="/login">Back to sign in</a>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-entry-return-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback flows when callback URLs are scrubbed during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const code = searchParams.get('code');
            if (code) {
              void auth.exchangeCodeForSession(code);
              history.replaceState({}, '', '/dashboard');
            }

            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-url-scrub-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth callback error returns that never scrub provider params during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const providerError = searchParams.get('error');
            if (providerError) {
              return <a href="/login">Back to sign in</a>;
            }

            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-url-scrub-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth callback error returns when provider params are scrubbed during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'callback', route: '/auth/callback', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback({ searchParams }) {
            const providerError = searchParams.get('error');
            if (providerError) {
              history.replaceState({}, '', '/login');
              return <a href="/login">Back to sign in</a>;
            }

            return null;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-callback-url-scrub-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag protected surfaces when session checks live in the same file', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form method="post">
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (!session) {
              return redirect('/login');
            }
            return <a href="/dashboard">Open dashboard</a>;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-protected-surface-auth-checks-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags missing auth entry surfaces when auth exists but no gateway or credential surface is implemented', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-entry-surface-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth forms without submit controls during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'Login.tsx'),
        `
          export function Login() {
            return (
              <form method="post">
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="current-password" />
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-interaction-safety-issues-present')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth entry signals when the gateway surface includes a real credential form', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-entry-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth entry surfaces that never route into the protected app after success', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            async function handleSubmit(event) {
              event.preventDefault();
              await auth.signIn();
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth entry success redirects when an explicit success state is present', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            const [successMessage, setSuccessMessage] = useState('');

            async function handleSubmit(event) {
              event.preventDefault();
              await auth.signIn();
              setSuccessMessage('Account created');
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="current-password" />
                {successMessage ? <p role="status">{successMessage}</p> : null}
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags project auth surfaces when a declared recovery route is never linked from sign-in flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['hero'] },
                  { id: 'forgot-password', route: '/forgot-password', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-recovery-route-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag project auth recovery gaps when sign-in flows link to the declared recovery route', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['hero'] },
                  { id: 'forgot-password', route: '/forgot-password', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <a href="/forgot-password">Forgot password?</a>
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-recovery-route-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags project auth surfaces when a declared registration route is never linked from sign-in flows', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['hero'] },
                  { id: 'register', route: '/register', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-registration-route-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags project auth surfaces when registration or recovery flows never link back to a declared sign-in route', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['hero'] },
                  { id: 'register', route: '/register', layout: ['form'] },
                  { id: 'forgot-password', route: '/forgot-password', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'RegisterPage.tsx'),
        `
          export function RegisterPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="new-password" />
                <button type="submit">Create account</button>
              </form>
            );
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'ForgotPasswordPage.tsx'),
        `
          export function ForgotPasswordPage() {
            return (
              <form>
                <input type="email" autoComplete="email" />
                <button type="submit">Send reset link</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-signin-route-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth entry surfaces when success redirects into the protected app', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            async function handleSubmit(event) {
              event.preventDefault();
              await auth.signIn();
              return redirect('/dashboard');
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth session handling that does not expose a loading or pending state', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { data: session } = useSession();
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth loading signals when the same session-aware surface exposes a pending state', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth loading signals when callback surfaces show explicit pending copy during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'callback', route: '/auth/callback', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'AuthCallback.tsx'),
        `
          export function AuthCallback() {
            const { data: session } = useSession();
            if (!session) {
              return <p>Signing you in...</p>;
            }

            return redirect('/dashboard');
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-loading-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags auth flows that expose no obvious error or failure state', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            return (
              <form method="post">
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                <button type="submit">Sign in</button>
              </form>
            );
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-error-signals-missing')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag auth error signals when auth flows expose failure handling', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['form'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'LoginPage.tsx'),
        `
          export function LoginPage() {
            const [formError, setFormError] = useState<string | null>(null);

            async function handleSubmit() {
              try {
                await signIn();
              } catch (error) {
                setFormError('Unable to sign in');
              }
            }

            return (
              <form method="post">
                <input type="email" autoComplete="email" />
                <input type="password" autoComplete="current-password" />
                {formError ? <p role="alert">{formError}</p> : null}
                <button type="submit" onClick={handleSubmit}>Sign in</button>
              </form>
            );
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'DashboardGate.tsx'),
        `
          export function DashboardGate() {
            const { status, data: session } = useSession();
            if (status === 'loading') {
              return <Spinner />;
            }
            if (status === 'error') {
              return <Alert>Session unavailable</Alert>;
            }
            if (!session) {
              return redirect('/login');
            }
            return <Dashboard />;
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-error-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags recovery flows that omit a visible success confirmation during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'forgot-password', route: '/forgot-password', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'ForgotPasswordPage.tsx'),
        `
          export function ForgotPasswordPage() {
            async function handleSubmit(event) {
              event.preventDefault();
              await requestPasswordReset();
              return redirect('/login');
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <button type="submit">Reset password</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-recovery-success-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag recovery success gaps when project auth flows show confirmation state', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'forgot-password', route: '/forgot-password', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'ForgotPasswordPage.tsx'),
        `
          export function ForgotPasswordPage() {
            const [successMessage, setSuccessMessage] = useState('');

            async function handleSubmit(event) {
              event.preventDefault();
              await requestPasswordReset();
              setSuccessMessage('Check your email');
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                {successMessage ? <p role="status">{successMessage}</p> : null}
                <button type="submit">Reset password</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-recovery-success-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('flags registration flows that show neither success state nor protected transition during project audit', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'register', route: '/register', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'RegisterPage.tsx'),
        `
          export function RegisterPage() {
            async function handleSubmit(event) {
              event.preventDefault();
              await createAccount();
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="new-password" />
                <button type="submit">Create account</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-registration-success-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('does not flag registration success gaps when project auth flows navigate into the protected app', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'src', 'routes'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [
                  { id: 'login', route: '/login', layout: ['form'] },
                  { id: 'register', route: '/register', layout: ['form'] },
                ],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'src', 'routes', 'RegisterPage.tsx'),
        `
          export function RegisterPage() {
            async function handleSubmit(event) {
              event.preventDefault();
              await createAccount();
              return redirect('/dashboard');
            }

            return (
              <form onSubmit={handleSubmit}>
                <input type="email" name="email" autoComplete="email" />
                <input type="password" name="password" autoComplete="new-password" />
                <button type="submit">Create account</button>
              </form>
            );
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-registration-success-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-success-redirect-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('detects auth middleware and exit signals from root middleware and lib directories', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'lib'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'gateway',
                role: 'gateway',
                pages: [{ id: 'login', route: '/login', layout: ['hero'] }],
              },
              {
                id: 'workspace',
                role: 'primary',
                pages: [{ id: 'dashboard', route: '/dashboard', layout: ['hero'] }],
              },
            ],
            features: ['auth'],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'middleware.ts'),
        `
          export function middleware(request: { auth?: { user?: unknown } }) {
            if (!request.auth?.user) {
              return redirect('/login');
            }
            return NextResponse.next();
          }
        `,
      );
      writeFileSync(
        join(projectRoot, 'lib', 'auth.ts'),
        `
          export async function logout() {
            await auth.signOut();
          }
        `,
      );

      const report = await auditProject(projectRoot);
      expect(report.findings.some(finding => finding.id === 'source-auth-guard-signals-missing')).toBe(false);
      expect(report.findings.some(finding => finding.id === 'source-auth-exit-signals-missing')).toBe(false);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('audits built dist directly with explicit route hints', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>Showcase</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/dashboard");\n');

      const report = await auditBuiltDist(projectRoot, {
        routeHints: ['/', '/dashboard'],
      });

      expect(report.checked).toBe(true);
      expect(report.distPresent).toBe(true);
      expect(report.indexPresent).toBe(true);
      expect(report.routeHintsChecked).toEqual(['/', '/dashboard']);
      expect(report.passed).toBe(true);
      expect(report.routeHintsCoverageOk).toBe(true);
      expect(report.routeDocumentsCoverageOk).toBe(true);
      expect(report.routeDocumentsHardeningOk).toBe(false);
      expect(report.routeDocumentsHardenedCount).toBe(0);
      expect(report.fullRouteCoverageOk).toBe(true);
      expect(report.langOk).toBe(true);
      expect(report.viewportOk).toBe(true);
      expect(report.charsetOk).toBe(false);
      expect(report.cspSignalOk).toBe(false);
      expect(report.inlineScriptCount).toBe(0);
      expect(report.inlineEventHandlerCount).toBe(0);
      expect(report.externalScriptsWithoutIntegrityCount).toBe(0);
      expect(report.externalStylesheetsWithoutIntegrityCount).toBe(0);
      expect(report.externalMediaSourcesWithInsecureTransportCount).toBe(0);
      expect(report.externalBlankLinksWithoutRelCount).toBe(0);
      expect(report.externalIframesWithoutSandboxCount).toBe(0);
      expect(report.externalIframesWithInsecureTransportCount).toBe(0);
      expect(report.jsEvalSignalCount).toBe(0);
      expect(report.jsHtmlInjectionSignalCount).toBe(0);
      expect(report.jsInsecureTransportSignalCount).toBe(0);
      expect(report.jsSecretSignalCount).toBe(0);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports partial route document hardening when a reviewed route drops document metadata', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Showcase</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'dashboard'),
        '<!doctype html><html lang="en"><head><title>Dashboard</title></head><body><div id="root"></div></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/"); console.log("/dashboard");\n');

      const report = await auditBuiltDist(projectRoot, {
        routeHints: ['/', '/dashboard'],
      });

      expect(report.checked).toBe(true);
      expect(report.routeDocumentsCoverageOk).toBe(true);
      expect(report.routeDocumentsPassed).toBe(2);
      expect(report.routeDocumentsHardenedCount).toBe(1);
      expect(report.routeDocumentsHardeningOk).toBe(false);
      expect(report.failures).toContain('route-document-hardening-failed:/dashboard');
      expect(report.failures).toContain('route-documents-hardening-missing');
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('reports partial route document hardening during project audit when only some reviewed routes preserve document metadata', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, 'dist', 'assets'), { recursive: true });
      writeFileSync(
        join(projectRoot, 'decantr.essence.json'),
        JSON.stringify({
          version: '4.0.0',
          dna: {
            theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
            spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
            typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
            color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
            radius: { philosophy: 'rounded', base: 8 },
            elevation: { system: 'layered', max_levels: 3 },
            motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
            accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
            personality: ['professional'],
          },
          blueprint: {
            shell: 'sidebar-main',
            sections: [
              {
                id: 'main',
                role: 'primary',
                pages: [
                  { id: 'home', route: '/', layout: ['hero'] },
                  { id: 'dashboard', route: '/dashboard', layout: ['hero'] },
                  { id: 'settings', route: '/settings', layout: ['hero'] },
                ],
              },
            ],
            features: [],
          },
          meta: {
            archetype: 'marketing',
            target: 'react',
            platform: { type: 'spa', routing: 'pathname' },
            guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
          },
        }, null, 2),
      );
      writeFileSync(
        join(projectRoot, 'dist', 'index.html'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Showcase</title></head><body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'dashboard'),
        '<!doctype html><html lang="en"><head><title>Dashboard</title></head><body><div id="root"></div></body></html>\n',
      );
      writeFileSync(
        join(projectRoot, 'dist', 'settings'),
        '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Settings</title></head><body><div id="root"></div></body></html>\n',
      );
      writeFileSync(join(projectRoot, 'dist', 'assets', 'app.js'), 'console.log("/"); console.log("/dashboard"); console.log("/settings");\n');

      const report = await auditProject(projectRoot);
      expect(report.runtimeAudit.routeDocumentsCoverageOk).toBe(true);
      expect(report.runtimeAudit.routeDocumentsHardenedCount).toBe(2);
      expect(report.findings.some(finding => finding.id === 'runtime-route-document-hardening-partial')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('extracts normalized route hints from v3 essence files', () => {
    const hints = extractRouteHintsFromEssence({
      version: '4.0.0',
      dna: {
        theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
        spacing: { base_unit: 4, scale: 'linear', density: 'comfortable', content_gap: '_gap4' },
        typography: { scale: 'modular', heading_weight: 600, body_weight: 400 },
        color: { palette: 'semantic', accent_count: 1, cvd_preference: 'auto' },
        radius: { philosophy: 'rounded', base: 8 },
        elevation: { system: 'layered', max_levels: 3 },
        motion: { preference: 'subtle', duration_scale: 1, reduce_motion: true },
        accessibility: { wcag_level: 'AA', focus_visible: true, skip_nav: true },
        personality: ['professional'],
      },
      blueprint: {
        shell: 'sidebar-main',
        sections: [
          {
            id: 'main',
            role: 'primary',
            pages: [
              { id: 'overview', route: '/overview', layout: ['hero'] },
              { id: 'record', route: '/records/:id', layout: ['hero'] },
            ],
          },
        ],
        routes: {
          '/settings/profile': { page: 'overview' },
        },
        features: [],
      },
      meta: {
        archetype: 'marketing',
        target: 'react',
        platform: { type: 'spa', routing: 'pathname' },
        guard: { mode: 'guided', dna_enforcement: 'error', blueprint_enforcement: 'warn' },
      },
    } as never);

    expect(hints).toContain('/');
    expect(hints).toContain('/overview');
    expect(hints).toContain('/records/');
    expect(hints).toContain('/settings/profile');
  });

  it('critiques files against the compiled review contract', async () => {
    const projectRoot = createProjectRoot();
    try {
      mkdirSync(join(projectRoot, '.decantr', 'context'), { recursive: true });
      mkdirSync(join(projectRoot, 'src', 'styles'), { recursive: true });
      writeFileSync(join(projectRoot, '.decantr', 'context', 'review-pack.json'), JSON.stringify({
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [
          {
            id: 'inline-styles',
            summary: 'Avoid inline style literals as the primary styling path.',
            guidance: 'Move visual styling into tokens.css and treatments.css instead of component-local style objects.',
          },
          {
            id: 'hardcoded-colors',
            summary: 'Avoid hardcoded color literals.',
            guidance: 'Use CSS variables and theme decorators instead of hex, rgb, or hsl values.',
          },
          {
            id: 'utility-framework-leakage',
            summary: 'Avoid letting utility-framework classes carry the primary visual system.',
            guidance: 'Prefer Decantr treatments and decorators as the primary styling contract.',
          },
        ],
        successChecks: [
          {
            id: 'theme-consistency',
            label: 'Theme identity and mode remain consistent across scaffolded routes.',
            severity: 'warn',
          },
        ],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['theme-consistency', 'accessibility', 'responsive-design', 'treatment-usage'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      }, null, 2));
      writeFileSync(join(projectRoot, 'src', 'styles', 'treatments.css'), '.brand-accent { color: var(--d-primary); }\n');
      const filePath = join(projectRoot, 'Example.tsx');
      writeFileSync(filePath, '<button className="hover:bg-pink-500" style={{ color: "#ff00ff" }}>Click me</button>\n');

      const report = await critiqueFile(filePath, projectRoot);
      expect(report.reviewPack?.packType).toBe('review');
      expect(report.focusAreas).toContain('accessibility');
      expect(report.findings.some(finding => finding.id === 'theme-consistency-weak')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'anti-pattern-inline-styles')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'anti-pattern-hardcoded-colors')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'anti-pattern-utility-framework-leakage')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'treatment-usage-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'accessibility-aria-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'accessibility-keyboard-missing')).toBe(true);
      expect(report.findings.some(finding => finding.id === 'responsive-signals-missing')).toBe(true);
      expect(report.scores.some(score => score.category === 'Topology Context')).toBe(true);
    } finally {
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('rejects critique file reads outside the project root', async () => {
    const projectRoot = createProjectRoot();
    const outsideName = `outside-${Date.now()}.tsx`;
    const outsideFile = join(projectRoot, '..', outsideName);

    try {
      writeFileSync(outsideFile, '<button>Outside</button>\n');

      await expect(critiqueFile(outsideFile, projectRoot)).rejects.toThrow(
        'Path escapes the project root',
      );
      await expect(critiqueFile(`../${outsideName}`, projectRoot)).rejects.toThrow(
        'Path escapes the project root',
      );
    } finally {
      await rm(outsideFile, { force: true });
      await rm(projectRoot, { recursive: true, force: true });
    }
  });

  it('critiques inline source with a provided hosted review contract', () => {
    const report = critiqueSource({
      filePath: 'src/pages/Home.tsx',
      code: '<button className="plain" style={{ color: "#ff00ff" }}>Click me</button>\n',
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [
          {
            id: 'inline-styles',
            summary: 'Avoid inline style literals as the primary styling path.',
            guidance: 'Move visual styling into tokens.css and treatments.css instead of component-local style objects.',
          },
          {
            id: 'hardcoded-colors',
            summary: 'Avoid hardcoded color literals.',
            guidance: 'Use CSS variables and theme decorators instead of hex, rgb, or hsl values.',
          },
        ],
        successChecks: [
          {
            id: 'theme-consistency',
            label: 'Theme identity and mode remain consistent across scaffolded routes.',
            severity: 'warn',
          },
        ],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['theme-consistency', 'accessibility', 'responsive-design'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
      packManifest: {
        $schema: 'https://decantr.ai/schemas/pack-manifest.v1.json',
        version: '1.0.0',
        generatedAt: '2026-04-09T00:00:00.000Z',
        scaffold: null,
        review: { id: 'review', markdown: 'review-pack.md', json: 'review-pack.json' },
        sections: [],
        pages: [{ id: 'home', markdown: 'page-home-pack.md', json: 'page-home-pack.json', sectionId: 'main', sectionRole: 'primary' }],
        mutations: [],
      },
      treatmentsCss: '.brand-accent { color: var(--d-primary); }\n',
    });

    expect(report.file).toBe('src/pages/Home.tsx');
    expect(report.reviewPack?.packType).toBe('review');
    expect(report.findings.some(finding => finding.id === 'anti-pattern-inline-styles')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'anti-pattern-hardcoded-colors')).toBe(true);
  });

  it('flags critique runs that only have a pack manifest and no compiled review pack', () => {
    const report = critiqueSource({
      filePath: 'src/pages/Home.tsx',
      code: '<a href="#">Go</a>\n',
      packManifest: {
        $schema: 'https://decantr.ai/schemas/pack-manifest.v1.json',
        version: '1.0.0',
        generatedAt: '2026-04-09T00:00:00.000Z',
        scaffold: { id: 'scaffold', markdown: 'scaffold-pack.md', json: 'scaffold-pack.json' },
        review: null,
        sections: [],
        pages: [{ id: 'home', markdown: 'page-home-pack.md', json: 'page-home-pack.json', sectionId: 'main', sectionRole: 'primary' }],
        mutations: [],
      },
    });

    expect(report.findings.some(finding => finding.id === 'review-pack-missing-for-critique')).toBe(true);
  });

  it('flags dangerous HTML injection and dynamic evaluation patterns during critique', () => {
    const report = critiqueSource({
      filePath: 'src/pages/Danger.tsx',
      code: `
        export function Danger({ html, expression }: { html: string; expression: string }) {
          const output = eval(expression);
          setTimeout("console.log('bad')", 100);
          return (
            <section>
              <div dangerouslySetInnerHTML={{ __html: html }} />
              <button onClick={() => document.body.innerHTML = "<p>bad</p>"}>{output}</button>
            </section>
          );
        }
      `,
    });

    expect(report.scores.some(score => score.category === 'Security Hygiene')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-dangerously-set-html')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-raw-html-injection')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-dynamic-code-eval')).toBe(true);
  });

  it('flags unlabeled icon buttons and clickable non-semantic containers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/Toolbar.tsx',
      code: `
        export function Toolbar() {
          return (
            <div>
              <button><IconMenu /></button>
              <div onClick={() => openPanel()}>Open</div>
            </div>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['toolbar'], patternIds: ['nav'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'toolbar', path: '/', patternIds: ['nav'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-icon-button-label-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'accessibility-clickable-non-semantic')).toBe(true);
  });

  it('flags missing image alt text and insecure target blank links during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/MarketingCard.tsx',
      code: `
        export function MarketingCard() {
          return (
            <section>
              <img src="/hero.png" />
              <a href="https://example.com/docs" target="_blank">Docs</a>
            </section>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['accessibility', 'security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-image-alt-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-target-blank-rel-missing')).toBe(true);
  });

  it('flags external Link targets without rel protections during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/DocsLink.tsx',
      code: `
        import { Link } from 'react-router-dom';

        export function DocsLink() {
          return <Link to="https://example.com/docs" target="_blank">Docs</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['docs'], patternIds: ['nav'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'docs', path: '/', patternIds: ['nav'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-target-blank-rel-missing')).toBe(true);
  });

  it('flags insecure remote image transport during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LegacyHero.tsx',
      code: `
        export function LegacyHero() {
          return (
            <section>
              <img src="http://cdn.example.com/hero.jpg" alt="Legacy hero" />
            </section>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-image-transport-insecure')).toBe(true);
  });

  it('flags Next-style Image components without alt text during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/HeroImage.tsx',
      code: `
        import Image from 'next/image';

        export function HeroImage() {
          return <Image src="/hero.jpg" width={1200} height={630} />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-image-alt-missing')).toBe(true);
  });

  it('flags insecure remote transport on Next-style Image components during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LegacyImage.tsx',
      code: `
        import Image from 'next/image';

        export function LegacyImage() {
          return <Image src="http://cdn.example.com/hero.jpg" alt="Legacy hero" width={1200} height={630} />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-image-transport-insecure')).toBe(true);
  });

  it('flags insecure remote picture sources during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/ResponsiveHero.tsx',
      code: `
        export function ResponsiveHero() {
          return (
            <picture>
              <source media="(min-width: 768px)" srcSet="http://cdn.example.com/hero@2x.jpg 2x, https://cdn.example.com/hero.jpg 1x" />
              <img src="/hero-mobile.jpg" alt="Responsive hero" />
            </picture>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-image-transport-insecure')).toBe(true);
  });

  it('does not flag secure remote image transport during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/ModernHero.tsx',
      code: `
        export function ModernHero() {
          return (
            <section>
              <img src="https://cdn.example.com/hero.jpg" alt="Modern hero" />
            </section>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['marketing'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'marketing', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-image-transport-insecure')).toBe(false);
  });

  it('flags unlabeled icon-only links during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppNav.tsx',
      code: `
        export function AppNav() {
          return (
            <nav>
              <a href="/settings"><svg aria-hidden="true" viewBox="0 0 16 16"><path d="M0 0h16v16H0z" /></svg></a>
            </nav>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['nav'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'nav', path: '/settings', patternIds: ['sidebar'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-icon-link-label-missing')).toBe(true);
  });

  it('flags unlabeled icon-only Link components during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppNav.tsx',
      code: `
        import { Link } from 'react-router-dom';

        export function AppNav() {
          return (
            <nav>
              <Link to="/settings"><svg aria-hidden="true" viewBox="0 0 16 16"><path d="M0 0h16v16H0z" /></svg></Link>
            </nav>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['nav'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'nav', path: '/settings', patternIds: ['sidebar'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-icon-link-label-missing')).toBe(true);
  });

  it('flags iframes without titles during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AnalyticsEmbed.tsx',
      code: `
        export function AnalyticsEmbed() {
          return (
            <section>
              <iframe src="https://example.com/embed" />
            </section>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['analytics'], patternIds: ['chart-grid'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'analytics', path: '/analytics', patternIds: ['chart-grid'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-iframe-title-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-iframe-sandbox-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-iframe-transport-insecure')).toBe(false);
  });

  it('flags insecure external iframe transport during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LegacyEmbed.tsx',
      code: `
        export function LegacyEmbed() {
          return (
            <section>
              <iframe title="Legacy analytics" src="http://example.com/embed" sandbox="" />
            </section>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['analytics'], patternIds: ['chart-grid'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'analytics', path: '/analytics', patternIds: ['chart-grid'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-iframe-transport-insecure')).toBe(true);
  });

  it('flags dialogs without accessible labels or modal hints during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AccountDialog.tsx',
      code: `
        export function AccountDialog() {
          return (
            <div role="dialog">
              <h2>Account settings</h2>
              <button type="button">Close</button>
            </div>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['settings'], patternIds: ['dialog'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'settings', path: '/settings', patternIds: ['dialog'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-dialog-label-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'accessibility-dialog-modal-hint-missing')).toBe(true);
  });

  it('does not flag dialogs when label and modal hints are present', () => {
    const report = critiqueSource({
      filePath: 'src/components/AccountDialog.tsx',
      code: `
        export function AccountDialog() {
          return (
            <div role="dialog" aria-modal="true" aria-labelledby="account-dialog-title">
              <h2 id="account-dialog-title">Account settings</h2>
              <button type="button">Close</button>
            </div>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['settings'], patternIds: ['dialog'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'settings', path: '/settings', patternIds: ['dialog'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-dialog-label-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'accessibility-dialog-modal-hint-missing')).toBe(false);
  });

  it('flags tables without headers or captions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/DataTable.tsx',
      code: `
        export function DataTable() {
          return (
            <table>
              <tbody>
                <tr>
                  <td>Revenue</td>
                  <td>$420k</td>
                </tr>
              </tbody>
            </table>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['data-table'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['data-table'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-table-headers-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'accessibility-table-caption-missing')).toBe(true);
  });

  it('flags multiple navigation landmarks without labels during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppShell.tsx',
      code: `
        export function AppShell() {
          return (
            <>
              <nav>
                <a href="/dashboard">Dashboard</a>
              </nav>
              <nav>
                <a href="/settings">Settings</a>
              </nav>
            </>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-navigation-landmark-label-missing')).toBe(true);
  });

  it('flags multiple main landmarks during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppShell.tsx',
      code: `
        export function AppShell() {
          return (
            <>
              <main>
                <section>Primary</section>
              </main>
              <main>
                <section>Secondary</section>
              </main>
            </>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['shell'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['shell'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-multiple-main-landmarks')).toBe(true);
  });

  it('does not flag a single main landmark during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppShell.tsx',
      code: `
        export function AppShell() {
          return (
            <main>
              <section>Primary</section>
            </main>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['shell'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['shell'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-multiple-main-landmarks')).toBe(false);
  });

  it('does not flag navigation landmarks when multiple nav regions are labeled', () => {
    const report = critiqueSource({
      filePath: 'src/components/AppShell.tsx',
      code: `
        export function AppShell() {
          return (
            <>
              <nav aria-label="Primary">
                <a href="/dashboard">Dashboard</a>
              </nav>
              <nav aria-label="Secondary">
                <a href="/settings">Settings</a>
              </nav>
            </>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-navigation-landmark-label-missing')).toBe(false);
  });

  it('does not flag tables when headers and caption are present', () => {
    const report = critiqueSource({
      filePath: 'src/components/DataTable.tsx',
      code: `
        export function DataTable() {
          return (
            <table>
              <caption>Revenue by month</caption>
              <thead>
                <tr>
                  <th scope="col">Metric</th>
                  <th scope="col">Value</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td>Revenue</td>
                  <td>$420k</td>
                </tr>
              </tbody>
            </table>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['data-table'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['data-table'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-table-headers-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'accessibility-table-caption-missing')).toBe(false);
  });

  it('flags insecure or unsafe form actions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LegacyCheckout.tsx',
      code: `
        export function LegacyCheckout() {
          return (
            <form action="http://legacy.example.com/checkout" method="post">
              <input type="email" name="email" />
              <button type="submit">Pay now</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['billing'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['billing'],
          routes: [{ pageId: 'billing', path: '/billing', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-form-action-insecure')).toBe(true);
  });

  it('flags javascript form actions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UnsafeAction.tsx',
      code: `
        export function UnsafeAction() {
          return (
            <form action="javascript:alert('owned')" method="post">
              <input type="email" name="email" />
              <button type="submit">Continue</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['billing'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['billing'],
          routes: [{ pageId: 'billing', path: '/billing', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-form-action-insecure')).toBe(true);
  });

  it('flags insecure client transport endpoints during critique', () => {
    const report = critiqueSource({
      filePath: 'src/lib/legacy-auth.ts',
      code: `
        export async function loadProfile() {
          await fetch('http://legacy.example.com/api/profile');
          window.location.assign('http://legacy.example.com/login');
          return new WebSocket('ws://legacy.example.com/live');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-transport-endpoint-insecure')).toBe(true);
  });

  it('flags localhost-style endpoints during critique', () => {
    const report = critiqueSource({
      filePath: 'src/lib/api.ts',
      code: `
        export const apiBase = 'http://localhost:3000/api';
        export const streamBase = 'ws://127.0.0.1:4000/live';
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-localhost-endpoint-present')).toBe(true);
  });

  it('flags auth-like forms that default to GET semantics during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-form-method-insecure')).toBe(true);
  });

  it('flags auth-like forms without submit controls during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['motion-interaction'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'interaction-auth-submit-missing')).toBe(true);
  });

  it('flags auth-like inputs without name attributes during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="email" autoComplete="email" />
              <input type="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['motion-interaction'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'interaction-auth-input-name-missing')).toBe(true);
  });

  it('does not flag auth inputs when stable name attributes are present', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['motion-interaction'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'interaction-auth-input-name-missing')).toBe(false);
  });

  it('flags auth/session files that redirect to protected destinations during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGuard.tsx',
      code: `
        export function DashboardGuard() {
          const { data: session } = useSession();
          if (!session) {
            return redirect('/dashboard');
          }
          return <Dashboard />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] }],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-guard-protected-redirect')).toBe(true);
  });

  it('flags auth/session exit logic that never returns users to an anonymous route during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const { status } = useSession();

          async function handleLogout() {
            await auth.signOut();
          }

          if (status === 'loading') {
            return <Spinner />;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-exit-redirect-missing')).toBe(true);
  });

  it('flags auth entry flows that never transition into the protected app during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(true);
  });

  it('flags auth/session critique files that omit a loading state', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGuard.tsx',
      code: `
        export function DashboardGuard() {
          const { data: session } = useSession();
          if (!session) {
            return redirect('/login');
          }
          return <Dashboard />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] }],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-missing')).toBe(true);
  });

  it('does not flag auth/session critique files when callback screens show explicit pending copy', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback() {
          const { data: session } = useSession();
          if (!session) {
            return <p>Signing you in...</p>;
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-missing')).toBe(false);
  });

  it('flags sign-in critique files that omit a route to the declared recovery flow', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'forgot-password', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-recovery-link-missing')).toBe(true);
  });

  it('does not flag recovery-link gaps when the sign-in flow links to the declared recovery route', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <a href="/forgot-password">Forgot password?</a>
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'forgot-password', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-recovery-link-missing')).toBe(false);
  });

  it('flags sign-in critique files that omit a route to the declared registration flow', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-registration-link-missing')).toBe(true);
  });

  it('does not flag registration-link gaps when the sign-in flow links to the declared registration route', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <a href="/register">Create account</a>
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-registration-link-missing')).toBe(false);
  });

  it('flags recovery critique files that omit a route back to the declared anonymous entry flow', () => {
    const report = critiqueSource({
      filePath: 'src/routes/ForgotPasswordPage.tsx',
      code: `
        export function ForgotPasswordPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.requestPasswordReset();
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <button type="submit">Send reset link</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'forgot-password', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-entry-return-missing')).toBe(true);
  });

  it('does not flag recovery-entry gaps when the recovery flow links back to the declared anonymous entry route', () => {
    const report = critiqueSource({
      filePath: 'src/routes/ForgotPasswordPage.tsx',
      code: `
        export function ForgotPasswordPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.requestPasswordReset();
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <a href="/login">Back to sign in</a>
              <button type="submit">Send reset link</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'forgot-password', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-entry-return-missing')).toBe(false);
  });

  it('flags registration critique files that omit a route back to the declared sign-in flow', () => {
    const report = critiqueSource({
      filePath: 'src/routes/RegisterPage.tsx',
      code: `
        export function RegisterPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signUp();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="new-password" />
              <button type="submit">Create account</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-signin-link-missing')).toBe(true);
  });

  it('does not flag sign-in return gaps when the registration flow links back to the declared sign-in route', () => {
    const report = critiqueSource({
      filePath: 'src/routes/RegisterPage.tsx',
      code: `
        export function RegisterPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signUp();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="new-password" />
              <a href="/login">Back to sign in</a>
              <button type="submit">Create account</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-signin-link-missing')).toBe(false);
  });

  it('flags auth entry critique files that omit a failure state', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-error-missing')).toBe(true);
  });

  it('flags auth flows that trust raw redirect query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          return redirect(searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth flows that trust raw URLSearchParams redirect params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          return redirect(new URLSearchParams(window.location.search).get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth flows that trust aliased raw URLSearchParams redirect params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(window.location.search).get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags link-driven auth redirects sourced from raw query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { Link } from 'react-router-dom';

        export function LoginRedirect({ searchParams }) {
          return <Link to={searchParams.get('next') ?? '/dashboard'}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags link-driven auth redirects sourced from raw URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { Link } from 'react-router-dom';

        export function LoginRedirect() {
          return <Link to={new URLSearchParams(window.location.search).get('next') ?? '/dashboard'}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags link-driven auth redirects sourced from aliased raw URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { Link } from 'react-router-dom';

        export function LoginRedirect() {
          const next = new URLSearchParams(window.location.search).get('next');
          return <Link to={next ?? '/dashboard'}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags browser-native auth redirects sourced from raw URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          window.location.assign(new URLSearchParams(window.location.search).get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags aliased browser-native auth redirects sourced from raw URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(window.location.search).get('next');
          window.location.href = next ?? '/dashboard';
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that alias the URLSearchParams container during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const params = new URLSearchParams(window.location.search);
          const next = params.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that alias a URL object searchParams carrier during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const url = new URL(window.location.href);
          const next = url.searchParams.get('next');
          window.location.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure location search carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const { search } = window.location;
          const next = new URLSearchParams(search).get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure location href URL carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const { href } = window.location;
          const url = new URL(href);
          const next = url.searchParams.get('next');
          window.location.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust globalThis location carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(globalThis.location.search).get('next');
          globalThis.location.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure globalThis location bases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const { location } = globalThis;
          const { href } = location;
          const url = new URL(href);
          const next = url.searchParams.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased location objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const browserLocation = window.location;
          const next = new URLSearchParams(browserLocation.search).get('next');
          browserLocation.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased global location href assignments during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const browserLocation = globalThis.location;
          const url = new URL(browserLocation.href);
          const next = url.searchParams.get('next');
          browserLocation.href = next ?? '/dashboard';
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust document location carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(document.location.search).get('next');
          document.location.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased document location objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const browserLocation = document.location;
          const next = new URLSearchParams(browserLocation.search).get('next');
          browserLocation.href = next ?? '/dashboard';
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust self location carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(self.location.search).get('next');
          self.location.assign(next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased parent location objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const frameLocation = parent.location;
          const next = new URLSearchParams(frameLocation.search).get('next');
          frameLocation.href = next ?? '/dashboard';
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bracketed self location carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const next = new URLSearchParams(self['location']['search']).get('next');
          self['location']['assign'](next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bracketed aliased frame location href assignments during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const frameLocation = parent['location'];
          const next = new URLSearchParams(frameLocation['search']).get('next');
          frameLocation['href'] = next ?? '/dashboard';
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bracketed location access through aliased browser bases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const browser = window;
          const next = new URLSearchParams(browser['location']['search']).get('next');
          browser['location']['assign'](next ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure URL searchParams carriers and alias query keys during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const { searchParams: params } = new URL(window.location.href);
          const queryKey = 'next';
          const next = params.get(queryKey);
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure query redirect params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const query = router.query;
          const { next: redirectTo } = query;
          return redirect(redirectTo ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that destructure query carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const { query: params } = router;
          return redirect(params.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that bracket-read aliased query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const query = router.query;
          const queryKey = 'next';
          const next = query[queryKey];
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that pass aliased query params through route objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const query = router.query;
          const queryKey = 'next';
          const next = query[queryKey];
          return navigate({ pathname: next ?? '/dashboard' });
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags link-driven auth redirects that pass aliased query params through route objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const query = router.query;
          const queryKey = 'next';
          const next = query[queryKey];
          return <Link to={{ pathname: next ?? '/dashboard' }}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust request URL search params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(request) {
          const url = new URL(request.url);
          const next = url.searchParams.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust req URL search params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          return redirect(new URL(req.url).searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust req nextUrl search params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          return redirect(req.nextUrl.searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust aliased req nextUrl search params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          const params = req.nextUrl.searchParams;
          const queryKey = 'next';
          return redirect(params.get(queryKey) ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust bracketed req nextUrl search-param getter calls during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          return redirect(req['nextUrl']['searchParams']['get']('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust req nextUrl aliases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          const nextUrl = req.nextUrl;
          return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that trust destructured req nextUrl aliases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export async function GET(req) {
          const { nextUrl } = req;
          return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that wrap query params in URL constructors during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { NextResponse } from 'next/server';

        export async function GET(req) {
          const next = req.nextUrl.searchParams.get('next');
          return NextResponse.redirect(new URL(next ?? '/dashboard', req.url));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags server auth redirects that wrap query params in URL constructors with aliased req urls during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { NextResponse } from 'next/server';

        export async function GET(req) {
          const requestUrl = req.url;
          const next = req.nextUrl.searchParams.get('next');
          return NextResponse.redirect(new URL(next ?? '/dashboard', requestUrl));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct searchParams props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          return redirect(searchParams.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased indexed searchParams props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect(props) {
          const { searchParams: params } = props;
          const queryKey = 'next';
          return <Link to={{ pathname: params[queryKey] ?? '/dashboard' }}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust parameter-aliased searchParams props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams: params }) {
          return redirect(params.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust optional searchParams getter props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          return redirect(searchParams?.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound searchParams getter helpers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const readRedirect = searchParams.get.bind(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust local arrow helper readers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const readRedirect = (key) => searchParams.get(key);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust object helper methods during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const helpers = {
            readRedirect(key) {
              return searchParams.get(key);
            },
          };

          return redirect(helpers.readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured object helper methods during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const helpers = {
            readRedirect(key) {
              return searchParams.get(key);
            },
          };
          const { readRedirect } = helpers;

          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust nested object helper methods during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const helpers = {
            redirect: {
              readRedirect(key) {
                return searchParams.get(key);
              },
            },
          };

          return redirect(helpers.redirect.readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured nested helper objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const helpers = {
            redirect: {
              readRedirect(key) {
                return searchParams.get(key);
              },
            },
          };
          const { redirect: redirectHelpers } = helpers;

          return redirect(redirectHelpers.readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust object helper factories during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createRedirectHelpers(searchParams) {
          return {
            readRedirect(key) {
              return searchParams.get(key);
            },
          };
        }

        export function LoginRedirect({ searchParams }) {
          const helpers = createRedirectHelpers(searchParams);
          return redirect(helpers.readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured helper-factory methods during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createRedirectHelpers(searchParams) {
          return {
            readRedirect(key) {
              return searchParams.get(key);
            },
          };
        }

        export function LoginRedirect({ searchParams }) {
          const { readRedirect } = createRedirectHelpers(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust renamed helper-factory params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createRedirectHelpers(params) {
          return {
            readRedirect(key) {
              return params.get(key);
            },
          };
        }

        export function LoginRedirect({ searchParams }) {
          const helpers = createRedirectHelpers(searchParams);
          return redirect(helpers.readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured renamed helper-factory params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createRedirectHelpers(params) {
          return {
            readRedirect(key) {
              return params.get(key);
            },
          };
        }

        export function LoginRedirect({ searchParams }) {
          const { readRedirect } = createRedirectHelpers(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust function helper factories with renamed params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased function helper factories with renamed params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const getRedirectFromQuery = (key) => params.get(key);
          return getRedirectFromQuery;
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures through call wrappers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures through apply wrappers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.apply(null, ['next']) ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures through apply wrappers with aliased args during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          const redirectArgs = ['next'];
          return redirect(readRedirect.apply(null, redirectArgs) ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures through Reflect.apply wrappers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(Reflect.apply(readRedirect, null, ['next']) ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures through Reflect.apply wrappers with aliased args during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          const redirectArgs = ['next'];
          return redirect(Reflect.apply(readRedirect, null, redirectArgs) ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams).bind(null);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with at() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).at(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with at() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).at(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with shift() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).shift();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with shift() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).shift();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with pop() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).pop();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with pop() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).pop();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with find() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).find(Boolean);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with find() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).find(Boolean);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over repeated query params with findLast() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).findLast(Boolean);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over repeated query params with findLast() during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).findLast(Boolean);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over sliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).slice(-1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over sliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).slice(-1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over reversed repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).reverse()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over reversed repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).reverse()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over non-mutating reversed repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toReversed()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating reversed repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toReversed()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over sorted repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).sort()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over sorted repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).sort()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over non-mutating sorted repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toSorted()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating sorted repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toSorted()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over Array.from wrapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Array.from(params.getAll(key))[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over Array.from wrapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Array.from(params.getAll(key))[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over spread wrapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => [...params.getAll(key)][0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over spread wrapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => [...params.getAll(key)][0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over concatenated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).concat()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over concatenated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).concat()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over flattened repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).flat()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over flattened repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).flat()[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over flat-mapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).flatMap((value) => [value])[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over flat-mapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).flatMap((value) => [value])[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over mapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).map((value) => value)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over mapped repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).map((value) => value)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over spliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).splice(0, 1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over spliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).splice(0, 1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over non-mutating spliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toSpliced(0, 1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over non-mutating spliced repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).toSpliced(0, 1)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over iterated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).values().next().value;
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over iterated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).values().next().value;
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over entry-iterated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).entries().next().value[1];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over entry-iterated repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).entries().next().value[1];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trim();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trim();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust replaced returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].replace(/^\\/+/, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped replaced returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].replace(/^\\/+/, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust replace-all returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].replaceAll('//', '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped replace-all returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].replaceAll('//', '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust substring returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].substring(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped substring returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].substring(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust substr returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].substr(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped substr returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].substr(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust lowercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLowerCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped lowercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLowerCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust uppercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toUpperCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped uppercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toUpperCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust locale-lowercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLocaleLowerCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped locale-lowercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLocaleLowerCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust locale-uppercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLocaleUpperCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped locale-uppercased returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLocaleUpperCase();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust normalized returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].normalize();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped normalized returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].normalize();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust left-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimStart();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped left-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimStart();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust right-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimEnd();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped right-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimEnd();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust legacy-left-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimLeft();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped legacy-left-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimLeft();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust legacy-right-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimRight();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped legacy-right-trimmed returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].trimRight();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust left-padded returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].padStart(12, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped left-padded returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].padStart(12, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust right-padded returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].padEnd(12, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped right-padded returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].padEnd(12, '/');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].repeat(1);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].repeat(1);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust split repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].split('?')[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust stringified repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toString();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust String-wrapped repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => String(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust value-unwrapped repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].valueOf();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust sliced repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].slice(0);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust locale-stringified repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toLocaleString();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust split-joined repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].split('?').join('?');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust matched repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].match(/^[^?]+/)?.[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust matchAll-normalized repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].matchAll(/^[^?]+/g).next().value?.[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust well-formed repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0].toWellFormed();
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust regex-exec repeated-string returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => /^[^?]+/.exec(params.getAll(key)[0])?.[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust right-reduced repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).reduceRight((_, value) => value);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust logical-or repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key)[0] || '/dashboard';
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust ternary repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => key === 'next' ? params.getAll(key)[0] : '/dashboard';
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust template-wrapped repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => \`\${params.getAll(key)[0]}\`;
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust tagged-template repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => String.raw\`\${params.getAll(key)[0]}\`;
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => encodeURI(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust browser-global URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => globalThis.encodeURI(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const encodeRedirect = globalThis.encodeURI.bind(globalThis);
          return (key) => encodeRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Reflect.apply(globalThis.encodeURI, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global legacy URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Reflect.apply(globalThis.escape, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct stringified repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => String(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust browser-global stringified repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => globalThis.String(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global stringified repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Reflect.apply(globalThis.String, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global stringified repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const stringifyRedirect = globalThis.String.bind(globalThis);
          return (key) => stringifyRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured constructor-style browser-global stringified repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { String: StringCtor } = globalThis;
          return (key) => new StringCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured object-boxed repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { Object: ObjectCtor } = globalThis;
          return (key) => ObjectCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global object repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Object.bind(globalThis);
          return (key) => readRedirectValue(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global number repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Number.bind(globalThis);
          return (key) => readRedirectValue(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured browser-global number-boxed repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { Number: NumberCtor } = globalThis;
          return (key) => NumberCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global number repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Number;
          return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust apply-based browser-global number repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Number;
          return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct browser-global number repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Number(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global number repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Number;
          return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global object repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Object;
          return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust apply-based browser-global object repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Object;
          return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct browser-global object repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Object(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global object repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Object;
          return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured browser-global boolean-boxed repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { Boolean: BooleanCtor } = globalThis;
          return (key) => BooleanCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct browser-global boolean repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Boolean(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global boolean repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Boolean.bind(globalThis);
          return (key) => readRedirectValue(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { BigInt: BigIntCtor } = globalThis;
          return (key) => BigIntCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => BigInt(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.BigInt.bind(globalThis);
          return (key) => readRedirectValue(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { Symbol: SymbolCtor } = globalThis;
          return (key) => SymbolCtor(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust direct browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Symbol(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Symbol.bind(globalThis);
          return (key) => readRedirectValue(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global boolean repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Boolean;
          return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust apply-based browser-global boolean repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Boolean;
          return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global boolean repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Boolean;
          return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.BigInt;
          return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust apply-based browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.BigInt;
          return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global bigint repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.BigInt;
          return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapper-based browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Symbol;
          return (key) => readRedirectValue.call(globalThis, params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust apply-based browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Symbol;
          return (key) => readRedirectValue.apply(globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global symbol repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const readRedirectValue = globalThis.Symbol;
          return (key) => Reflect.apply(readRedirectValue, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured JSON.parse repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { parse } = JSON;
          return (key) => parse(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound JSON.parse repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const parseRedirect = JSON.parse.bind(JSON);
          return (key) => parseRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected JSON.parse repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const parseRedirect = JSON.parse;
          return (key) => {
            const parseArgs = [params.getAll(key)[0]];
            return Reflect.apply(parseRedirect, JSON, parseArgs);
          };
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured JSON.stringify repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { stringify } = JSON;
          return (key) => stringify(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound JSON.stringify repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const stringifyRedirect = JSON.stringify.bind(JSON);
          return (key) => stringifyRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected JSON.stringify repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const stringifyRedirect = JSON.stringify;
          return (key) => {
            const stringifyArgs = [params.getAll(key)[0]];
            return Reflect.apply(stringifyRedirect, JSON, stringifyArgs);
          };
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured structuredClone repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { structuredClone: cloneRedirect } = globalThis;
          return (key) => cloneRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound structuredClone repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const cloneRedirect = globalThis.structuredClone.bind(globalThis);
          return (key) => cloneRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected structuredClone repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const cloneRedirect = globalThis.structuredClone;
          return (key) => {
            const cloneArgs = [params.getAll(key)[0]];
            return Reflect.apply(cloneRedirect, globalThis, cloneArgs);
          };
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust base64-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => btoa(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust Buffer-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Buffer.from(params.getAll(key)[0], 'utf8').toString('base64');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured Buffer.from repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { from } = Buffer;
          return (key) => from(params.getAll(key)[0], 'utf8').toString('base64');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured global-object Buffer repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const { Buffer: BufferCtor } = globalThis;
          return (key) => BufferCtor.from(params.getAll(key)[0], 'utf8').toString('base64');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected Buffer.from repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const decodeRedirect = Buffer.from;
          return (key) => Reflect.apply(decodeRedirect, Buffer, [params.getAll(key)[0], 'utf8']).toString('base64');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound global-object Buffer.from repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const decodeRedirect = globalThis.Buffer.from.bind(globalThis.Buffer);
          return (key) => decodeRedirect(params.getAll(key)[0], 'utf8').toString('base64');
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust browser-global base64-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => globalThis.btoa(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound browser-global base64-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          const encodeRedirect = globalThis.btoa.bind(globalThis);
          return (key) => encodeRedirect(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust reflected browser-global base64-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => Reflect.apply(globalThis.btoa, globalThis, [params.getAll(key)[0]]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust browser-global legacy URI-encoded repeated-query returned helper closures during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => window.escape(params.getAll(key)[0]);
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next'));
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust returned helper closures over filtered repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).filter(Boolean)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust wrapped returned helper closures over filtered repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function createReadRedirect(params) {
          return (key) => params.getAll(key).filter(Boolean)[0];
        }

        export function LoginRedirect({ searchParams }) {
          const readRedirect = createReadRedirect(searchParams);
          return redirect(readRedirect.call(null, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust local function helper readers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        function readRedirect(searchParams, key) {
          return searchParams.get(key);
        }

        export function LoginRedirect({ searchParams }) {
          return redirect(readRedirect(searchParams, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust searchParams getter call wrappers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { get } = searchParams;
          return redirect(get.call(searchParams, 'next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust optional query property carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const query = Object.fromEntries(new URLSearchParams(window.location.search));
          return redirect(query?.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bracketed searchParams getter props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          return redirect(searchParams['get']('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust nested destructured searchParams props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams: { next } }) {
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bracketed router push transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router, searchParams }) {
          router['push'](searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased router push transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const { push } = useRouter();
          push(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust optional router push transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          router?.push(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust router push call transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          router.push.call(router, searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased router replace apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          const navigate = router.replace;
          navigate.apply(router, [searchParams.get('next') ?? '/dashboard']);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased router apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          const navigate = router.replace;
          const args = [searchParams.get('next') ?? '/dashboard'];
          navigate.apply(router, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust router Reflect.apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          Reflect.apply(router.replace, router, [searchParams.get('next') ?? '/dashboard']);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust router Reflect.apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          const args = [searchParams.get('next') ?? '/dashboard'];
          Reflect.apply(router.replace, router, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound router replace transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect({ searchParams }) {
          const router = useRouter();
          const navigate = router.replace.bind(router);
          navigate(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust history replaceState call transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          history.replaceState.call(history, {}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust history Reflect.apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const args = [{}, '', searchParams.get('next') ?? '/dashboard'];
          Reflect.apply(history.replaceState, history, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust location assign call transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          window.location.assign.call(window.location, searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust location Reflect.apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          Reflect.apply(window.location.assign, window.location, [searchParams.get('next') ?? '/dashboard']);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust window open apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          window.open.apply(window, [searchParams.get('next') ?? '/dashboard', '_self']);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust location Reflect.apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const args = [searchParams.get('next') ?? '/dashboard'];
          Reflect.apply(window.location.assign, window.location, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust window open Reflect.apply transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          Reflect.apply(window.open, window, [searchParams.get('next') ?? '/dashboard', '_self']);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust window open Reflect.apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const args = [searchParams.get('next') ?? '/dashboard', '_self'];
          Reflect.apply(window.open, window, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased history apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const updateHistory = history.replaceState;
          const args = [{}, '', searchParams.get('next') ?? '/dashboard'];
          updateHistory.apply(history, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased location apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const navigate = window.location.assign;
          const args = [searchParams.get('next') ?? '/dashboard'];
          navigate.apply(window.location, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased window open apply argument arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const popup = window.open;
          const args = [searchParams.get('next') ?? '/dashboard', '_self'];
          popup.apply(window, args);
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust history replaceState transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const browserHistory = window.history;
          browserHistory.replaceState({}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased history replaceState transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const updateHistory = history.replaceState;
          updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured history pushState transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { pushState: updateHistory } = window.history;
          updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound history replaceState transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const updateHistory = history.replaceState.bind(history);
          updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured bound history pushState transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { pushState } = window.history;
          const updateHistory = pushState.bind(window.history);
          updateHistory({}, '', searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust window.open transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          window.open(searchParams.get('next') ?? '/dashboard', '_self');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased window.open transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const popup = window.open;
          popup(searchParams.get('next') ?? '/dashboard', '_self');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured window.open transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { open: popup } = window;
          popup(searchParams.get('next') ?? '/dashboard', '_self');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased location.assign transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const navigate = window.location.assign;
          navigate(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust optional location assign transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          window.location?.assign(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured location.replace transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { replace: navigate } = window.location;
          navigate(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust bound location.assign transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const navigate = window.location.assign.bind(window.location);
          navigate(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured bound location.replace transitions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const { replace } = window.location;
          const navigate = replace.bind(window.location);
          navigate(searchParams.get('next') ?? '/dashboard');
          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased useSearchParams hook carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useSearchParams } from 'react-router-dom';

        export function LoginRedirect() {
          const params = useSearchParams();
          return redirect(params.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust tuple-destructured useSearchParams hook carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useSearchParams } from 'react-router-dom';

        export function LoginRedirect() {
          const [params] = useSearchParams();
          return redirect(params.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased useRouter hook query carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect() {
          const appRouter = useRouter();
          return redirect(appRouter.query.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust helper-wrapped query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const next = decodeURIComponent(searchParams.get('next') ?? '/dashboard');
          return redirect(next);
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust repeated query params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          const next = searchParams.getAll('next')[0];
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased useLocation hook carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useLocation } from 'react-router-dom';

        export function LoginRedirect() {
          const routeLocation = useLocation();
          const next = new URLSearchParams(routeLocation.search).get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured useLocation hook search carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useLocation } from 'react-router-dom';

        export function LoginRedirect() {
          const { search } = useLocation();
          const next = new URLSearchParams(search).get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust cloned nextUrl carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const nextUrl = req.nextUrl.clone();
          return redirect(nextUrl.searchParams.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased cloned nextUrl searchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const params = req.nextUrl.clone().searchParams;
          const next = params.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust nextUrl search-string carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const next = new URLSearchParams(req.nextUrl.search).get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust nextUrl href carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const nextUrl = req.nextUrl.clone();
          const next = new URL(nextUrl.href).searchParams.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust stringified nextUrl carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const next = new URL(req.nextUrl.toString()).searchParams.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust String-wrapped nextUrl carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const nextUrl = req.nextUrl.clone();
          const next = new URL(String(nextUrl)).searchParams.get('next');
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust Object.fromEntries query carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const query = Object.fromEntries(req.nextUrl.searchParams);
          return redirect(query.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust destructured Object.fromEntries query carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const { next } = Object.fromEntries(new URLSearchParams(window.location.search));
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased searchParams entries in Object.fromEntries during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const entries = new URLSearchParams(window.location.search).entries();
          const query = Object.fromEntries(entries);
          return redirect(query.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust Array.from wrapped entries in Object.fromEntries during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const entries = Array.from(new URLSearchParams(window.location.search).entries());
          const query = Object.fromEntries(entries);
          return redirect(query.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust spread wrapped searchParams iterables in Object.fromEntries during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const query = Object.fromEntries([...new URLSearchParams(window.location.search)]);
          return redirect(query.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust normalized location search carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const params = new URLSearchParams(window.location.search.slice(1));
          return redirect(params.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust normalized nextUrl search carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function middleware(req) {
          const params = new URLSearchParams(req.nextUrl.search.slice(1));
          return redirect(params.get('next') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust aliased destructured useRouter query carriers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        import { useRouter } from 'next/router';

        export function LoginRedirect() {
          const { query: params } = useRouter();
          return redirect(params.next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust template-wrapped query aliases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const next = router.query.next;
          return redirect(\`\${next ?? '/dashboard'}\`);
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust template-wrapped searchParams props in JSX during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams: { next } }) {
          return <Link to={\`\${next ?? '/dashboard'}\`}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust snake-case search param keys during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ searchParams }) {
          return redirect(searchParams.get('return_to') ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust snake-case query aliases during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect({ router }) {
          const queryKey = 'redirect_to';
          return <Link to={{ pathname: router.query[queryKey] ?? '/dashboard' }}>Continue</Link>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth redirects that trust snake-case callback URL params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          const queryKey = 'callback_url';
          const next = new URLSearchParams(window.location.search).get(queryKey);
          return redirect(next ?? '/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-open-redirect-risk')).toBe(true);
  });

  it('flags auth flows that redirect directly to external URLs during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginRedirect.tsx',
      code: `
        export function LoginRedirect() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/continue');
          }

          return <button onClick={handleSubmit}>Sign in</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-external-redirect-risk')).toBe(true);
  });

  it('flags provider authorize URLs without state during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-state-missing')).toBe(true);
  });

  it('does not flag provider authorize URLs with state during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-state-missing')).toBe(false);
  });

  it('flags provider code-flow URLs without PKCE during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-pkce-missing')).toBe(true);
  });

  it('does not flag provider code-flow URLs with PKCE during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&state=opaque123&code_challenge=pkce123&code_challenge_method=S256');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-pkce-missing')).toBe(false);
  });

  it('flags provider id_token URLs without nonce during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=id_token&state=opaque123');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-nonce-missing')).toBe(true);
  });

  it('does not flag provider id_token URLs with nonce during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginProvider.tsx',
      code: `
        export function LoginProvider() {
          async function handleSubmit() {
            await auth.signIn();
            return redirect('https://accounts.example.com/oauth2/authorize?client_id=web&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=id_token&state=opaque123&nonce=nonce123');
          }

          return <button onClick={handleSubmit}>Sign in with SSO</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-provider-nonce-missing')).toBe(false);
  });

  it('flags auth callback flows that never scrub URL codes during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          return <p>Signing you in...</p>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-url-scrub-missing')).toBe(true);
  });

  it('flags auth callback flows that never handle provider error returns during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          return <p>Signing you in...</p>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-error-missing')).toBe(true);
  });

  it('does not flag auth callback flows when provider error returns are handled during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const providerError = searchParams.get('error');
          if (providerError) {
            return <p>Authentication failed. Please try again.</p>;
          }

          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-error-missing')).toBe(false);
  });

  it('flags auth callback flows that read provider state without validating it during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const state = searchParams.get('state');
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          return <p data-state={state}>Signing you in...</p>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-state-validation-missing')).toBe(true);
  });

  it('does not flag auth callback flows when provider state is validated during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const returnedState = searchParams.get('state');
          const expectedState = sessionStorage.getItem('oauth_state');
          if (!returnedState || returnedState !== expectedState) {
            return <p>Authentication failed. Please try again.</p>;
          }

          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-state-validation-missing')).toBe(false);
  });

  it('flags auth callback flows that validate provider state but never clear stored state during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const returnedState = searchParams.get('state');
          const expectedState = sessionStorage.getItem('oauth_state');
          if (!returnedState || returnedState !== expectedState) {
            return <p>Authentication failed. Please try again.</p>;
          }

          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          history.replaceState({}, '', '/dashboard');
          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-state-teardown-missing')).toBe(true);
  });

  it('does not flag auth callback flows when stored provider state is cleared during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const returnedState = searchParams.get('state');
          const expectedState = sessionStorage.getItem('oauth_state');
          if (!returnedState || returnedState !== expectedState) {
            sessionStorage.removeItem('oauth_state');
            return <p>Authentication failed. Please try again.</p>;
          }

          sessionStorage.removeItem('oauth_state');
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-state-teardown-missing')).toBe(false);
  });

  it('flags auth callback failure handling that never routes back to sign-in during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const providerError = searchParams.get('error');
          if (providerError) {
            return <p>Authentication failed. Please try again.</p>;
          }

          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
          ],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-callback-entry-return-missing')).toBe(true);
  });

  it('does not flag auth callback failure handling when it routes back to sign-in during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const providerError = searchParams.get('error');
          if (providerError) {
            return <a href="/login">Back to sign in</a>;
          }

          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
          ],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-callback-entry-return-missing')).toBe(false);
  });

  it('flags auth callback flows that never surface success state or protected transition during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          return <p>Signing you in...</p>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          focusAreas: ['route-topology', 'state-handling'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-success-missing')).toBe(true);
  });

  it('does not flag auth callback flows when they transition into a protected route during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          history.replaceState({}, '', '/dashboard');
          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          focusAreas: ['route-topology', 'state-handling'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-success-missing')).toBe(false);
  });

  it('flags auth callback exchanges without explicit rejection handling during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
          }

          history.replaceState({}, '', '/dashboard');
          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-exchange-error-missing')).toBe(true);
  });

  it('does not flag auth callback exchanges when rejection handling is explicit during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code).catch(() => {
              toast.error('Unable to sign you in.');
            });
          }

          history.replaceState({}, '', '/dashboard');
          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-callback-exchange-error-missing')).toBe(false);
  });

  it('flags auth callback exchange failures that never route back to sign-in during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code).catch(() => {
              toast.error('Unable to sign you in.');
            });
          }

          return <p>Still working...</p>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-callback-entry-return-missing')).toBe(true);
  });

  it('does not flag auth callback exchange failures when they route back to sign-in during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code).catch(() => {
              history.replaceState({}, '', '/login');
            });
          }

          return <a href="/login">Back to sign in</a>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['hero'] },
          ],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-callback-entry-return-missing')).toBe(false);
  });

  it('does not flag auth callback flows when callback URLs are scrubbed during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const code = searchParams.get('code');
          if (code) {
            void auth.exchangeCodeForSession(code);
            history.replaceState({}, '', '/dashboard');
          }

          return redirect('/dashboard');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'callback', path: '/auth/callback', patternIds: ['form'] }],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-url-scrub-missing')).toBe(false);
  });

  it('flags auth callback error returns that never scrub provider params during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const providerError = searchParams.get('error');
          if (providerError) {
            return <a href="/login">Back to sign in</a>;
          }

          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
          ],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-url-scrub-missing')).toBe(true);
  });

  it('does not flag auth callback error returns when provider params are scrubbed during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/AuthCallback.tsx',
      code: `
        export function AuthCallback({ searchParams }) {
          const providerError = searchParams.get('error');
          if (providerError) {
            history.replaceState({}, '', '/login');
            return <a href="/login">Back to sign in</a>;
          }

          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['callback'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'callback', path: '/auth/callback', patternIds: ['form'] },
          ],
          focusAreas: ['security-hygiene', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-callback-url-scrub-missing')).toBe(false);
  });

  it('does not flag auth/session exit logic when logout returns users to an anonymous route during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const { status } = useSession();

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (status === 'loading') {
            return <Spinner />;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-exit-redirect-missing')).toBe(false);
  });

  it('flags auth/session exit logic that redirects away without tearing down the session during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const { status } = useSession();

          async function handleLogout() {
            return redirect('/login');
          }

          if (status === 'loading') {
            return <Spinner />;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-exit-teardown-missing')).toBe(true);
  });

  it('does not flag auth/session exit teardown gaps when logout explicitly signs out during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const { status } = useSession();

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (status === 'loading') {
            return <Spinner />;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-exit-teardown-missing')).toBe(false);
  });

  it('flags client-managed auth persistence that is never cleared during critique sign-out flows', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu({ token }) {
          localStorage.setItem('auth_token', token);
          document.cookie = \`auth_token=\${token}; path=/\`;
          fetch('/api/me', { headers: { Authorization: \`Bearer \${token}\` } });

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling', 'security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-storage-teardown-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'state-auth-cookie-teardown-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'state-auth-header-teardown-missing')).toBe(true);
  });

  it('does not treat Decantr dev-auth bypass storage as credential persistence during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          localStorage.setItem('decantr_authenticated', 'true');

          function handleLogout() {
            localStorage.removeItem('decantr_authenticated');
            return redirect('/login');
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling', 'security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-storage-teardown-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'security-auth-storage-write')).toBe(false);
  });

  it('flags client data caches that are never cleared during critique sign-out flows', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        import { useQueryClient } from '@tanstack/react-query';

        export function UserMenu() {
          const queryClient = useQueryClient();
          const { data: session } = useSession();

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (!session) {
            return null;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling', 'security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-cache-teardown-missing')).toBe(true);
  });

  it('flags auth refresh timers that are never torn down during critique sign-out flows', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const { data: session } = useSession();

          setInterval(() => auth.refreshSession(), 60_000);

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (!session) {
            return null;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-refresh-teardown-missing')).toBe(true);
  });

  it('flags realtime channels that are never torn down during critique sign-out flows', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const realtime = new WebSocket('wss://example.com/live');
          const { data: session } = useSession();

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (!session) {
            return null;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-realtime-teardown-missing')).toBe(true);
  });

  it('flags cross-tab auth coordination that is never torn down during critique sign-out flows', () => {
    const report = critiqueSource({
      filePath: 'src/components/UserMenu.tsx',
      code: `
        export function UserMenu() {
          const authChannel = new BroadcastChannel('auth');
          window.addEventListener('storage', syncSession);
          const { data: session } = useSession();

          async function handleLogout() {
            await auth.signOut();
            return redirect('/login');
          }

          if (!session) {
            return null;
          }

          return <button onClick={handleLogout}>Sign out</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-coordination-teardown-missing')).toBe(true);
  });

  it('flags protected session-aware files that never branch on unauthenticated state during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-handling-missing')).toBe(true);
  });

  it('flags protected session-aware files that branch on auth loss but never return users to an anonymous route during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return null;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-redirect-missing')).toBe(true);
  });

  it('flags protected session-aware files that render protected shells inside loading branches during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <DashboardShell path="/dashboard" pendingSession={session} />;
          }

          if (!session) {
            return redirect('/login');
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth/session loading branches that return nothing during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return null;
          }

          if (!session) {
            return redirect('/login');
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-blank-render')).toBe(true);
  });

  it('flags auth/session loading branches that redirect to anonymous routes during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return redirect('/login');
          }

          if (!session) {
            return redirect('/login');
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-anonymous-redirect')).toBe(true);
  });

  it('flags unauthenticated branches that still render protected shells during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <DashboardShell path="/dashboard" />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags protected-looking unauthenticated shell renders even without explicit route props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <DashboardShell />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags protected-looking unauthenticated child renders even without explicit route props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <DashboardSummary />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still return outlet-like protected content during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Outlet />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that pass auth-scoped props into generic components during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <SummaryPanel currentUser={session?.user} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that pass auth-scoped props into generic components during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <SummaryPanel currentUser={session?.user} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still interpolate auth-scoped data into generic jsx during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <section>{session?.user?.email}</section>;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still interpolate auth-scoped data into generic jsx during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <section>{session?.user?.email}</section>;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route links inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <a href="/dashboard">Continue to dashboard</a>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected route links inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <a href="/dashboard">Continue to dashboard</a>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route actions inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <button onClick={() => navigate('/dashboard')}>Continue to dashboard</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected route actions inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <button onClick={() => navigate('/dashboard')}>Continue to dashboard</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected form actions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <form action="/dashboard">
                  <button type="submit">Continue to dashboard</button>
                </form>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected form actions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <form action="/dashboard">
                  <button type="submit">Continue to dashboard</button>
                </form>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected browser redirects inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <button onClick={() => window.location.assign('/dashboard')}>Continue to dashboard</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected browser redirects inside generic markup during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <button onClick={() => window.location.assign('/dashboard')}>Continue to dashboard</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still stash protected hidden redirects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <input type="hidden" name="redirectTo" value="/dashboard" />
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still stash protected hidden redirects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <input type="hidden" name="redirectTo" value="/dashboard" />
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still stash protected redirect metadata during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section data-redirect="/dashboard">
                <p>Loading account context...</p>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still stash protected redirect metadata during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section data-next="/dashboard">
                <p>Sign in again.</p>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still pass protected redirect props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard redirectTo="/dashboard" />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still pass protected redirect props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard returnTo="/dashboard" />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still pass protected redirect object props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard state={{ redirectTo: '/dashboard' }} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still pass protected redirect object props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard options={{ returnTo: '/dashboard' }} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still pass protected generic route objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard config={{ to: '/dashboard' }} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still pass protected generic route objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard config={{ path: '/dashboard' }} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still serialize protected route payloads during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={JSON.stringify({ redirectTo: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still serialize protected route payloads during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={JSON.stringify({ path: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still encode protected route payloads with URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={new URLSearchParams({ next: '/dashboard' }).toString()} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose raw URLSearchParams next payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={new URLSearchParams({ next: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still encode protected route payloads with URLSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={new URLSearchParams({ path: '/dashboard' }).toString()} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams route payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={new URLSearchParams({ path: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still encode protected route payloads with createSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={createSearchParams({ next: '/dashboard' }).toString()} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still encode protected route payloads with createSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={createSearchParams({ path: '/dashboard' }).toString()} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose raw createSearchParams route payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={createSearchParams({ next: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw createSearchParams path payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={createSearchParams({ path: '/dashboard' })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still encode auth-scoped payloads with JSON.stringify during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={JSON.stringify({ label: session?.user?.email })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still encode auth-scoped payloads with createSearchParams during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={createSearchParams({ email: currentUser?.email }).toString()} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw createSearchParams auth payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={createSearchParams({ email: currentUser?.email })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose URLSearchParams payload objects in route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ payload: new URLSearchParams({ next: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams route payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: new URLSearchParams({ path: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose direct URLSearchParams auth payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard payload={new URLSearchParams({ email: currentUser?.email })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose raw URLSearchParams auth payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ payload: new URLSearchParams({ email: session?.user?.email }), href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw URLSearchParams auth payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: new URLSearchParams({ email: currentUser?.email }), href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose raw URLSearchParams auth payload objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <StatusCard payload={new URLSearchParams({ email: session?.user?.email })} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route props through JSX expressions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Navigate to={'/dashboard'} replace />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ to: '/dashboard', label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose helper-generated protected route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { generatePath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ to: generatePath('/dashboard'), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose helper-prop route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ redirectTo: '/dashboard', label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose nested redirect state arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ state: { redirectTo: '/dashboard' }, label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose serialized redirect payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ payload: JSON.stringify({ redirectTo: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose auth-scoped data arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ label: session?.user?.email, href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose nested auth-scoped data arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ meta: { label: session?.user?.email }, href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose encoded auth-scoped payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ payload: JSON.stringify({ label: session?.user?.email }), href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected helper props through JSX expressions during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard redirectTo={\`/dashboard\`} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ href: '/dashboard', label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose helper-generated protected route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createPath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ pathname: createPath({ pathname: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose helper-generated helper-prop route arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { generatePath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ returnTo: generatePath('/dashboard'), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose nested redirect state arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ options: { returnTo: '/dashboard' }, label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose encoded redirect payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: createSearchParams({ path: '/dashboard' }).toString(), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw createSearchParams route payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: createSearchParams({ path: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose raw createSearchParams next payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <QuickNav items={[{ payload: createSearchParams({ next: '/dashboard' }), label: 'Dashboard' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose auth-scoped data arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ label: currentUser?.email, href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose nested auth-scoped data arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ details: { subtitle: currentUser?.email }, href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose encoded auth-scoped payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: createSearchParams({ email: currentUser?.email }).toString(), href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose raw createSearchParams auth payload arrays during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createSearchParams } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();
          const currentUser = session?.user;

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <Sidebar links={[{ payload: createSearchParams({ email: currentUser?.email }), href: '/login' }]} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route objects through pathname props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Navigate to={{ pathname: '/dashboard' }} replace />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected route objects through pathname props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard redirect={{ pathname: '/dashboard' }} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose protected route objects through callback navigation during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <button onClick={() => navigate({ pathname: '/dashboard' })}>Continue</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose protected route objects through callback navigation during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <button onClick={() => navigate({ pathname: '/dashboard' })}>Continue</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose helper-generated protected route props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { generatePath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Navigate to={generatePath('/dashboard')} replace />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose helper-generated protected route props during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { generatePath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return <StatusCard redirectTo={generatePath('/dashboard')} />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose helper-generated protected callback destinations during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createPath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return (
              <section>
                <button onClick={() => navigate(createPath({ pathname: '/dashboard' }))}>Continue</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose helper-generated protected callback destinations during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createPath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <button onClick={() => navigate(createPath({ pathname: '/dashboard' }))}>Continue</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('flags auth-loading branches that still expose helper-generated protected route objects during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { generatePath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Navigate to={{ pathname: generatePath('/dashboard') }} replace />;
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-protected-render')).toBe(true);
  });

  it('flags unauthenticated branches that still expose helper-generated protected route objects through callback navigation during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGate.tsx',
      code: `
        import { createPath } from 'react-router-dom';

        export function DashboardGate() {
          const { status, data: session } = useSession();

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return (
              <section>
                <button onClick={() => navigate({ pathname: createPath({ pathname: '/dashboard' }) })}>Continue</button>
              </section>
            );
          }

          return <DashboardShell session={session} path="/dashboard" />;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['sidebar'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['sidebar'] }],
          focusAreas: ['route-topology', 'state-handling'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-session-loss-protected-render')).toBe(true);
  });

  it('does not flag auth entry flows when success transitions into the protected app during critique', () => {
    const report = critiqueSource({
      filePath: 'src/routes/LoginPage.tsx',
      code: `
        export function LoginPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await auth.signIn();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'login', path: '/login', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(false);
  });

  it('does not flag auth/session critique files when loading and error states are present', () => {
    const report = critiqueSource({
      filePath: 'src/routes/DashboardGuard.tsx',
      code: `
        export function DashboardGuard() {
          const { data: session, status } = useSession();
          const [errorMessage, setErrorMessage] = useState('');

          async function handleRefresh() {
            try {
              await auth.refresh();
            } catch (error) {
              setErrorMessage(String(error));
            }
          }

          if (status === 'loading') {
            return <Spinner />;
          }

          if (!session) {
            return redirect('/login');
          }

          return (
            <>
              {errorMessage ? <p role="alert">{errorMessage}</p> : null}
              <button onClick={handleRefresh}>Refresh</button>
              <Dashboard />
            </>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['dashboard'], patternIds: ['panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] }],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-loading-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'state-auth-error-missing')).toBe(false);
  });

  it('flags recovery critique files that omit a visible success confirmation', () => {
    const report = critiqueSource({
      filePath: 'src/routes/ForgotPasswordPage.tsx',
      code: `
        export function ForgotPasswordPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await requestPasswordReset();
            return redirect('/login');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <button type="submit">Reset password</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['forgot-password'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] }],
          focusAreas: ['state-handling', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-recovery-success-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(false);
  });

  it('does not flag recovery critique files when confirmation state is present', () => {
    const report = critiqueSource({
      filePath: 'src/routes/ForgotPasswordPage.tsx',
      code: `
        export function ForgotPasswordPage() {
          const [successMessage, setSuccessMessage] = useState('');

          async function handleSubmit(event) {
            event.preventDefault();
            await requestPasswordReset();
            setSuccessMessage('Check your email');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              {successMessage ? <p role="status">{successMessage}</p> : null}
              <button type="submit">Reset password</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['forgot-password'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'forgot-password', path: '/forgot-password', patternIds: ['form'] }],
          focusAreas: ['state-handling', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-recovery-success-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(false);
  });

  it('flags registration critique files that show neither success state nor protected transition', () => {
    const report = critiqueSource({
      filePath: 'src/routes/RegisterPage.tsx',
      code: `
        export function RegisterPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await createAccount();
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="new-password" />
              <button type="submit">Create account</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['state-handling', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-registration-success-missing')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(false);
  });

  it('does not flag registration critique files when they transition into the protected app', () => {
    const report = critiqueSource({
      filePath: 'src/routes/RegisterPage.tsx',
      code: `
        export function RegisterPage() {
          async function handleSubmit(event) {
            event.preventDefault();
            await createAccount();
            return redirect('/dashboard');
          }

          return (
            <form onSubmit={handleSubmit}>
              <input type="email" name="email" autoComplete="email" />
              <input type="password" name="password" autoComplete="new-password" />
              <button type="submit">Create account</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['register', 'dashboard'], patternIds: ['form', 'panel'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [
            { pageId: 'register', path: '/register', patternIds: ['form'] },
            { pageId: 'dashboard', path: '/dashboard', patternIds: ['panel'] },
          ],
          focusAreas: ['state-handling', 'route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'state-auth-registration-success-missing')).toBe(false);
    expect(report.findings.some(finding => finding.id === 'route-auth-success-redirect-missing')).toBe(false);
  });

  it('flags auth inputs that disable autocomplete during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="email" name="email" autoComplete="off" />
              <input type="password" name="password" autoComplete="off" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(true);
  });

  it('flags auth inputs whose autocomplete values do not match the field purpose during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="email" name="email" autoComplete="current-password" />
              <input type="password" name="password" autoComplete="email" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(true);
  });

  it('flags auth inputs with semantic type mismatches during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form method="post">
              <input type="text" name="email" autoComplete="email" />
              <input type="text" name="password" autoComplete="current-password" />
              <button type="submit">Sign in</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/login', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(true);
  });

  it('flags unlabeled form controls during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/LoginForm.tsx',
      code: `
        export function LoginForm() {
          return (
            <form>
              <input type="email" placeholder="Email" />
              <label>
                Password
                <input type="password" />
              </label>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/', patternIds: ['form'] }],
          focusAreas: ['accessibility'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'accessibility-form-control-label-missing')).toBe(true);
  });

  it('flags placeholder navigation targets during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/NavLinks.tsx',
      code: `
        export function NavLinks() {
          return (
            <nav>
              <a href="#">Overview</a>
              <Link to="javascript:void(0)">Settings</Link>
            </nav>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['overview', 'settings'], patternIds: ['nav'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [
            { pageId: 'overview', path: '/', patternIds: ['nav'] },
            { pageId: 'settings', path: '/settings', patternIds: ['nav'] },
          ],
          focusAreas: ['route-topology'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'route-placeholder-navigation-target')).toBe(true);
  });

  it('flags auth inputs without autocomplete hints during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/AuthForm.tsx',
      code: `
        export function AuthForm() {
          return (
            <form>
              <label htmlFor="email">Email</label>
              <input id="email" type="email" />
              <label htmlFor="password">Password</label>
              <input id="password" type="password" />
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/', patternIds: ['form'] }],
          focusAreas: ['accessibility', 'security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(true);
  });

  it('flags OTP inputs without one-time-code autocomplete during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/VerifyCodeForm.tsx',
      code: `
        export function VerifyCodeForm() {
          return (
            <form method="post">
              <label htmlFor="verification-code">Verification code</label>
              <input id="verification-code" name="verificationCode" type="text" />
              <button type="submit">Verify</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['verify'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'verify', path: '/verify', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(true);
  });

  it('accepts OTP inputs with one-time-code autocomplete during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/VerifyCodeForm.tsx',
      code: `
        export function VerifyCodeForm() {
          return (
            <form method="post">
              <label htmlFor="verification-code">Verification code</label>
              <input
                id="verification-code"
                name="verificationCode"
                type="text"
                autoComplete="one-time-code"
                inputMode="numeric"
              />
              <button type="submit">Verify</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['verify'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'verify', path: '/verify', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-autocomplete-missing')).toBe(false);
  });

  it('flags buttons inside forms that omit an explicit type', () => {
    const report = critiqueSource({
      filePath: 'src/components/ProfileForm.tsx',
      code: `
        export function ProfileForm() {
          return (
            <form>
              <button>Open help</button>
              <button type="submit">Save</button>
            </form>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['profile'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'profile', path: '/profile', patternIds: ['form'] }],
          focusAreas: ['motion-interaction'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'interaction-button-type-missing')).toBe(true);
  });

  it('flags auth-like credential writes into browser storage during critique', () => {
    const report = critiqueSource({
      filePath: 'src/lib/session.ts',
      code: `
        export function persistSession(token: string) {
          localStorage.setItem('auth_token', token);
          sessionStorage.jwt = token;
          document.cookie = \`auth_token=\${token}; path=/\`;
          fetch('/api/me', { headers: { Authorization: \`Bearer \${token}\` } });
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-storage-write')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-auth-cookie-write')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-auth-header-write')).toBe(true);
  });

  it('flags hardcoded secret literals and client-exposed secret env references during critique', () => {
    const report = critiqueSource({
      filePath: 'src/app/login/page.tsx',
      code: `
        'use client';

        const leaked = "sk_live_1234567890";
        const serviceRole = import.meta.env.VITE_SUPABASE_SERVICE_ROLE_KEY;

        export default function LoginPage() {
          return <button>Continue</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['login'], patternIds: ['form'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'login', path: '/', patternIds: ['form'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-hardcoded-secret-literal')).toBe(true);
    expect(report.findings.some(finding => finding.id === 'security-client-secret-env-reference')).toBe(true);
  });

  it('flags wildcard postMessage target origins during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/EmbedBridge.tsx',
      code: `
        export function EmbedBridge() {
          function sendReady(payload: unknown) {
            window.parent.postMessage({ type: 'ready', payload }, '*');
          }

          return <button onClick={() => sendReady({ ok: true })}>Send</button>;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-postmessage-wildcard-origin')).toBe(true);
  });

  it('flags imperative new-tab opens without noopener protections during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/OpenDocs.tsx',
      code: `
        export function OpenDocs() {
          return (
            <button
              onClick={() => {
                window.open('https://example.com/docs', '_blank');
              }}
            >
              Open docs
            </button>
          );
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-window-open-noopener-missing')).toBe(true);
  });

  it('flags message listeners that do not validate event origin during critique', () => {
    const report = critiqueSource({
      filePath: 'src/components/InboundBridge.tsx',
      code: `
        export function InboundBridge() {
          window.addEventListener('message', (event) => {
            if (event.data?.type === 'sync') {
              console.log(event.data.payload);
            }
          });

          return null;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-message-listener-origin-check-missing')).toBe(true);
  });

  it('flags auth cookies that are set without explicit hardening during critique', () => {
    const report = critiqueSource({
      filePath: 'src/server/session.ts',
      code: `
        export async function issueSession(cookies, token) {
          cookies.set('session_token', token, {
            secure: true,
          });
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-cookie-hardening-missing')).toBe(true);
  });

  it('flags insecure realtime transport constructors during critique', () => {
    const report = critiqueSource({
      filePath: 'src/lib/socket.ts',
      code: `
        export function connectRealtime() {
          return new WebSocket('ws://example.com/live');
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: [],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-transport-endpoint-insecure')).toBe(true);
  });

  it('flags under-hardened auth set-cookie headers during critique', () => {
    const report = critiqueSource({
      filePath: 'src/server/route.ts',
      code: `
        export function issueSession(res, token) {
          res.setHeader('Set-Cookie', 'session_token=' + token + '; Path=/; Secure');
          return res;
        }
      `,
      reviewPack: {
        $schema: 'https://decantr.ai/schemas/review-pack.v1.json',
        packVersion: '1.0.0',
        packType: 'review',
        objective: 'Review generated output against the compiled Decantr contract.',
        target: { platform: 'web', framework: 'react', runtime: 'spa', adapter: 'react-vite' },
        preset: null,
        scope: { appId: 'app', pageIds: ['home'], patternIds: ['hero'] },
        requiredSetup: [],
        allowedVocabulary: [],
        examples: [],
        antiPatterns: [],
        successChecks: [],
        tokenBudget: { target: 1400, max: 2200, strategy: [] },
        data: {
          reviewType: 'app',
          shell: 'sidebar-main',
          theme: { id: 'luminarum', mode: 'dark', shape: 'rounded' },
          routing: 'hash',
          features: ['auth'],
          routes: [{ pageId: 'home', path: '/', patternIds: ['hero'] }],
          focusAreas: ['security-hygiene'],
          workflow: [],
        },
        renderedMarkdown: '# Review Pack\n',
      },
    });

    expect(report.findings.some(finding => finding.id === 'security-auth-cookie-hardening-missing')).toBe(true);
  });
});
