@adrkit/evaluator 0.1.0

package/dist/index.js

@@ -0,0 +1,2064 @@
+// src/catalog.ts
+var RULE_IDS = [
+  "schema-valid",
+  "id-unique",
+  "supersession-consistent",
+  "no-orphan-refs",
+  "affects-resolvable",
+  "affects-overlap",
+  "scope-hierarchy",
+  "assertions-compile",
+  "assertions-pass",
+  "decider-resolvable",
+  "expiry-sane"
+];
+var RULE_SEVERITY = {
+  "schema-valid": "error",
+  "id-unique": "error",
+  "supersession-consistent": "error",
+  "no-orphan-refs": "error",
+  "affects-resolvable": "warn",
+  "affects-overlap": "warn",
+  "scope-hierarchy": "error",
+  "assertions-compile": "error",
+  "assertions-pass": "warn",
+  "decider-resolvable": "warn",
+  "expiry-sane": "info"
+};
+var ROUTING_TRIGGERS = [
+  "one-way-door",
+  "cost-threshold",
+  "security-surface",
+  "data-residency",
+  "regulatory",
+  "contradicts-accepted-adr",
+  "agent-authored-production",
+  "human-requested"
+];
+var REASON_CODES = [
+  "schema-valid.ok",
+  "schema-valid.file-read",
+  "schema-valid.parse-error",
+  "schema-valid.contract-error",
+  "id-unique.ok",
+  "id-unique.collision",
+  "supersession-consistent.ok",
+  "supersession-consistent.dangling-superseded-by",
+  "supersession-consistent.non-reciprocal",
+  "supersession-consistent.cycle",
+  "no-orphan-refs.ok",
+  "no-orphan-refs.dangling-supersedes",
+  "no-orphan-refs.dangling-relates-to",
+  "no-orphan-refs.federated-log-absent",
+  "affects-resolvable.ok",
+  "affects-resolvable.zero-targets",
+  "affects-resolvable.backing-absent",
+  "affects-resolvable.resolver-absent",
+  "affects-overlap.accepted-intersection",
+  "affects-overlap.no-accepted-corpus",
+  "affects-overlap.backing-absent",
+  "affects-overlap.none",
+  "scope-hierarchy.ok",
+  "scope-hierarchy.contradicts-org-assertion",
+  "scope-hierarchy.evidence-absent",
+  "scope-hierarchy.engine-absent",
+  "scope-hierarchy.source-absent",
+  "scope-hierarchy.base-input-absent",
+  "scope-hierarchy.proposed-input-absent",
+  "scope-hierarchy.not-applicable-scope",
+  "assertions-compile.ok",
+  "assertions-compile.none",
+  "assertions-compile.no-source",
+  "assertions-compile.ambiguous-source",
+  "assertions-compile.parse-error",
+  "assertions-compile.engine-absent",
+  "assertions-compile.source-absent",
+  "assertions-pass.ok",
+  "assertions-pass.none",
+  "assertions-pass.evaluates-false",
+  "assertions-pass.evaluation-error",
+  "assertions-pass.engine-absent",
+  "assertions-pass.input-absent",
+  "decider-resolvable.ok",
+  "decider-resolvable.none-declared",
+  "decider-resolvable.zero-match",
+  "decider-resolvable.ambiguous-match",
+  "decider-resolvable.directory-absent",
+  "expiry-sane.ok",
+  "expiry-sane.past-or-equal",
+  "not-evaluated.schema-invalid",
+  "not-evaluated.prereq-failed",
+  "route.escalate.one-way-door",
+  "route.escalate.cost-threshold",
+  "route.escalate.security-surface",
+  "route.escalate.data-residency",
+  "route.escalate.regulatory",
+  "route.escalate.contradicts-accepted-adr",
+  "route.escalate.agent-authored-production",
+  "route.escalate.human-requested",
+  "route.evidence.one-way-door.not-proven",
+  "route.evidence.cost-threshold.not-proven",
+  "route.evidence.security-surface.not-proven",
+  "route.evidence.data-residency.not-proven",
+  "route.evidence.regulatory.not-proven",
+  "route.evidence.contradicts-accepted-adr.not-proven",
+  "route.evidence.agent-authored-production.not-proven",
+  "route.evidence.human-requested.not-proven",
+  "route.target.not-required",
+  "route.target.deciders",
+  "route.target.codeowners",
+  "route.target.catalog-owner",
+  "route.target.unresolved"
+];
+var REASON_CODE_SET = new Set(REASON_CODES);
+function isReasonCode(value) {
+  return REASON_CODE_SET.has(value);
+}
+var RULE_REASON_PRECEDENCE = {
+  "schema-valid": [
+    "schema-valid.ok",
+    "schema-valid.file-read",
+    "schema-valid.parse-error",
+    "schema-valid.contract-error"
+  ],
+  "id-unique": ["id-unique.ok", "id-unique.collision"],
+  "supersession-consistent": [
+    "supersession-consistent.ok",
+    "supersession-consistent.dangling-superseded-by",
+    "supersession-consistent.non-reciprocal",
+    "supersession-consistent.cycle"
+  ],
+  "no-orphan-refs": [
+    "no-orphan-refs.ok",
+    "no-orphan-refs.dangling-supersedes",
+    "no-orphan-refs.dangling-relates-to",
+    "no-orphan-refs.federated-log-absent"
+  ],
+  "affects-resolvable": [
+    "affects-resolvable.ok",
+    "affects-resolvable.zero-targets",
+    "affects-resolvable.backing-absent",
+    "affects-resolvable.resolver-absent"
+  ],
+  "affects-overlap": [
+    "affects-overlap.accepted-intersection",
+    "affects-overlap.no-accepted-corpus",
+    "affects-overlap.backing-absent",
+    "affects-overlap.none"
+  ],
+  "scope-hierarchy": [
+    "scope-hierarchy.ok",
+    "scope-hierarchy.contradicts-org-assertion",
+    "scope-hierarchy.evidence-absent",
+    "scope-hierarchy.engine-absent",
+    "scope-hierarchy.source-absent",
+    "scope-hierarchy.base-input-absent",
+    "scope-hierarchy.proposed-input-absent",
+    "scope-hierarchy.not-applicable-scope"
+  ],
+  "assertions-compile": [
+    "assertions-compile.ok",
+    "assertions-compile.none",
+    "assertions-compile.no-source",
+    "assertions-compile.ambiguous-source",
+    "assertions-compile.parse-error",
+    "assertions-compile.engine-absent",
+    "assertions-compile.source-absent"
+  ],
+  "assertions-pass": [
+    "assertions-pass.ok",
+    "assertions-pass.none",
+    "assertions-pass.evaluates-false",
+    "assertions-pass.evaluation-error",
+    "assertions-pass.engine-absent",
+    "assertions-pass.input-absent"
+  ],
+  "decider-resolvable": [
+    "decider-resolvable.ok",
+    "decider-resolvable.none-declared",
+    "decider-resolvable.zero-match",
+    "decider-resolvable.ambiguous-match",
+    "decider-resolvable.directory-absent"
+  ],
+  "expiry-sane": ["expiry-sane.ok", "expiry-sane.past-or-equal"]
+};
+var ROUTE_ESCALATE_CODE = {
+  "one-way-door": "route.escalate.one-way-door",
+  "cost-threshold": "route.escalate.cost-threshold",
+  "security-surface": "route.escalate.security-surface",
+  "data-residency": "route.escalate.data-residency",
+  regulatory: "route.escalate.regulatory",
+  "contradicts-accepted-adr": "route.escalate.contradicts-accepted-adr",
+  "agent-authored-production": "route.escalate.agent-authored-production",
+  "human-requested": "route.escalate.human-requested"
+};
+var ROUTE_EVIDENCE_NOT_PROVEN_CODE = {
+  "one-way-door": "route.evidence.one-way-door.not-proven",
+  "cost-threshold": "route.evidence.cost-threshold.not-proven",
+  "security-surface": "route.evidence.security-surface.not-proven",
+  "data-residency": "route.evidence.data-residency.not-proven",
+  regulatory: "route.evidence.regulatory.not-proven",
+  "contradicts-accepted-adr": "route.evidence.contradicts-accepted-adr.not-proven",
+  "agent-authored-production": "route.evidence.agent-authored-production.not-proven",
+  "human-requested": "route.evidence.human-requested.not-proven"
+};
+var RUBRIC_VERSION = "0.1.0";
+
+// src/keys.ts
+function makeAssertionKey(log, path, id) {
+  return JSON.stringify([log ?? "", path, id]);
+}
+function assertionKeyForAssertion(record, assertion) {
+  return makeAssertionKey(record.log, record.path, assertion.id);
+}
+function isCanonicalAssertionKey(key) {
+  let parsed;
+  try {
+    parsed = JSON.parse(key);
+  } catch {
+    return false;
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 3)
+    return false;
+  if (!parsed.every((part) => typeof part === "string"))
+    return false;
+  return JSON.stringify(parsed) === key;
+}
+function parseAssertionKey(key) {
+  if (!isCanonicalAssertionKey(key))
+    return;
+  const [log, path, id] = JSON.parse(key);
+  return { log, path, id };
+}
+function canonicalTargetKey(id) {
+  return `${id.kind}:${id.id}`;
+}
+
+// src/compare.ts
+function byCodeUnit(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// src/report/order.ts
+function cmp(a, b) {
+  return byCodeUnit(a ?? "", b ?? "");
+}
+function targetKey(target) {
+  return target ? canonicalTargetKey(target) : "";
+}
+function compareRuleFindings(a, b) {
+  return cmp(a.candidateAdr, b.candidateAdr) || cmp(a.relatedAdr, b.relatedAdr) || cmp(a.matcherKey ?? a.assertionKey, b.matcherKey ?? b.assertionKey) || cmp(targetKey(a.target), targetKey(b.target)) || cmp(a.recordPath, b.recordPath) || cmp(a.field, b.field) || cmp(a.adr, b.adr) || cmp(a.message, b.message);
+}
+function sortRuleFindings(findings) {
+  return [...findings].sort(compareRuleFindings);
+}
+var RULE_INDEX = new Map(RULE_IDS.map((rule, index) => [rule, index]));
+
+// src/report/aggregate.ts
+var STATUS_RANK = { fail: 3, inert: 2, pass: 1 };
+function winningStatus(subs) {
+  let winner = "pass";
+  for (const sub of subs) {
+    if (STATUS_RANK[sub.status] > STATUS_RANK[winner])
+      winner = sub.status;
+  }
+  return winner;
+}
+function primaryReason(rule, winners) {
+  const present = new Set(winners.map((sub) => sub.reason));
+  for (const code of RULE_REASON_PRECEDENCE[rule]) {
+    if (present.has(code))
+      return code;
+  }
+  return RULE_REASON_PRECEDENCE[rule][0];
+}
+function aggregate(rule, subs, evidence) {
+  const status = subs.length === 0 ? "pass" : winningStatus(subs);
+  const winners = subs.filter((sub) => sub.status === status);
+  const reason = winners.length === 0 ? RULE_REASON_PRECEDENCE[rule][0] : primaryReason(rule, winners);
+  const findings = sortRuleFindings(subs.flatMap((sub) => sub.finding ? [sub.finding] : []));
+  const severity = status === "fail" ? RULE_SEVERITY[rule] : undefined;
+  return {
+    rule,
+    status,
+    ...severity ? { severity } : {},
+    reason,
+    findings,
+    ...evidence ? { evidence } : {}
+  };
+}
+
+// src/rules/kernel.ts
+function passResult(rule, reason = RULE_REASON_PRECEDENCE[rule][0]) {
+  return { rule, status: "pass", reason, findings: [] };
+}
+function inertResult(rule, reason, finding) {
+  return { rule, status: "inert", reason, findings: finding ? [finding] : [] };
+}
+function notEvaluated(rule, reason) {
+  return { rule, status: "not-evaluated", reason, findings: [] };
+}
+
+// src/rules/context.ts
+function acceptedRecordsExcludingCandidate(records, proposalPath) {
+  return records.filter((record) => record.frontmatter.status === "accepted" && record.path !== proposalPath);
+}
+
+// src/rules/schema-valid.ts
+var PARSE_RULES = new Set(["frontmatter-parse", "frontmatter-fence"]);
+function reasonForFinding(finding) {
+  if (finding.rule === "file-read")
+    return "schema-valid.file-read";
+  if (PARSE_RULES.has(finding.rule))
+    return "schema-valid.parse-error";
+  return "schema-valid.contract-error";
+}
+function toRuleFinding(finding) {
+  return {
+    reason: reasonForFinding(finding),
+    ...finding.message ? { message: finding.message } : {},
+    ...finding.path ? { recordPath: finding.path } : {},
+    ...finding.field ? { field: finding.field } : {},
+    lowerLevel: {
+      rule: finding.rule,
+      ...finding.path ? { path: finding.path } : {},
+      ...finding.id ? { id: finding.id } : {},
+      ...finding.field ? { field: finding.field } : {},
+      ...finding.pattern ? { pattern: finding.pattern } : {}
+    }
+  };
+}
+function evaluateSchemaValid(resolution) {
+  const findings = resolution.schemaFindings;
+  if (findings.length === 0) {
+    return passResult("schema-valid");
+  }
+  const subs = findings.map((finding) => {
+    const ruleFinding = toRuleFinding(finding);
+    return { status: "fail", reason: ruleFinding.reason, finding: ruleFinding };
+  });
+  return aggregate("schema-valid", subs);
+}
+
+// src/rules/id-unique.ts
+function key(log, id) {
+  return JSON.stringify([log ?? "", id]);
+}
+function corpusKey(record) {
+  return key(record.log, record.frontmatter.id);
+}
+function federatedKeys(snapshots) {
+  const keys = [];
+  for (const snapshot of snapshots ?? []) {
+    for (const id of snapshot.adrIds)
+      keys.push(key(snapshot.log, id));
+  }
+  return keys;
+}
+function evaluateIdUnique(ctx) {
+  const candidate = key(ctx.proposed.log, ctx.proposed.frontmatter.id);
+  let occurrences = 0;
+  for (const record of ctx.corpusRecords) {
+    if (corpusKey(record) === candidate)
+      occurrences += 1;
+  }
+  for (const federated of federatedKeys(ctx.input.federatedLogs)) {
+    if (federated === candidate)
+      occurrences += 1;
+  }
+  if (occurrences <= 1) {
+    return passResult("id-unique");
+  }
+  const finding = {
+    reason: "id-unique.collision",
+    message: `ADR id "${ctx.proposed.frontmatter.id}" is not unique within log "${ctx.proposed.log ?? ""}"`,
+    adr: ctx.proposed.frontmatter.id,
+    candidateAdr: ctx.proposed.frontmatter.id,
+    recordPath: ctx.proposed.path,
+    field: "id",
+    lowerLevel: { rule: "unique-id", path: ctx.proposed.path, id: ctx.proposed.frontmatter.id, field: "id" }
+  };
+  const subs = [{ status: "fail", reason: "id-unique.collision", finding }];
+  return aggregate("id-unique", subs);
+}
+
+// src/rules/supersession-consistent.ts
+import { buildAdrGraph } from "@adrkit/core";
+function hasSupersedesCycle(records) {
+  const graph = buildAdrGraph(records);
+  const adjacency = new Map;
+  for (const edge of graph.edges) {
+    if (edge.kind !== "supersedes")
+      continue;
+    const list = adjacency.get(edge.from) ?? [];
+    list.push(edge.to);
+    adjacency.set(edge.from, list);
+  }
+  const WHITE = 0;
+  const GRAY = 1;
+  const BLACK = 2;
+  const color = new Map;
+  const nodes = graph.nodes.map((node) => node.id);
+  function visit(node) {
+    color.set(node, GRAY);
+    for (const next of adjacency.get(node) ?? []) {
+      const state = color.get(next) ?? WHITE;
+      if (state === GRAY)
+        return true;
+      if (state === WHITE && visit(next))
+        return true;
+    }
+    color.set(node, BLACK);
+    return false;
+  }
+  for (const node of nodes) {
+    if ((color.get(node) ?? WHITE) === WHITE && visit(node))
+      return true;
+  }
+  return false;
+}
+function evaluateSupersessionConsistent(ctx) {
+  const records = ctx.corpusRecords;
+  const ids = new Set(records.map((record) => record.frontmatter.id));
+  const supersededByById = new Map;
+  for (const record of records) {
+    if (record.frontmatter.supersededBy) {
+      supersededByById.set(record.frontmatter.id, record.frontmatter.supersededBy);
+    }
+  }
+  const subs = [];
+  const seenPairs = new Set;
+  const danglingRefs = new Set;
+  for (const record of records) {
+    const target = record.frontmatter.supersededBy;
+    if (target && !ids.has(target)) {
+      danglingRefs.add(`${record.frontmatter.id}->${target}`);
+      const finding = {
+        reason: "supersession-consistent.dangling-superseded-by",
+        message: `supersededBy "${target}" does not resolve to a record in the corpus`,
+        adr: record.frontmatter.id,
+        candidateAdr: record.frontmatter.id,
+        relatedAdr: target,
+        recordPath: record.path,
+        field: "supersededBy",
+        lowerLevel: { rule: "dangling-supersededBy", path: record.path, id: record.frontmatter.id, field: "supersededBy" }
+      };
+      subs.push({ status: "fail", reason: "supersession-consistent.dangling-superseded-by", finding });
+    }
+  }
+  function nonReciprocal(fromId, toId, path, field) {
+    const key2 = [fromId, toId].sort().join("|");
+    if (seenPairs.has(key2))
+      return;
+    seenPairs.add(key2);
+    const finding = {
+      reason: "supersession-consistent.non-reciprocal",
+      message: `supersedes/supersededBy between "${fromId}" and "${toId}" is not reciprocal`,
+      adr: fromId,
+      candidateAdr: fromId,
+      relatedAdr: toId,
+      recordPath: path,
+      field,
+      lowerLevel: { rule: "non-reciprocal", path, id: fromId, field }
+    };
+    subs.push({ status: "fail", reason: "supersession-consistent.non-reciprocal", finding });
+  }
+  for (const record of records) {
+    for (const target of record.frontmatter.supersedes) {
+      if (!ids.has(target))
+        continue;
+      if (supersededByById.get(target) !== record.frontmatter.id) {
+        nonReciprocal(record.frontmatter.id, target, record.path, "supersedes");
+      }
+    }
+  }
+  const supersedesPairs = new Set;
+  for (const record of records) {
+    for (const target of record.frontmatter.supersedes) {
+      supersedesPairs.add(`${record.frontmatter.id}=>${target}`);
+    }
+  }
+  for (const record of records) {
+    const target = record.frontmatter.supersededBy;
+    if (!target || !ids.has(target))
+      continue;
+    if (danglingRefs.has(`${record.frontmatter.id}->${target}`))
+      continue;
+    if (!supersedesPairs.has(`${target}=>${record.frontmatter.id}`)) {
+      nonReciprocal(record.frontmatter.id, target, record.path, "supersededBy");
+    }
+  }
+  if (hasSupersedesCycle(records)) {
+    subs.push({
+      status: "fail",
+      reason: "supersession-consistent.cycle",
+      finding: {
+        reason: "supersession-consistent.cycle",
+        message: "The supersedes relation contains a cycle",
+        lowerLevel: { rule: "supersedes-cycle" }
+      }
+    });
+  }
+  if (subs.length === 0)
+    return passResult("supersession-consistent");
+  return aggregate("supersession-consistent", subs);
+}
+
+// src/rules/no-orphan-refs.ts
+function parseRef(ref) {
+  const idx = ref.indexOf(":");
+  if (idx <= 0)
+    return { id: ref };
+  return { log: ref.slice(0, idx), id: ref.slice(idx + 1) };
+}
+function evaluateNoOrphanRefs(ctx) {
+  const resolutionLog = ctx.input.resolutionLog;
+  const localIds = new Set;
+  const knownLogs = new Map;
+  for (const record of ctx.corpusRecords) {
+    if (record.log === undefined || record.log === resolutionLog) {
+      localIds.add(record.frontmatter.id);
+    }
+    if (record.log !== undefined) {
+      const set = knownLogs.get(record.log) ?? new Set;
+      set.add(record.frontmatter.id);
+      knownLogs.set(record.log, set);
+    }
+  }
+  for (const snapshot of ctx.input.federatedLogs ?? []) {
+    const set = knownLogs.get(snapshot.log) ?? new Set;
+    for (const id of snapshot.adrIds)
+      set.add(id);
+    knownLogs.set(snapshot.log, set);
+  }
+  const subs = [];
+  function classify(ref) {
+    const parsed = parseRef(ref);
+    if (parsed.log === undefined || parsed.log === resolutionLog) {
+      return localIds.has(parsed.id) ? "resolved" : "dangling";
+    }
+    const known = knownLogs.get(parsed.log);
+    if (!known)
+      return "federated-absent";
+    return known.has(parsed.id) ? "resolved" : "dangling";
+  }
+  function check(record, field, refs) {
+    const danglingReason = field === "supersedes" ? "no-orphan-refs.dangling-supersedes" : "no-orphan-refs.dangling-relates-to";
+    const lowerRule = field === "supersedes" ? "dangling-supersedes" : "dangling-relatesTo";
+    for (const ref of refs) {
+      const outcome = classify(ref);
+      if (outcome === "resolved")
+        continue;
+      if (outcome === "federated-absent") {
+        const finding2 = {
+          reason: "no-orphan-refs.federated-log-absent",
+          message: `Federated ref "${ref}" has no external-log snapshot; reference is inert`,
+          candidateAdr: record.frontmatter.id,
+          relatedAdr: ref,
+          recordPath: record.path,
+          field
+        };
+        subs.push({ status: "inert", reason: "no-orphan-refs.federated-log-absent", finding: finding2 });
+        continue;
+      }
+      const finding = {
+        reason: danglingReason,
+        message: `Reference "${ref}" in ${field} does not resolve to a record in the corpus`,
+        adr: record.frontmatter.id,
+        candidateAdr: record.frontmatter.id,
+        relatedAdr: ref,
+        recordPath: record.path,
+        field,
+        lowerLevel: { rule: lowerRule, path: record.path, id: record.frontmatter.id, field }
+      };
+      subs.push({ status: "fail", reason: danglingReason, finding });
+    }
+  }
+  for (const record of ctx.corpusRecords) {
+    check(record, "supersedes", record.frontmatter.supersedes);
+    check(record, "relatesTo", record.frontmatter.relatesTo);
+  }
+  if (subs.length === 0)
+    return passResult("no-orphan-refs");
+  return aggregate("no-orphan-refs", subs);
+}
+
+// src/targets/canonical.ts
+function normalizePathId(path) {
+  return path.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function makeTargetId(kind, id) {
+  return { kind, id: kind === "path" ? normalizePathId(id) : id };
+}
+function anyMatcherInert(resolution) {
+  return resolution.matchers.some((matcher) => matcher.status !== "resolved");
+}
+function sortedUnique(ids) {
+  const byKey = new Map;
+  for (const id of ids)
+    byKey.set(canonicalTargetKey(id), id);
+  return [...byKey.values()].sort((a, b) => byCodeUnit(canonicalTargetKey(a), canonicalTargetKey(b)));
+}
+function resolveRecordTargets(record, registry, inventory, resolutionLog) {
+  const context = { ...resolutionLog !== undefined ? { log: resolutionLog } : {}, inventory };
+  const positive = new Map;
+  const negated = new Set;
+  const matcherResolutions = [];
+  const matchers = record.frontmatter.affects;
+  let hasPositiveMatcher = false;
+  for (const matcher of matchers) {
+    const type = matcher.type;
+    if (!matcher.negate)
+      hasPositiveMatcher = true;
+    if (matcher.repo !== undefined && matcher.repo !== resolutionLog) {
+      matcherResolutions.push({ type, pattern: matcher.pattern, negate: matcher.negate, status: "resolved", ids: [] });
+      continue;
+    }
+    const port = registry.get(type);
+    if (!port) {
+      matcherResolutions.push({ type, pattern: matcher.pattern, negate: matcher.negate, status: "inert-resolver", ids: [] });
+      continue;
+    }
+    const resolution = port.resolve(matcher, context);
+    if (resolution.status === "inert") {
+      matcherResolutions.push({ type, pattern: matcher.pattern, negate: matcher.negate, status: "inert-backing", ids: [] });
+      continue;
+    }
+    matcherResolutions.push({ type, pattern: matcher.pattern, negate: matcher.negate, status: "resolved", ids: resolution.ids });
+    for (const id of resolution.ids) {
+      const key2 = canonicalTargetKey(id);
+      if (matcher.negate)
+        negated.add(key2);
+      else
+        positive.set(key2, id);
+    }
+  }
+  const finalIds = [...positive.entries()].filter(([key2]) => !negated.has(key2)).map(([, id]) => id);
+  const targets = sortedUnique(finalIds);
+  return {
+    targets,
+    targetKeys: new Set(targets.map(canonicalTargetKey)),
+    matchers: matcherResolutions,
+    hasMatchers: matchers.length > 0,
+    hasPositiveMatcher
+  };
+}
+
+// src/rules/affects-resolvable.ts
+function matcherFinding(ctx, matcher, reason, message) {
+  return {
+    reason,
+    candidateAdr: ctx.proposed.frontmatter.id,
+    matcherKey: `${matcher.type}:${matcher.pattern}`,
+    recordPath: ctx.proposed.path,
+    field: `affects.${matcher.type}`,
+    message
+  };
+}
+function evaluateAffectsResolvable(ctx) {
+  const resolution = resolveRecordTargets(ctx.proposed, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+  if (!resolution.hasMatchers)
+    return passResult("affects-resolvable");
+  const subs = [];
+  for (const matcher of resolution.matchers) {
+    if (matcher.status === "inert-resolver") {
+      subs.push({
+        status: "inert",
+        reason: "affects-resolvable.resolver-absent",
+        finding: matcherFinding(ctx, matcher, "affects-resolvable.resolver-absent", `No resolver registered for "${matcher.type}" matcher "${matcher.pattern}"`)
+      });
+      continue;
+    }
+    if (matcher.status === "inert-backing") {
+      subs.push({
+        status: "inert",
+        reason: "affects-resolvable.backing-absent",
+        finding: matcherFinding(ctx, matcher, "affects-resolvable.backing-absent", `No inventory backing for "${matcher.type}" matcher "${matcher.pattern}"`)
+      });
+      continue;
+    }
+    if (matcher.negate)
+      continue;
+    if (matcher.ids.length >= 1) {
+      subs.push({ status: "pass", reason: "affects-resolvable.ok" });
+    } else {
+      subs.push({
+        status: "fail",
+        reason: "affects-resolvable.zero-targets",
+        finding: matcherFinding(ctx, matcher, "affects-resolvable.zero-targets", `"${matcher.type}" matcher "${matcher.pattern}" resolves to zero targets against the supplied inventory`)
+      });
+    }
+  }
+  if (!resolution.hasPositiveMatcher) {
+    subs.push({
+      status: "fail",
+      reason: "affects-resolvable.zero-targets",
+      finding: {
+        reason: "affects-resolvable.zero-targets",
+        candidateAdr: ctx.proposed.frontmatter.id,
+        recordPath: ctx.proposed.path,
+        field: "affects",
+        message: "negation-only affects resolves to zero targets"
+      }
+    });
+  }
+  if (subs.length === 0)
+    return passResult("affects-resolvable");
+  return aggregate("affects-resolvable", subs, { resolvedTargets: resolution.targets });
+}
+
+// src/rules/affects-overlap.ts
+function evaluateAffectsOverlap(ctx) {
+  const accepted = ctx.acceptedRecords;
+  if (accepted.length === 0) {
+    return passResult("affects-overlap", "affects-overlap.no-accepted-corpus");
+  }
+  const proposal = resolveRecordTargets(ctx.proposed, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+  let anyInert = anyMatcherInert(proposal);
+  const subs = [];
+  const overlapping = [];
+  for (const acc of accepted) {
+    const accResolution = resolveRecordTargets(acc, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+    if (anyMatcherInert(accResolution))
+      anyInert = true;
+    const intersects = [...proposal.targetKeys].some((key2) => accResolution.targetKeys.has(key2));
+    if (intersects) {
+      overlapping.push(acc.frontmatter.id);
+      subs.push({
+        status: "fail",
+        reason: "affects-overlap.accepted-intersection",
+        finding: {
+          reason: "affects-overlap.accepted-intersection",
+          candidateAdr: ctx.proposed.frontmatter.id,
+          relatedAdr: acc.frontmatter.id,
+          message: `affects overlaps accepted ADR "${acc.frontmatter.id}"`
+        }
+      });
+    }
+  }
+  if (subs.length > 0) {
+    return aggregate("affects-overlap", subs, { overlappingWith: [...overlapping].sort(byCodeUnit) });
+  }
+  if (anyInert) {
+    return inertResult("affects-overlap", "affects-overlap.backing-absent");
+  }
+  return passResult("affects-overlap", "affects-overlap.none");
+}
+
+// src/assertions/evaluate.ts
+function runPort(port, key2, record, hasInline, inline, source, input) {
+  const base = { assertionKey: key2, candidateAdr: record.frontmatter.id, recordPath: record.path };
+  if (!port) {
+    return {
+      compile: { status: "inert", reason: "assertions-compile.engine-absent", finding: { reason: "assertions-compile.engine-absent", ...base } },
+      pass: { status: "inert", reason: "assertions-pass.engine-absent", finding: { reason: "assertions-pass.engine-absent", ...base } }
+    };
+  }
+  if (port.profile === "source") {
+    const effectiveSource = hasInline ? inline : source?.fileContent;
+    if (effectiveSource === undefined) {
+      return {
+        compile: { status: "inert", reason: "assertions-compile.source-absent", finding: { reason: "assertions-compile.source-absent", ...base } },
+        pass: { status: "inert", reason: "assertions-pass.input-absent", finding: { reason: "assertions-pass.input-absent", ...base } }
+      };
+    }
+    const outcome2 = port.compile(effectiveSource, source?.sourceRef);
+    if (!outcome2.ok) {
+      return { compile: { status: "fail", reason: outcome2.reason, finding: { reason: outcome2.reason, ...base } } };
+    }
+    const compileSub2 = { status: "pass", reason: "assertions-compile.ok" };
+    if (input === undefined) {
+      return { compile: compileSub2, pass: { status: "inert", reason: "assertions-pass.input-absent", finding: { reason: "assertions-pass.input-absent", ...base } } };
+    }
+    const evaluated2 = port.evaluate(outcome2.compiled, input);
+    if (!evaluated2.ok) {
+      return { compile: compileSub2, pass: { status: "fail", reason: evaluated2.reason, finding: { reason: evaluated2.reason, ...base } } };
+    }
+    return {
+      compile: compileSub2,
+      pass: evaluated2.pass ? { status: "pass", reason: "assertions-pass.ok" } : { status: "fail", reason: "assertions-pass.evaluates-false", finding: { reason: "assertions-pass.evaluates-false", ...base } }
+    };
+  }
+  const artifact = source?.compiledArtifact;
+  if (artifact === undefined) {
+    return {
+      compile: { status: "inert", reason: "assertions-compile.source-absent", finding: { reason: "assertions-compile.source-absent", ...base } },
+      pass: { status: "inert", reason: "assertions-pass.input-absent", finding: { reason: "assertions-pass.input-absent", ...base } }
+    };
+  }
+  const outcome = port.validateArtifact(artifact);
+  if (!outcome.ok) {
+    return { compile: { status: "fail", reason: outcome.reason, finding: { reason: outcome.reason, ...base } } };
+  }
+  const compileSub = { status: "pass", reason: "assertions-compile.ok" };
+  if (input === undefined) {
+    return { compile: compileSub, pass: { status: "inert", reason: "assertions-pass.input-absent", finding: { reason: "assertions-pass.input-absent", ...base } } };
+  }
+  const evaluated = port.evaluate(outcome.compiled, input);
+  if (!evaluated.ok) {
+    return { compile: compileSub, pass: { status: "fail", reason: evaluated.reason, finding: { reason: evaluated.reason, ...base } } };
+  }
+  return {
+    compile: compileSub,
+    pass: evaluated.pass ? { status: "pass", reason: "assertions-pass.ok" } : { status: "fail", reason: "assertions-pass.evaluates-false", finding: { reason: "assertions-pass.evaluates-false", ...base } }
+  };
+}
+function dispatch(ctx, assertion, key2, input) {
+  const record = ctx.proposed;
+  const source = ctx.input.assertionInputs.sources[key2];
+  const hasInline = assertion.expression !== undefined;
+  const registry = ctx.input.assertionEngines;
+  switch (assertion.engine) {
+    case "rego":
+      return runPort(registry.rego, key2, record, hasInline, assertion.expression, source, input);
+    case "jsonpath":
+      return runPort(registry.jsonpath, key2, record, hasInline, assertion.expression, source, input);
+    case "grep":
+      return runPort(registry.grep, key2, record, hasInline, assertion.expression, source, input);
+    case "custom":
+      return runPort(registry.custom, key2, record, hasInline, assertion.expression, source, input);
+  }
+}
+function computeAssertionOutcomes(ctx) {
+  const assertions = ctx.proposed.frontmatter.assertions;
+  const compileSubs = [];
+  const passSubs = [];
+  for (const assertion of assertions) {
+    const key2 = makeAssertionKey(ctx.proposed.log, ctx.proposed.path, assertion.id);
+    const base = { assertionKey: key2, candidateAdr: ctx.proposed.frontmatter.id, recordPath: ctx.proposed.path };
+    const hasInline = assertion.expression !== undefined;
+    const hasFile = assertion.expressionFile !== undefined;
+    if (!hasInline && !hasFile) {
+      compileSubs.push({
+        status: "fail",
+        reason: "assertions-compile.no-source",
+        finding: { reason: "assertions-compile.no-source", field: "assertions", message: `Assertion "${assertion.id}" declares no source`, ...base }
+      });
+      continue;
+    }
+    if (hasInline && hasFile) {
+      compileSubs.push({
+        status: "fail",
+        reason: "assertions-compile.ambiguous-source",
+        finding: { reason: "assertions-compile.ambiguous-source", field: "assertions", message: `Assertion "${assertion.id}" declares both expression and expressionFile`, ...base }
+      });
+      continue;
+    }
+    const input = ctx.input.assertionInputs.inputs[key2]?.document;
+    const result = dispatch(ctx, assertion, key2, input);
+    compileSubs.push(result.compile);
+    if (result.pass)
+      passSubs.push(result.pass);
+  }
+  return { compileSubs, passSubs, hasAssertions: assertions.length > 0 };
+}
+function compileWith(port, hasInline, inline, source) {
+  if (!port)
+    return { ok: false, reason: "engine-absent" };
+  if (port.profile === "source") {
+    const effectiveSource = hasInline ? inline : source?.fileContent;
+    if (effectiveSource === undefined)
+      return { ok: false, reason: "source-absent" };
+    const outcome2 = port.compile(effectiveSource, source?.sourceRef);
+    if (!outcome2.ok)
+      return { ok: false, reason: "compile-error" };
+    return { ok: true, evaluate: (input) => port.evaluate(outcome2.compiled, input) };
+  }
+  const artifact = source?.compiledArtifact;
+  if (artifact === undefined)
+    return { ok: false, reason: "source-absent" };
+  const outcome = port.validateArtifact(artifact);
+  if (!outcome.ok)
+    return { ok: false, reason: "compile-error" };
+  return { ok: true, evaluate: (input) => port.evaluate(outcome.compiled, input) };
+}
+function compileAssertionForScope(ctx, orgRecord, assertion) {
+  const key2 = makeAssertionKey(orgRecord.log, orgRecord.path, assertion.id);
+  const source = ctx.input.assertionInputs.sources[key2];
+  const hasInline = assertion.expression !== undefined;
+  const hasFile = assertion.expressionFile !== undefined;
+  if (hasInline === hasFile)
+    return { ok: false, reason: "compile-error" };
+  const registry = ctx.input.assertionEngines;
+  switch (assertion.engine) {
+    case "rego":
+      return compileWith(registry.rego, hasInline, assertion.expression, source);
+    case "jsonpath":
+      return compileWith(registry.jsonpath, hasInline, assertion.expression, source);
+    case "grep":
+      return compileWith(registry.grep, hasInline, assertion.expression, source);
+    case "custom":
+      return compileWith(registry.custom, hasInline, assertion.expression, source);
+  }
+}
+
+// src/rules/scope-hierarchy.ts
+function domainApplies(orgRecord, proposal) {
+  const orgDomain = orgRecord.frontmatter.domain;
+  if (orgDomain === undefined)
+    return true;
+  return orgDomain === proposal.frontmatter.domain;
+}
+function evaluateScopeHierarchy(ctx) {
+  const proposal = ctx.proposed;
+  if (proposal.frontmatter.scope !== "component") {
+    return passResult("scope-hierarchy", "scope-hierarchy.not-applicable-scope");
+  }
+  const proposalTargets = resolveRecordTargets(proposal, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+  const subs = [];
+  if (anyMatcherInert(proposalTargets)) {
+    subs.push({ status: "inert", reason: "scope-hierarchy.evidence-absent" });
+  }
+  const applicableOrgAdrs = [];
+  for (const record of ctx.acceptedRecords) {
+    if (record.frontmatter.scope !== "org")
+      continue;
+    if (!domainApplies(record, proposal))
+      continue;
+    const orgTargets = resolveRecordTargets(record, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+    if (anyMatcherInert(orgTargets)) {
+      subs.push({ status: "inert", reason: "scope-hierarchy.evidence-absent" });
+    }
+    if ([...proposalTargets.targetKeys].some((key2) => orgTargets.targetKeys.has(key2))) {
+      applicableOrgAdrs.push(record);
+    }
+  }
+  if (applicableOrgAdrs.length === 0) {
+    return subs.length > 0 ? aggregate("scope-hierarchy", subs) : passResult("scope-hierarchy", "scope-hierarchy.ok");
+  }
+  const transitions = [];
+  for (const orgRecord of applicableOrgAdrs) {
+    for (const assertion of orgRecord.frontmatter.assertions) {
+      const key2 = makeAssertionKey(orgRecord.log, orgRecord.path, assertion.id);
+      const compiled = compileAssertionForScope(ctx, orgRecord, assertion);
+      if (!compiled.ok) {
+        const reason = compiled.reason === "engine-absent" ? "scope-hierarchy.engine-absent" : "scope-hierarchy.source-absent";
+        subs.push({ status: "inert", reason });
+        continue;
+      }
+      const baseInput = ctx.input.scopeEvidence?.baseInputs?.[key2]?.document;
+      if (baseInput === undefined) {
+        subs.push({ status: "inert", reason: "scope-hierarchy.base-input-absent" });
+        continue;
+      }
+      const proposedInput = ctx.input.assertionInputs.inputs[key2]?.document;
+      if (proposedInput === undefined) {
+        subs.push({ status: "inert", reason: "scope-hierarchy.proposed-input-absent" });
+        continue;
+      }
+      const baseEval = compiled.evaluate(baseInput);
+      const proposedEval = compiled.evaluate(proposedInput);
+      if (!baseEval.ok || !proposedEval.ok) {
+        subs.push({ status: "inert", reason: "scope-hierarchy.evidence-absent" });
+        continue;
+      }
+      if (baseEval.pass && !proposedEval.pass) {
+        transitions.push(`${orgRecord.frontmatter.id}:${assertion.id}`);
+        subs.push({
+          status: "fail",
+          reason: "scope-hierarchy.contradicts-org-assertion",
+          finding: {
+            reason: "scope-hierarchy.contradicts-org-assertion",
+            candidateAdr: proposal.frontmatter.id,
+            relatedAdr: orgRecord.frontmatter.id,
+            assertionKey: key2,
+            message: `Proposal turns accepted org assertion "${orgRecord.frontmatter.id}:${assertion.id}" from green to red`
+          }
+        });
+      }
+    }
+  }
+  if (subs.length === 0)
+    return passResult("scope-hierarchy", "scope-hierarchy.ok");
+  return aggregate("scope-hierarchy", subs, transitions.length > 0 ? { assertionTransitions: [...transitions].sort(byCodeUnit) } : undefined);
+}
+
+// src/rules/assertions-compile.ts
+function evaluateAssertionsCompile(outcomes) {
+  if (!outcomes.hasAssertions)
+    return passResult("assertions-compile", "assertions-compile.none");
+  return aggregate("assertions-compile", outcomes.compileSubs);
+}
+
+// src/rules/assertions-pass.ts
+function evaluateAssertionsPass(outcomes) {
+  if (!outcomes.hasAssertions || outcomes.passSubs.length === 0) {
+    return passResult("assertions-pass", "assertions-pass.none");
+  }
+  return aggregate("assertions-pass", outcomes.passSubs);
+}
+
+// src/identity/directory.ts
+function buildIdentityIndex(directory) {
+  const principalsById = new Map;
+  for (const principal of directory.principals) {
+    principalsById.set(principal.id, principal);
+  }
+  const teamMembersById = new Map;
+  for (const team of directory.teams) {
+    teamMembersById.set(team.id, team.members);
+  }
+  function isActiveHuman(ref) {
+    const principal = principalsById.get(ref);
+    return principal !== undefined && principal.kind === "human" && principal.active;
+  }
+  function isTeam(ref) {
+    if (teamMembersById.has(ref))
+      return true;
+    const principal = principalsById.get(ref);
+    return principal !== undefined && principal.kind === "team";
+  }
+  function activeHumansForTeam(ref) {
+    const members = teamMembersById.get(ref) ?? [];
+    const seen = new Set;
+    const humans = [];
+    for (const member of members) {
+      if (seen.has(member))
+        continue;
+      if (isActiveHuman(member)) {
+        seen.add(member);
+        humans.push(member);
+      }
+    }
+    return humans;
+  }
+  function resolveToActiveHuman(ref) {
+    if (isTeam(ref)) {
+      const humans = activeHumansForTeam(ref);
+      if (humans.length === 1)
+        return { status: "resolved", human: humans[0] };
+      return humans.length === 0 ? { status: "zero" } : { status: "ambiguous" };
+    }
+    if (isActiveHuman(ref))
+      return { status: "resolved", human: ref };
+    return { status: "zero" };
+  }
+  return { resolveToActiveHuman, isActiveHuman, isTeam };
+}
+
+// src/rules/decider-resolvable.ts
+function evaluateDeciderResolvable(ctx) {
+  const directory = ctx.input.identity;
+  if (!directory) {
+    return inertResult("decider-resolvable", "decider-resolvable.directory-absent");
+  }
+  const deciders = ctx.proposed.frontmatter.deciders;
+  if (deciders.length === 0) {
+    return aggregate("decider-resolvable", [
+      {
+        status: "fail",
+        reason: "decider-resolvable.none-declared",
+        finding: {
+          reason: "decider-resolvable.none-declared",
+          candidateAdr: ctx.proposed.frontmatter.id,
+          field: "deciders",
+          message: "No deciders are declared on the proposal"
+        }
+      }
+    ]);
+  }
+  const index = buildIdentityIndex(directory);
+  const subs = deciders.map((decider) => {
+    const resolution = index.resolveToActiveHuman(decider);
+    if (resolution.status === "resolved") {
+      return { status: "pass", reason: "decider-resolvable.ok" };
+    }
+    const reason = resolution.status === "ambiguous" ? "decider-resolvable.ambiguous-match" : "decider-resolvable.zero-match";
+    return {
+      status: "fail",
+      reason,
+      finding: {
+        reason,
+        candidateAdr: ctx.proposed.frontmatter.id,
+        field: "deciders",
+        message: `Decider "${decider}" ${resolution.status === "ambiguous" ? "resolves ambiguously" : "does not resolve to one active principal"}`
+      }
+    };
+  });
+  return aggregate("decider-resolvable", subs);
+}
+
+// src/rules/expiry-sane.ts
+function evaluateExpirySane(ctx) {
+  const reviewBy = ctx.proposed.frontmatter.reviewBy;
+  if (reviewBy === undefined)
+    return passResult("expiry-sane");
+  if (reviewBy > ctx.evaluationDate)
+    return passResult("expiry-sane");
+  return aggregate("expiry-sane", [
+    {
+      status: "fail",
+      reason: "expiry-sane.past-or-equal",
+      finding: {
+        reason: "expiry-sane.past-or-equal",
+        candidateAdr: ctx.proposed.frontmatter.id,
+        field: "reviewBy",
+        message: `reviewBy "${reviewBy}" is on or before the evaluation date "${ctx.evaluationDate}"`
+      }
+    }
+  ]);
+}
+
+// src/report/assemble.ts
+function computeOutcome(results) {
+  const returned = results.some((result) => result.status === "fail" && result.severity === "error");
+  return returned ? "returned" : "ok";
+}
+function assembleReport(proposalPath, resultsByRule, routing) {
+  const results = RULE_IDS.map((rule) => {
+    const result = resultsByRule.get(rule);
+    if (!result) {
+      throw new Error(`internal: missing rule result for "${rule}"`);
+    }
+    return result;
+  });
+  return {
+    rubricVersion: RUBRIC_VERSION,
+    proposalPath,
+    results,
+    routing,
+    outcome: computeOutcome(results)
+  };
+}
+
+// src/routing/target.ts
+import { matchPathPattern } from "@adrkit/core";
+var VIA_CODE = {
+  deciders: "route.target.deciders",
+  codeowners: "route.target.codeowners",
+  catalog: "route.target.catalog-owner"
+};
+function orderedCandidates(deciders, directory, resolvedPaths, resolvedEntities) {
+  const candidates = [];
+  for (const decider of deciders)
+    candidates.push({ ref: decider, via: "deciders" });
+  const codeowners = directory.codeowners ?? [];
+  const uniquePaths = [...new Set(resolvedPaths)].sort(byCodeUnit);
+  for (const path of uniquePaths) {
+    let lastMatch;
+    for (const rule of codeowners) {
+      if (matchPathPattern(rule.pattern, [path]).matched)
+        lastMatch = rule.owners;
+    }
+    if (lastMatch) {
+      for (const owner of lastMatch)
+        candidates.push({ ref: owner, via: "codeowners" });
+    }
+  }
+  const catalogOwners = directory.catalogOwners;
+  const uniqueEntities = [...new Map(resolvedEntities.map((id) => [canonicalTargetKey(id), id])).values()].sort((a, b) => byCodeUnit(canonicalTargetKey(a), canonicalTargetKey(b)));
+  for (const entity of uniqueEntities) {
+    const owners = catalogOwners !== undefined && Object.hasOwn(catalogOwners, entity.id) ? catalogOwners[entity.id] ?? [] : [];
+    for (const owner of owners)
+      candidates.push({ ref: owner, via: "catalog" });
+  }
+  return candidates;
+}
+function resolveRouteTarget(index, deciders, directory, resolvedPaths, resolvedEntities) {
+  const candidates = orderedCandidates(deciders, directory, resolvedPaths, resolvedEntities);
+  const seen = new Set;
+  for (const candidate of candidates) {
+    if (seen.has(candidate.ref))
+      continue;
+    seen.add(candidate.ref);
+    const resolution = index.resolveToActiveHuman(candidate.ref);
+    if (resolution.status === "resolved") {
+      return { kind: "resolved", human: resolution.human, via: candidate.via, code: VIA_CODE[candidate.via] };
+    }
+    if (index.isTeam(candidate.ref)) {
+      return { kind: "unresolved", code: "route.target.unresolved" };
+    }
+  }
+  return { kind: "unresolved", code: "route.target.unresolved" };
+}
+
+// src/routing/route.ts
+function allNotProven() {
+  return ROUTING_TRIGGERS.map((reason) => ({
+    reason,
+    status: "not-proven",
+    code: ROUTE_EVIDENCE_NOT_PROVEN_CODE[reason]
+  }));
+}
+function notRequiredRouting() {
+  return {
+    escalate: false,
+    reasons: [],
+    evidenceStatus: allNotProven(),
+    target: { kind: "not-required", code: "route.target.not-required" }
+  };
+}
+function intersects(a, b) {
+  if (!b || b.size === 0)
+    return false;
+  for (const key2 of a)
+    if (b.has(key2))
+      return true;
+  return false;
+}
+function computeRouting(ctx, proposalTargets, contradictsAccepted) {
+  const evidence = ctx.input.routingEvidence;
+  const proposalKeys = proposalTargets.targetKeys;
+  const frontmatter = ctx.proposed.frontmatter;
+  const proven = {
+    "one-way-door": frontmatter.reversibility === "one-way-door",
+    "cost-threshold": evidence?.costEvidence !== undefined && evidence.costEvidence.normalizedCost >= evidence.costEvidence.threshold,
+    "security-surface": intersects(proposalKeys, evidence?.securitySurfaceTargets),
+    "data-residency": evidence?.dataResidency?.present === true,
+    regulatory: frontmatter.complianceControls.length > 0 || intersects(proposalKeys, evidence?.regulatedTargets),
+    "contradicts-accepted-adr": contradictsAccepted,
+    "agent-authored-production": (frontmatter.provenance?.authoredBy === "agent" || frontmatter.provenance?.authoredBy === "agent-drafted") && intersects(proposalKeys, evidence?.productionTargets),
+    "human-requested": evidence?.humanRequested?.requester !== undefined
+  };
+  const evidenceStatus = ROUTING_TRIGGERS.map((reason) => proven[reason] ? { reason, status: "proven", code: ROUTE_ESCALATE_CODE[reason] } : { reason, status: "not-proven", code: ROUTE_EVIDENCE_NOT_PROVEN_CODE[reason] });
+  const reasons = ROUTING_TRIGGERS.filter((reason) => proven[reason]);
+  const escalate = reasons.length > 0;
+  if (!escalate) {
+    return {
+      escalate: false,
+      reasons: [],
+      evidenceStatus,
+      target: { kind: "not-required", code: "route.target.not-required" }
+    };
+  }
+  const directory = ctx.input.identity;
+  if (!directory) {
+    return { escalate: true, reasons, evidenceStatus, target: { kind: "unresolved", code: "route.target.unresolved" } };
+  }
+  const resolvedPaths = proposalTargets.targets.filter((id) => id.kind === "path").map((id) => id.id);
+  const resolvedEntities = proposalTargets.targets.filter((id) => id.kind === "entity");
+  const target = resolveRouteTarget(buildIdentityIndex(directory), frontmatter.deciders, directory, resolvedPaths, resolvedEntities);
+  return { escalate: true, reasons, evidenceStatus, target };
+}
+
+// src/routing/accepted-assertion.ts
+function contradictsAcceptedAdr(ctx, proposalTargetKeys) {
+  if (proposalTargetKeys.size === 0)
+    return false;
+  for (const accepted of ctx.acceptedRecords) {
+    const acceptedTargets = resolveRecordTargets(accepted, ctx.input.targetRegistry, ctx.input.targets, ctx.input.resolutionLog);
+    const overlaps = [...proposalTargetKeys].some((key2) => acceptedTargets.targetKeys.has(key2));
+    if (!overlaps)
+      continue;
+    for (const assertion of accepted.frontmatter.assertions) {
+      const key2 = makeAssertionKey(accepted.log, accepted.path, assertion.id);
+      const compiled = compileAssertionForScope(ctx, accepted, assertion);
+      if (!compiled.ok)
+        continue;
+      const proposedInput = ctx.input.assertionInputs.inputs[key2]?.document;
+      if (proposedInput === undefined)
+        continue;
+      const evaluated = compiled.evaluate(proposedInput);
+      if (evaluated.ok && !evaluated.pass)
+        return true;
+    }
+  }
+  return false;
+}
+
+// src/patch/project.ts
+import { AdrRef } from "@adrkit/core";
+function isViolation(result) {
+  return result.status === "fail";
+}
+function representativeFinding(result) {
+  return result.findings.find((finding) => finding.reason === result.reason) ?? result.findings[0];
+}
+function projectFinding(result) {
+  const finding = representativeFinding(result);
+  const adr = finding?.adr !== undefined && AdrRef.safeParse(finding.adr).success ? finding.adr : undefined;
+  return {
+    rule: result.rule,
+    severity: RULE_SEVERITY[result.rule],
+    ...finding?.message ? { message: finding.message } : {},
+    ...adr !== undefined ? { adr } : {}
+  };
+}
+function projectPatch(report) {
+  const deterministicFindings = report.results.filter(isViolation).map(projectFinding);
+  return {
+    deterministicFindings,
+    escalate: report.routing.escalate,
+    escalationReasons: report.routing.reasons
+  };
+}
+
+// src/pass0.ts
+var PROPOSAL_STATUSES = new Set(["draft", "proposed"]);
+var NON_PROPOSAL_STATUSES = new Set([
+  "accepted",
+  "rejected",
+  "superseded",
+  "deprecated"
+]);
+function resolveProposal(input) {
+  const proposed = input.corpus.records.find((record) => record.path === input.proposalPath);
+  if (proposed) {
+    return { proposalPath: input.proposalPath, schemaFindings: [], proposed };
+  }
+  const onPath = input.corpus.findings.filter((finding) => finding.path === input.proposalPath);
+  const schemaFindings = onPath.length > 0 ? onPath : [
+    {
+      rule: "file-read",
+      severity: "error",
+      message: `Proposal not found in corpus: ${input.proposalPath}`,
+      path: input.proposalPath
+    }
+  ];
+  return { proposalPath: input.proposalPath, schemaFindings };
+}
+function evaluateStructuralAndBacked(context) {
+  const results = new Map;
+  results.set("id-unique", evaluateIdUnique(context));
+  results.set("supersession-consistent", evaluateSupersessionConsistent(context));
+  results.set("no-orphan-refs", evaluateNoOrphanRefs(context));
+  results.set("affects-resolvable", evaluateAffectsResolvable(context));
+  results.set("affects-overlap", evaluateAffectsOverlap(context));
+  results.set("scope-hierarchy", evaluateScopeHierarchy(context));
+  const assertionOutcomes = computeAssertionOutcomes(context);
+  const compile = evaluateAssertionsCompile(assertionOutcomes);
+  results.set("assertions-compile", compile);
+  results.set("assertions-pass", compile.status === "fail" ? notEvaluated("assertions-pass", "not-evaluated.prereq-failed") : evaluateAssertionsPass(assertionOutcomes));
+  results.set("decider-resolvable", evaluateDeciderResolvable(context));
+  results.set("expiry-sane", evaluateExpirySane(context));
+  return results;
+}
+function evaluatePass0(input) {
+  const resolution = resolveProposal(input);
+  if (resolution.proposed) {
+    const status = resolution.proposed.frontmatter.status;
+    if (!PROPOSAL_STATUSES.has(status) && NON_PROPOSAL_STATUSES.has(status)) {
+      const error = {
+        code: "candidate-status-not-proposal",
+        proposalPath: input.proposalPath,
+        actualStatus: status
+      };
+      return { kind: "input-error", error };
+    }
+  }
+  const schemaValid = evaluateSchemaValid(resolution);
+  const resultsByRule = new Map;
+  resultsByRule.set("schema-valid", schemaValid);
+  if (schemaValid.status === "fail" || !resolution.proposed) {
+    for (const rule of RULE_IDS) {
+      if (rule === "schema-valid")
+        continue;
+      resultsByRule.set(rule, notEvaluated(rule, "not-evaluated.schema-invalid"));
+    }
+    const report2 = assembleReport(input.proposalPath, resultsByRule, notRequiredRouting());
+    return { kind: "evaluated", result: { report: report2, patch: projectPatch(report2) } };
+  }
+  const proposed = resolution.proposed;
+  const context = {
+    input,
+    proposed,
+    resolution,
+    corpusRecords: input.corpus.records,
+    acceptedRecords: acceptedRecordsExcludingCandidate(input.corpus.records, input.proposalPath),
+    evaluationDate: input.evaluationDate
+  };
+  for (const [rule, result] of evaluateStructuralAndBacked(context)) {
+    resultsByRule.set(rule, result);
+  }
+  const proposalTargets = resolveRecordTargets(proposed, input.targetRegistry, input.targets, input.resolutionLog);
+  const contradicts = contradictsAcceptedAdr(context, proposalTargets.targetKeys);
+  const routing = computeRouting(context, proposalTargets, contradicts);
+  const report = assembleReport(input.proposalPath, resultsByRule, routing);
+  return { kind: "evaluated", result: { report, patch: projectPatch(report) } };
+}
+// src/targets/registry.ts
+function createTargetResolutionRegistry(ports) {
+  const byType = new Map;
+  for (const port of ports)
+    byType.set(port.type, port);
+  return { get: (type) => byType.get(type) };
+}
+var emptyTargetResolutionRegistry = {
+  get: () => {
+    return;
+  }
+};
+// src/targets/path.ts
+import { matchPathPattern as matchPathPattern2 } from "@adrkit/core";
+function createPathTargetResolver() {
+  return {
+    type: "path",
+    resolve(matcher, context) {
+      const inventory = context.inventory.trackedPaths;
+      if (inventory === undefined) {
+        return { status: "inert", ids: [], reason: "affects-resolvable.backing-absent" };
+      }
+      const ids = inventory.filter((path) => matchPathPattern2(matcher.pattern, [path]).matched).map((path) => makeTargetId("path", path));
+      return {
+        status: "resolved",
+        ids,
+        reason: ids.length > 0 ? "affects-resolvable.ok" : "affects-resolvable.zero-targets"
+      };
+    }
+  };
+}
+// src/targets/package.ts
+import { matchPackagePattern, parsePackagePattern } from "@adrkit/core";
+function createPackageTargetResolver() {
+  return {
+    type: "package",
+    resolve(matcher, context) {
+      const inventory = context.inventory.dependencies;
+      if (inventory === undefined) {
+        return { status: "inert", ids: [], reason: "affects-resolvable.backing-absent" };
+      }
+      if (!parsePackagePattern(matcher.pattern)) {
+        return { status: "resolved", ids: [], reason: "affects-resolvable.zero-targets" };
+      }
+      const ids = inventory.filter((dependency) => matchPackagePattern(matcher.pattern, [
+        { name: dependency.name, version: dependency.version ?? "0.0.0-unversioned" }
+      ]).matched).map((dependency) => makeTargetId("package", dependency.name));
+      return {
+        status: "resolved",
+        ids,
+        reason: ids.length > 0 ? "affects-resolvable.ok" : "affects-resolvable.zero-targets"
+      };
+    }
+  };
+}
+// src/assertions/registry.ts
+function createAssertionEngineRegistry(ports = {}) {
+  const registry = {
+    ...ports.rego ? { rego: ports.rego } : {},
+    ...ports.jsonpath ? { jsonpath: ports.jsonpath } : {},
+    ...ports.grep ? { grep: ports.grep } : {},
+    ...ports.custom ? { custom: ports.custom } : {}
+  };
+  return registry;
+}
+var emptyAssertionEngineRegistry = {};
+// src/assertions/jsonpath.ts
+import { query } from "jsonpath-rfc9535";
+import parseJsonPath from "jsonpath-rfc9535/parser";
+
+// src/report/serialize.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function indentOf(depth, pretty) {
+  return pretty ? "  ".repeat(depth) : "";
+}
+function canonicalStringify(root, pretty = false) {
+  const nl = pretty ? `
+` : "";
+  const colon = pretty ? ": " : ":";
+  const out = [];
+  const stack = [{ kind: "val", value: root, depth: 0 }];
+  while (stack.length > 0) {
+    const task = stack.pop();
+    if (!task)
+      continue;
+    if (task.kind === "str") {
+      out.push(task.text);
+      continue;
+    }
+    const { value, depth } = task;
+    if (value === null) {
+      out.push("null");
+      continue;
+    }
+    const type = typeof value;
+    if (type === "string" || type === "boolean") {
+      out.push(JSON.stringify(value));
+      continue;
+    }
+    if (type === "number") {
+      out.push(Number.isFinite(value) ? JSON.stringify(value) : "null");
+      continue;
+    }
+    if (Array.isArray(value)) {
+      if (value.length === 0) {
+        out.push("[]");
+        continue;
+      }
+      const parts = [{ kind: "str", text: `[${nl}` }];
+      value.forEach((item, i) => {
+        parts.push({ kind: "str", text: indentOf(depth + 1, pretty) });
+        parts.push({ kind: "val", value: item, depth: depth + 1 });
+        parts.push({ kind: "str", text: `${i < value.length - 1 ? "," : ""}${nl}` });
+      });
+      parts.push({ kind: "str", text: `${indentOf(depth, pretty)}]` });
+      for (let i = parts.length - 1;i >= 0; i -= 1)
+        stack.push(parts[i]);
+      continue;
+    }
+    if (isRecord(value)) {
+      const source = value;
+      const keys = Object.keys(source).filter((key2) => source[key2] !== undefined).sort(byCodeUnit);
+      if (keys.length === 0) {
+        out.push("{}");
+        continue;
+      }
+      const parts = [{ kind: "str", text: `{${nl}` }];
+      keys.forEach((key2, i) => {
+        parts.push({ kind: "str", text: `${indentOf(depth + 1, pretty)}${JSON.stringify(key2)}${colon}` });
+        parts.push({ kind: "val", value: source[key2], depth: depth + 1 });
+        parts.push({ kind: "str", text: `${i < keys.length - 1 ? "," : ""}${nl}` });
+      });
+      parts.push({ kind: "str", text: `${indentOf(depth, pretty)}}` });
+      for (let i = parts.length - 1;i >= 0; i -= 1)
+        stack.push(parts[i]);
+      continue;
+    }
+    out.push("null");
+  }
+  return out.join("");
+}
+function canonicalize(value) {
+  if (value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "boolean")
+    return value;
+  if (typeof value === "number")
+    return Number.isFinite(value) ? value : null;
+  if (Array.isArray(value)) {
+    return value.map((item) => canonicalize(item));
+  }
+  if (!isRecord(value))
+    return null;
+  const source = value;
+  const out = Object.create(null);
+  for (const key2 of Object.keys(source).sort(byCodeUnit)) {
+    const entry = source[key2];
+    if (entry === undefined)
+      continue;
+    out[key2] = canonicalize(entry);
+  }
+  return out;
+}
+function canonicalBytes(value) {
+  return `${canonicalStringify(value, true)}
+`;
+}
+function serializeReport(report) {
+  return canonicalBytes(report);
+}
+function serializePatch(patch) {
+  return canonicalBytes(patch);
+}
+function serializeArtifacts(report, patch) {
+  return { report: serializeReport(report), patch: serializePatch(patch) };
+}
+
+// src/assertions/limits.ts
+var ASSERTION_INPUT_LIMITS = { maxBytes: 1024 * 1024, maxDepth: 64, maxNodes: 1e5 };
+var REGO_DATA_LIMITS = { maxBytes: 1024 * 1024, maxDepth: 64, maxNodes: 1e5 };
+function canonicalJsonString(value) {
+  return canonicalStringify(value, false);
+}
+function withinStructuralLimits(value, limits) {
+  let nodes = 0;
+  const stack = [{ value, depth: 1 }];
+  while (stack.length > 0) {
+    const { value: current, depth } = stack.pop();
+    nodes += 1;
+    if (nodes > limits.maxNodes)
+      return false;
+    if (depth > limits.maxDepth)
+      return false;
+    if (Array.isArray(current)) {
+      for (const item of current)
+        stack.push({ value: item, depth: depth + 1 });
+    } else if (current !== null && typeof current === "object") {
+      for (const entry of Object.values(current)) {
+        stack.push({ value: entry, depth: depth + 1 });
+      }
+    }
+  }
+  return true;
+}
+function withinJsonLimits(value, limits) {
+  if (!withinStructuralLimits(value, limits))
+    return false;
+  const bytes = new TextEncoder().encode(canonicalJsonString(value)).length;
+  return bytes <= limits.maxBytes;
+}
+
+// src/assertions/jsonpath.ts
+var MAX_SOURCE_BYTES = 8 * 1024;
+var ALLOWED_FUNCTIONS = new Set(["length", "count", "value"]);
+function functionNames(node, out) {
+  if (Array.isArray(node)) {
+    for (const item of node)
+      functionNames(item, out);
+    return;
+  }
+  if (node === null || typeof node !== "object")
+    return;
+  const record = node;
+  if (record.type === "FunctionExpr" && typeof record.name === "string") {
+    out.add(record.name);
+  }
+  for (const value of Object.values(record))
+    functionNames(value, out);
+}
+function usesOnlyAllowedFunctions(ast) {
+  const names = new Set;
+  functionNames(ast, names);
+  for (const name of names) {
+    if (!ALLOWED_FUNCTIONS.has(name))
+      return false;
+  }
+  return true;
+}
+function createJsonPathEngine() {
+  return {
+    engine: "jsonpath",
+    profile: "source",
+    compile(effectiveSource, sourceRef) {
+      if (new TextEncoder().encode(effectiveSource).length > MAX_SOURCE_BYTES) {
+        return { ok: false, reason: "assertions-compile.parse-error" };
+      }
+      let ast;
+      try {
+        ast = parseJsonPath(effectiveSource);
+      } catch {
+        return { ok: false, reason: "assertions-compile.parse-error" };
+      }
+      if (!usesOnlyAllowedFunctions(ast)) {
+        return { ok: false, reason: "assertions-compile.parse-error" };
+      }
+      const payload = { source: effectiveSource, ast };
+      return {
+        ok: true,
+        compiled: { engine: "jsonpath", payload, ...sourceRef !== undefined ? { sourceRef } : {} }
+      };
+    },
+    evaluate(compiled, input) {
+      if (!withinJsonLimits(input, ASSERTION_INPUT_LIMITS)) {
+        return { ok: false, reason: "assertions-pass.evaluation-error" };
+      }
+      try {
+        const nodes = query(input, compiled.payload.source);
+        return { ok: true, pass: nodes.length > 0 };
+      } catch {
+        return { ok: false, reason: "assertions-pass.evaluation-error" };
+      }
+    }
+  };
+}
+// src/crypto/sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function rotr(x, n) {
+  return x >>> n | x << 32 - n;
+}
+function sha256Bytes(message) {
+  const h = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+  const length = message.length;
+  const bitLength = length * 8;
+  const paddedLength = (length + 8 >> 6) + 1;
+  const padded = new Uint8Array(paddedLength * 64);
+  padded.set(message);
+  padded[length] = 128;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 4, bitLength >>> 0, false);
+  dv.setUint32(padded.length - 8, Math.floor(bitLength / 4294967296), false);
+  const w = new Uint32Array(64);
+  for (let offset = 0;offset < padded.length; offset += 64) {
+    for (let i = 0;i < 16; i += 1)
+      w[i] = dv.getUint32(offset + i * 4, false);
+    for (let i = 16;i < 64; i += 1) {
+      const a2 = w[i - 15];
+      const b2 = w[i - 2];
+      const s0 = rotr(a2, 7) ^ rotr(a2, 18) ^ a2 >>> 3;
+      const s1 = rotr(b2, 17) ^ rotr(b2, 19) ^ b2 >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let a = h[0];
+    let b = h[1];
+    let c = h[2];
+    let d = h[3];
+    let e = h[4];
+    let f = h[5];
+    let g = h[6];
+    let hh = h[7];
+    for (let i = 0;i < 64; i += 1) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const t1 = hh + S1 + ch + K[i] + w[i] >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const t2 = S0 + maj >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    h[0] = h[0] + a >>> 0;
+    h[1] = h[1] + b >>> 0;
+    h[2] = h[2] + c >>> 0;
+    h[3] = h[3] + d >>> 0;
+    h[4] = h[4] + e >>> 0;
+    h[5] = h[5] + f >>> 0;
+    h[6] = h[6] + g >>> 0;
+    h[7] = h[7] + hh >>> 0;
+  }
+  const out = new Uint8Array(32);
+  const outView = new DataView(out.buffer);
+  for (let i = 0;i < 8; i += 1)
+    outView.setUint32(i * 4, h[i], false);
+  return out;
+}
+function toHex(bytes) {
+  let hex = "";
+  for (const byte of bytes)
+    hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+function sha256Hex(message) {
+  return toHex(sha256Bytes(message));
+}
+var encoder = new TextEncoder;
+function sha256HexUtf8(text) {
+  return sha256Hex(encoder.encode(text));
+}
+
+// src/assertions/rego.ts
+var MEDIA_TYPE = "application/vnd.adrkit.rego-wasm-policy.v1+json";
+var SCHEMA_VERSION = "adrkit.rego-wasm-policy/v1";
+var CAPABILITIES_PROFILE = "adrkit.rego-wasm.capabilities/v1";
+var MAX_SOURCE_BYTES2 = 64 * 1024;
+var MAX_MODULE_BYTES = 4 * 1024 * 1024;
+var MAX_MODULE_BASE64_LEN = Math.ceil(MAX_MODULE_BYTES / 3) * 4;
+var MAX_ENVELOPE_BYTES = Math.floor(6.75 * 1024 * 1024);
+var HEX_64 = /^[0-9a-f]{64}$/;
+var ENVELOPE_KEYS = [
+  "mediaType",
+  "schemaVersion",
+  "source",
+  "sourceSha256",
+  "moduleBase64",
+  "moduleSha256",
+  "data",
+  "entrypoint",
+  "abi",
+  "compiler",
+  "requiredHostBuiltins",
+  "envelopeSha256"
+];
+function fail(message) {
+  return { ok: false, message: `Rego-Wasm envelope: ${message}` };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeCanonicalBase64(b64) {
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0)
+    return;
+  let binary;
+  try {
+    binary = atob(b64);
+  } catch {
+    return;
+  }
+  if (btoa(binary) !== b64)
+    return;
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i += 1)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function hasWasmMagic(bytes) {
+  return bytes.length >= 8 && bytes[0] === 0 && bytes[1] === 97 && bytes[2] === 115 && bytes[3] === 109;
+}
+function isStructurallyValidWasm(bytes) {
+  try {
+    return WebAssembly.validate(bytes);
+  } catch {
+    return false;
+  }
+}
+function isJsonValue(root) {
+  const active = new Set;
+  const stack = [{ kind: "enter", value: root }];
+  while (stack.length > 0) {
+    const task = stack.pop();
+    if (!task)
+      continue;
+    if (task.kind === "exit") {
+      active.delete(task.value);
+      continue;
+    }
+    const value = task.value;
+    if (value === null)
+      continue;
+    const type = typeof value;
+    if (type === "boolean" || type === "string")
+      continue;
+    if (type === "number") {
+      if (!Number.isFinite(value))
+        return false;
+      continue;
+    }
+    if (typeof value !== "object" || value === null)
+      return false;
+    const objectValue = value;
+    if (active.has(objectValue))
+      return false;
+    active.add(objectValue);
+    stack.push({ kind: "exit", value: objectValue });
+    if (Array.isArray(objectValue)) {
+      for (let index = objectValue.length - 1;index >= 0; index -= 1) {
+        if (!(index in objectValue))
+          return false;
+        stack.push({ kind: "enter", value: objectValue[index] });
+      }
+      continue;
+    }
+    let prototype;
+    let descriptors;
+    try {
+      prototype = Object.getPrototypeOf(objectValue);
+      descriptors = Object.getOwnPropertyDescriptors(objectValue);
+    } catch {
+      return false;
+    }
+    if (prototype !== Object.prototype && prototype !== null)
+      return false;
+    for (const key2 of Reflect.ownKeys(descriptors)) {
+      if (typeof key2 !== "string")
+        return false;
+      const descriptor = descriptors[key2];
+      if (!descriptor?.enumerable || !("value" in descriptor))
+        return false;
+      stack.push({ kind: "enter", value: descriptor.value });
+    }
+  }
+  return true;
+}
+function isCanonicalEntrypoint(entrypoint) {
+  if (!entrypoint.startsWith("/") || entrypoint.length < 2)
+    return false;
+  if (entrypoint.endsWith("/") || entrypoint.includes("//"))
+    return false;
+  return entrypoint.slice(1).split("/").every((segment) => segment.length > 0);
+}
+function validateRegoWasmPolicyEnvelopeV1(artifact) {
+  if (!isPlainObject(artifact))
+    return fail("must be an object");
+  for (const key2 of Object.keys(artifact)) {
+    if (!ENVELOPE_KEYS.includes(key2))
+      return fail(`unknown key "${key2}"`);
+  }
+  for (const key2 of ENVELOPE_KEYS) {
+    if (!(key2 in artifact))
+      return fail(`missing key "${key2}"`);
+  }
+  if (artifact.mediaType !== MEDIA_TYPE)
+    return fail("mediaType mismatch");
+  if (artifact.schemaVersion !== SCHEMA_VERSION)
+    return fail("schemaVersion mismatch");
+  const source = artifact.source;
+  if (typeof source !== "string")
+    return fail("source must be a string");
+  if (new TextEncoder().encode(source).length > MAX_SOURCE_BYTES2)
+    return fail("source exceeds 64 KiB");
+  const sourceSha256 = artifact.sourceSha256;
+  if (typeof sourceSha256 !== "string" || !HEX_64.test(sourceSha256))
+    return fail("sourceSha256 must be 64 lowercase hex");
+  if (sha256HexUtf8(source) !== sourceSha256)
+    return fail("sourceSha256 does not match source");
+  const moduleBase64 = artifact.moduleBase64;
+  if (typeof moduleBase64 !== "string")
+    return fail("moduleBase64 must be a string");
+  if (moduleBase64.length > MAX_MODULE_BASE64_LEN)
+    return fail("moduleBase64 exceeds the maximum encoded length for a 4 MiB module");
+  const moduleBytes = decodeCanonicalBase64(moduleBase64);
+  if (!moduleBytes)
+    return fail("moduleBase64 is not canonical base64");
+  if (moduleBytes.length > MAX_MODULE_BYTES)
+    return fail("module exceeds 4 MiB");
+  if (!hasWasmMagic(moduleBytes))
+    return fail("module is not a valid Wasm binary (magic)");
+  if (!isStructurallyValidWasm(moduleBytes))
+    return fail("module is not a structurally valid Wasm binary");
+  const moduleSha256 = artifact.moduleSha256;
+  if (typeof moduleSha256 !== "string" || !HEX_64.test(moduleSha256))
+    return fail("moduleSha256 must be 64 lowercase hex");
+  if (sha256Hex(moduleBytes) !== moduleSha256)
+    return fail("moduleSha256 does not match module");
+  const data = artifact.data;
+  if (!isJsonValue(data))
+    return fail("data must be a JSON value");
+  if (!withinJsonLimits(data, REGO_DATA_LIMITS))
+    return fail("data exceeds size/depth/node limits");
+  const entrypoint = artifact.entrypoint;
+  if (typeof entrypoint !== "string" || !isCanonicalEntrypoint(entrypoint)) {
+    return fail("entrypoint must be a canonical /slash/path");
+  }
+  const abi = artifact.abi;
+  if (!isPlainObject(abi))
+    return fail("abi must be an object");
+  for (const key2 of Object.keys(abi)) {
+    if (key2 !== "major" && key2 !== "minor")
+      return fail(`unknown abi key "${key2}"`);
+  }
+  if (abi.major !== 1 || abi.minor !== 3)
+    return fail("unsupported ABI (expected 1.3)");
+  const compiler = artifact.compiler;
+  if (!isPlainObject(compiler))
+    return fail("compiler must be an object");
+  for (const key2 of Object.keys(compiler)) {
+    if (!["name", "version", "capabilitiesProfile", "capabilitiesSha256"].includes(key2)) {
+      return fail(`unknown compiler key "${key2}"`);
+    }
+  }
+  if (compiler.name !== "opa")
+    return fail('compiler.name must be "opa"');
+  const compilerVersion = compiler.version;
+  if (typeof compilerVersion !== "string" || compilerVersion.length === 0)
+    return fail("compiler.version required");
+  if (compiler.capabilitiesProfile !== CAPABILITIES_PROFILE)
+    return fail("unsupported capabilities profile");
+  const capabilitiesSha256 = compiler.capabilitiesSha256;
+  if (typeof capabilitiesSha256 !== "string" || !HEX_64.test(capabilitiesSha256)) {
+    return fail("compiler.capabilitiesSha256 must be 64 lowercase hex");
+  }
+  if (!Array.isArray(artifact.requiredHostBuiltins) || artifact.requiredHostBuiltins.length !== 0) {
+    return fail("requiredHostBuiltins must be empty in v1");
+  }
+  const envelopeSha256 = artifact.envelopeSha256;
+  if (typeof envelopeSha256 !== "string" || !HEX_64.test(envelopeSha256))
+    return fail("envelopeSha256 must be 64 lowercase hex");
+  const envelope = {
+    mediaType: MEDIA_TYPE,
+    schemaVersion: SCHEMA_VERSION,
+    source,
+    sourceSha256,
+    moduleBase64,
+    moduleSha256,
+    data,
+    entrypoint,
+    abi: { major: 1, minor: 3 },
+    compiler: {
+      name: "opa",
+      version: compilerVersion,
+      capabilitiesProfile: CAPABILITIES_PROFILE,
+      capabilitiesSha256
+    },
+    requiredHostBuiltins: [],
+    envelopeSha256
+  };
+  if (new TextEncoder().encode(canonicalJsonString(envelope)).length > MAX_ENVELOPE_BYTES) {
+    return fail("decoded envelope exceeds 6.75 MiB");
+  }
+  const { envelopeSha256: _boundHash, ...priorFields } = envelope;
+  if (sha256HexUtf8(canonicalJsonString(priorFields)) !== envelopeSha256) {
+    return fail("envelopeSha256 does not bind the prior fields");
+  }
+  return { ok: true, envelope };
+}
+export {
+  validateRegoWasmPolicyEnvelopeV1,
+  sortRuleFindings,
+  serializeReport,
+  serializePatch,
+  serializeArtifacts,
+  resolveRecordTargets,
+  parseAssertionKey,
+  normalizePathId,
+  makeTargetId,
+  makeAssertionKey,
+  isReasonCode,
+  isCanonicalAssertionKey,
+  evaluatePass0,
+  emptyTargetResolutionRegistry,
+  emptyAssertionEngineRegistry,
+  createTargetResolutionRegistry,
+  createPathTargetResolver,
+  createPackageTargetResolver,
+  createJsonPathEngine,
+  createAssertionEngineRegistry,
+  computeAssertionOutcomes,
+  compareRuleFindings,
+  canonicalize,
+  canonicalTargetKey,
+  canonicalStringify,
+  canonicalBytes,
+  buildIdentityIndex,
+  assertionKeyForAssertion,
+  anyMatcherInert,
+  aggregate,
+  RULE_SEVERITY,
+  RULE_REASON_PRECEDENCE,
+  RULE_IDS,
+  RUBRIC_VERSION,
+  ROUTING_TRIGGERS,
+  ROUTE_EVIDENCE_NOT_PROVEN_CODE,
+  ROUTE_ESCALATE_CODE,
+  REASON_CODES
+};