@anhcodo13/lattice 0.4.0 → 0.5.0

package/dist/index.js

@@ -101,6 +101,7 @@ function parseAnalysisConfig(value) {
 // src/governance/policy.ts
 var exactVersion = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var minimumVersion = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var measuredVersion = /^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/;
 function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -169,6 +170,51 @@ function parseAssessmentPolicy(value) {
     if (!Array.isArray(projects) || projects.length === 0 || !projects.every((item) => typeof item === "string" && item.length > 0) || new Set(projects).size !== projects.length) {
       throw new Error("assessment.evidence.compatibility.requiredProjects must be a unique nonempty string array");
     }
+    const versionFloors = (key) => {
+      const raw = compatibility[key];
+      if (raw === void 0) return void 0;
+      if (!record2(raw)) throw new Error(`assessment.evidence.compatibility.${key} must be an object`);
+      for (const [project, version] of Object.entries(raw)) {
+        if (!projects.includes(project)) throw new Error(`${key} references unknown required project ${project}`);
+        if (key === "minimumEmulatedOsVersions" && project !== "android-chrome" && project !== "iphone-safari") {
+          throw new Error(`${key} requires an Android Chrome or iPhone Safari project`);
+        }
+        if (typeof version !== "string" || !measuredVersion.test(version) || !version.split(".").map(Number).every(Number.isSafeInteger)) {
+          throw new Error(`${key}.${project} must be a numeric version with one to four components`);
+        }
+      }
+      return raw;
+    };
+    const minimumTestedBrowserVersions = versionFloors("minimumTestedBrowserVersions");
+    const minimumEmulatedOsVersions = versionFloors("minimumEmulatedOsVersions");
+    let accessibility;
+    if (gates.accessibility !== void 0) {
+      if (!record2(gates.accessibility)) throw new Error("assessment.evidence.accessibility must be an object");
+      const source = gates.accessibility;
+      const requiredProjects = source.requiredProjects;
+      if (!Array.isArray(requiredProjects) || requiredProjects.length === 0 || !requiredProjects.every((project) => typeof project === "string" && projects.includes(project)) || new Set(requiredProjects).size !== requiredProjects.length) {
+        throw new Error("assessment.evidence.accessibility projects must be unique members of compatibility.requiredProjects");
+      }
+      const requiredTags = source.requiredTags;
+      if (!Array.isArray(requiredTags) || requiredTags.length === 0 || !requiredTags.every((tag) => typeof tag === "string" && /^wcag(?:2|21|22)(?:a|aa)$/.test(tag)) || new Set(requiredTags).size !== requiredTags.length) {
+        throw new Error("assessment.evidence.accessibility.requiredTags must list unique supported WCAG A/AA tags");
+      }
+      if (typeof source.minimumAxeVersion !== "string" || !minimumVersion.test(`>=${source.minimumAxeVersion}`) || valid(source.minimumAxeVersion) === null) {
+        throw new Error("assessment.evidence.accessibility.minimumAxeVersion must be an exact stable version");
+      }
+      accessibility = {
+        requiredProjects,
+        requiredTags,
+        minimumScansPerProject: nonnegative2(source, "minimumScansPerProject", "assessment.evidence.accessibility"),
+        minimumChecksPerScan: nonnegative2(source, "minimumChecksPerScan", "assessment.evidence.accessibility"),
+        minimumAxeVersion: source.minimumAxeVersion,
+        maximumViolations: nonnegative2(source, "maximumViolations", "assessment.evidence.accessibility"),
+        maximumNeedsReview: nonnegative2(source, "maximumNeedsReview", "assessment.evidence.accessibility")
+      };
+      if (accessibility.minimumScansPerProject === 0 || accessibility.minimumChecksPerScan === 0) {
+        throw new Error("assessment.evidence.accessibility minimum scans and checks must be positive");
+      }
+    }
     evidence = {
       maximumAgeHours: gates.maximumAgeHours,
       dependencySecurity: { maximumHigh: nonnegative2(dependencySecurity, "maximumHigh", "assessment.evidence.dependencySecurity"), maximumCritical: nonnegative2(dependencySecurity, "maximumCritical", "assessment.evidence.dependencySecurity") },
@@ -179,7 +225,13 @@ function parseAssessmentPolicy(value) {
         requireTests: codeQuality.requireTests
       },
       codeSecurity: { maximumHigh: nonnegative2(codeSecurity, "maximumHigh", "assessment.evidence.codeSecurity"), maximumCritical: nonnegative2(codeSecurity, "maximumCritical", "assessment.evidence.codeSecurity"), maximumSecrets: nonnegative2(codeSecurity, "maximumSecrets", "assessment.evidence.codeSecurity") },
-      compatibility: { requiredProjects: projects, minimumTestsPerProject: nonnegative2(compatibility, "minimumTestsPerProject", "assessment.evidence.compatibility") }
+      compatibility: {
+        requiredProjects: projects,
+        minimumTestsPerProject: nonnegative2(compatibility, "minimumTestsPerProject", "assessment.evidence.compatibility"),
+        ...minimumTestedBrowserVersions ? { minimumTestedBrowserVersions } : {},
+        ...minimumEmulatedOsVersions ? { minimumEmulatedOsVersions } : {}
+      },
+      ...accessibility ? { accessibility } : {}
     };
   }
   return { architecture: {
@@ -219,10 +271,25 @@ function parsePolicy(raw, source) {
     }
     profiles3[name] = versions;
   }
+  let managedPackages;
+  if (parsed.managedPackages !== void 0) {
+    if (!record2(parsed.managedPackages)) throw new Error("Policy managedPackages must be an object");
+    managedPackages = {};
+    for (const [packageName, version] of Object.entries(parsed.managedPackages)) {
+      if (typeof version !== "string" || !minimumVersion.test(version) || valid(version.slice(2)) === null) {
+        throw new Error(`Policy minimum version (>=X.Y.Z) required for managed package ${packageName}`);
+      }
+      if (Object.values(profiles3).some((profile) => packageName in profile)) {
+        throw new Error(`Package ${packageName} appears in both profiles and managedPackages`);
+      }
+      managedPackages[packageName] = version;
+    }
+  }
   return {
     schemaVersion: 2,
     policyVersion: parsed.policyVersion,
     profiles: profiles3,
+    ...managedPackages ? { managedPackages } : {},
     ...parsed.assessment === void 0 ? {} : { assessment: parseAssessmentPolicy(parsed.assessment) },
     source,
     sha256: createHash("sha256").update(raw).digest("hex")
@@ -246,9 +313,145 @@ async function loadPolicy(source) {
 }
 
 // src/governance/check.ts
-import { resolve as resolve3, relative as relative3, sep as sep2 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { resolve as resolve3, relative as relative3, sep as sep2, join as join4, dirname as dirname2 } from "path";
+import fastGlob2 from "fast-glob";
 import { satisfies, subset, valid as valid2, validRange } from "semver";
 
+// src/analysis/parse.ts
+import ts from "typescript";
+function hasModifier(node, kind) {
+  return ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) === true;
+}
+function containsJsx(node) {
+  if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)) return true;
+  return ts.forEachChild(node, containsJsx) === true;
+}
+function importNames(clause) {
+  if (!clause) return [];
+  const names = [];
+  if (clause.name) names.push("default");
+  if (clause.namedBindings) {
+    if (ts.isNamespaceImport(clause.namedBindings)) names.push("*");
+    else for (const item of clause.namedBindings.elements) names.push(item.propertyName?.text ?? item.name.text);
+  }
+  return names;
+}
+function sourceKind(path) {
+  if (path.endsWith(".tsx")) return ts.ScriptKind.TSX;
+  if (path.endsWith(".jsx")) return ts.ScriptKind.JSX;
+  if (path.endsWith(".js") || path.endsWith(".mjs") || path.endsWith(".cjs")) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+function parseModule(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const imports = [];
+  const exports = [];
+  const typeExports = [];
+  let jsxDepth = 0;
+  let complexity = 1;
+  let componentCount = 0;
+  for (const node of source.statements) {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.push({
+        specifier: node.moduleSpecifier.text,
+        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+        importedNames: importNames(node.importClause),
+        isTypeOnly: node.importClause?.isTypeOnly ?? false
+      });
+    }
+    if (ts.isExportDeclaration(node)) {
+      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        imports.push({
+          specifier: node.moduleSpecifier.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: node.exportClause && ts.isNamedExports(node.exportClause) ? node.exportClause.elements.map((item) => item.propertyName?.text ?? item.name.text) : ["*"],
+          isTypeOnly: node.isTypeOnly
+        });
+      }
+      if (node.exportClause && ts.isNamedExports(node.exportClause)) {
+        exports.push(...node.exportClause.elements.map((item) => item.name.text));
+        if (node.isTypeOnly) typeExports.push(...node.exportClause.elements.map((item) => item.name.text));
+      }
+    }
+    if (hasModifier(node, ts.SyntaxKind.ExportKeyword)) {
+      if (hasModifier(node, ts.SyntaxKind.DefaultKeyword)) exports.push("default");
+      else if (ts.isVariableStatement(node)) {
+        for (const declaration of node.declarationList.declarations) {
+          if (ts.isIdentifier(declaration.name)) exports.push(declaration.name.text);
+        }
+      } else if ("name" in node && node.name && ts.isIdentifier(node.name)) {
+        const name = node.name.text;
+        exports.push(name);
+        if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node)) typeExports.push(name);
+      }
+    }
+    if (ts.isFunctionDeclaration(node) && node.name && /^[A-Z]/.test(node.name.text) && containsJsx(node)) {
+      componentCount++;
+    }
+    if (ts.isVariableStatement(node)) {
+      for (const declaration of node.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name) && /^[A-Z]/.test(declaration.name.text) && declaration.initializer && containsJsx(declaration.initializer)) {
+          componentCount++;
+        }
+      }
+    }
+  }
+  function visit(node, depth) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (argument && ts.isStringLiteralLike(argument)) {
+        imports.push({
+          specifier: argument.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: ["*"],
+          isTypeOnly: false
+        });
+      }
+    }
+    const isJsx = ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
+    const nextDepth = depth + (isJsx ? 1 : 0);
+    jsxDepth = Math.max(jsxDepth, nextDepth);
+    if (ts.isIfStatement(node) || ts.isForStatement(node) || ts.isForOfStatement(node) || ts.isForInStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCatchClause(node) || ts.isConditionalExpression(node) || ts.isCaseBlock(node)) complexity++;
+    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind)) {
+      complexity++;
+    }
+    ts.forEachChild(node, (child) => visit(child, nextDepth));
+  }
+  visit(source, 0);
+  return {
+    path,
+    imports,
+    exports: [...new Set(exports)].sort(),
+    typeExports: [...new Set(typeExports)].sort(),
+    lines: contents.split(/\r?\n/).length,
+    jsxDepth,
+    componentCount,
+    complexity,
+    isRoute: /(^|\/)(app|pages)\/.+(page|layout|route|index)\.[cm]?[jt]sx?$/.test(path) || /(^|\/)app\/(page|layout|route)\.[cm]?[jt]sx?$/.test(path)
+  };
+}
+function moduleParseDiagnostics(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const diagnostics = source.parseDiagnostics ?? [];
+  const messages = diagnostics.map((diagnostic) => {
+    const line = source.getLineAndCharacterOfPosition(diagnostic.start ?? 0).line + 1;
+    return `${path}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`;
+  });
+  function visit(node) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (!argument || !ts.isStringLiteralLike(argument)) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+        messages.push(`${path}:${line}: nonliteral dynamic import or require cannot be analyzed`);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(source);
+  return messages;
+}
+
 // src/governance/discover.ts
 import { readFile as readFile3 } from "fs/promises";
 import { join as join2, relative } from "path";
@@ -430,11 +633,36 @@ async function readResolution(app, workspaceRoot, name) {
 }
 
 // src/governance/check.ts
+var scanIgnore = ["**/node_modules/**", "**/.git/**", "**/.next/**", "**/dist/**", "**/build/**", "**/out/**", "**/coverage/**", "**/.turbo/**", "**/.vercel/**", "**/.astro/**", "**/.nklattice-report/**", "**/.nklattice-governance/**", "**/*.d.ts"];
+async function importedManagedPackages(app, managed) {
+  if (Object.keys(managed).length === 0) return /* @__PURE__ */ new Set();
+  const nestedManifests = await fastGlob2("**/package.json", { cwd: app.directory, onlyFiles: true, dot: true, followSymbolicLinks: false, ignore: scanIgnore });
+  const nestedIgnore = nestedManifests.filter((path) => path !== "package.json").map((path) => `${dirname2(path)}/**`);
+  const files = await fastGlob2("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+    cwd: app.directory,
+    onlyFiles: true,
+    dot: true,
+    followSymbolicLinks: false,
+    ignore: [...scanIgnore, ...nestedIgnore]
+  });
+  const found = /* @__PURE__ */ new Set();
+  await Promise.all(files.map(async (path) => {
+    const module = parseModule(path, await readFile5(join4(app.directory, path), "utf8"));
+    for (const imported of module.imports) {
+      for (const name of Object.keys(managed)) {
+        if (imported.specifier === name || imported.specifier.startsWith(`${name}/`)) found.add(name);
+      }
+    }
+  }));
+  return found;
+}
 async function checkApp(app, workspaceRoot, policy) {
   const requirements = policy.profiles[app.profile];
   if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
   const findings2 = [];
-  for (const [packageName, expected] of Object.entries(requirements)) {
+  const imported = await importedManagedPackages(app, policy.managedPackages ?? {});
+  const managed = Object.fromEntries(Object.entries(policy.managedPackages ?? {}).filter(([packageName]) => app.dependencies[packageName] !== void 0 || imported.has(packageName)));
+  for (const [packageName, expected] of Object.entries({ ...requirements, ...managed })) {
     const declared = app.dependencies[packageName];
     const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
     const reasons = [];
@@ -484,7 +712,7 @@ async function checkGovernance(options) {
 
 // src/governance/assess.ts
 import { mkdir, writeFile } from "fs/promises";
-import { basename, join as join8, relative as relative7, resolve as resolve8, sep as sep6 } from "path";
+import { basename, join as join9, relative as relative7, resolve as resolve8, sep as sep6 } from "path";
 
 // src/analysis/graph.ts
 function buildGraph(_modules) {
@@ -704,153 +932,19 @@ function evaluateRules(graph, config) {
 }
 
 // src/analysis/scan.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join5, resolve as resolve5 } from "path";
-import fastGlob2 from "fast-glob";
-
-// src/analysis/parse.ts
-import ts from "typescript";
-function hasModifier(node, kind) {
-  return ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) === true;
-}
-function containsJsx(node) {
-  if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)) return true;
-  return ts.forEachChild(node, containsJsx) === true;
-}
-function importNames(clause) {
-  if (!clause) return [];
-  const names = [];
-  if (clause.name) names.push("default");
-  if (clause.namedBindings) {
-    if (ts.isNamespaceImport(clause.namedBindings)) names.push("*");
-    else for (const item of clause.namedBindings.elements) names.push(item.propertyName?.text ?? item.name.text);
-  }
-  return names;
-}
-function sourceKind(path) {
-  if (path.endsWith(".tsx")) return ts.ScriptKind.TSX;
-  if (path.endsWith(".jsx")) return ts.ScriptKind.JSX;
-  if (path.endsWith(".js") || path.endsWith(".mjs") || path.endsWith(".cjs")) return ts.ScriptKind.JS;
-  return ts.ScriptKind.TS;
-}
-function parseModule(path, contents) {
-  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
-  const imports = [];
-  const exports = [];
-  const typeExports = [];
-  let jsxDepth = 0;
-  let complexity = 1;
-  let componentCount = 0;
-  for (const node of source.statements) {
-    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
-      imports.push({
-        specifier: node.moduleSpecifier.text,
-        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-        importedNames: importNames(node.importClause),
-        isTypeOnly: node.importClause?.isTypeOnly ?? false
-      });
-    }
-    if (ts.isExportDeclaration(node)) {
-      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
-        imports.push({
-          specifier: node.moduleSpecifier.text,
-          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-          importedNames: node.exportClause && ts.isNamedExports(node.exportClause) ? node.exportClause.elements.map((item) => item.propertyName?.text ?? item.name.text) : ["*"],
-          isTypeOnly: node.isTypeOnly
-        });
-      }
-      if (node.exportClause && ts.isNamedExports(node.exportClause)) {
-        exports.push(...node.exportClause.elements.map((item) => item.name.text));
-        if (node.isTypeOnly) typeExports.push(...node.exportClause.elements.map((item) => item.name.text));
-      }
-    }
-    if (hasModifier(node, ts.SyntaxKind.ExportKeyword)) {
-      if (hasModifier(node, ts.SyntaxKind.DefaultKeyword)) exports.push("default");
-      else if (ts.isVariableStatement(node)) {
-        for (const declaration of node.declarationList.declarations) {
-          if (ts.isIdentifier(declaration.name)) exports.push(declaration.name.text);
-        }
-      } else if ("name" in node && node.name && ts.isIdentifier(node.name)) {
-        const name = node.name.text;
-        exports.push(name);
-        if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node)) typeExports.push(name);
-      }
-    }
-    if (ts.isFunctionDeclaration(node) && node.name && /^[A-Z]/.test(node.name.text) && containsJsx(node)) {
-      componentCount++;
-    }
-    if (ts.isVariableStatement(node)) {
-      for (const declaration of node.declarationList.declarations) {
-        if (ts.isIdentifier(declaration.name) && /^[A-Z]/.test(declaration.name.text) && declaration.initializer && containsJsx(declaration.initializer)) {
-          componentCount++;
-        }
-      }
-    }
-  }
-  function visit(node, depth) {
-    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
-      const argument = node.arguments[0];
-      if (argument && ts.isStringLiteralLike(argument)) {
-        imports.push({
-          specifier: argument.text,
-          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-          importedNames: ["*"],
-          isTypeOnly: false
-        });
-      }
-    }
-    const isJsx = ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
-    const nextDepth = depth + (isJsx ? 1 : 0);
-    jsxDepth = Math.max(jsxDepth, nextDepth);
-    if (ts.isIfStatement(node) || ts.isForStatement(node) || ts.isForOfStatement(node) || ts.isForInStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCatchClause(node) || ts.isConditionalExpression(node) || ts.isCaseBlock(node)) complexity++;
-    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind)) {
-      complexity++;
-    }
-    ts.forEachChild(node, (child) => visit(child, nextDepth));
-  }
-  visit(source, 0);
-  return {
-    path,
-    imports,
-    exports: [...new Set(exports)].sort(),
-    typeExports: [...new Set(typeExports)].sort(),
-    lines: contents.split(/\r?\n/).length,
-    jsxDepth,
-    componentCount,
-    complexity,
-    isRoute: /(^|\/)(app|pages)\/.+(page|layout|route|index)\.[cm]?[jt]sx?$/.test(path) || /(^|\/)app\/(page|layout|route)\.[cm]?[jt]sx?$/.test(path)
-  };
-}
-function moduleParseDiagnostics(path, contents) {
-  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
-  const diagnostics = source.parseDiagnostics ?? [];
-  const messages = diagnostics.map((diagnostic) => {
-    const line = source.getLineAndCharacterOfPosition(diagnostic.start ?? 0).line + 1;
-    return `${path}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`;
-  });
-  function visit(node) {
-    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
-      const argument = node.arguments[0];
-      if (!argument || !ts.isStringLiteralLike(argument)) {
-        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
-        messages.push(`${path}:${line}: nonliteral dynamic import or require cannot be analyzed`);
-      }
-    }
-    ts.forEachChild(node, visit);
-  }
-  visit(source);
-  return messages;
-}
+import { readFile as readFile7 } from "fs/promises";
+import { join as join6, resolve as resolve5 } from "path";
+import fastGlob3 from "fast-glob";
 
 // src/analysis/resolve.ts
-import { readFile as readFile5, stat } from "fs/promises";
-import { dirname as dirname2, extname, join as join4, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
+import { readFile as readFile6, stat } from "fs/promises";
+import { dirname as dirname3, extname, join as join5, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
 import ts2 from "typescript";
 async function compilerOptions(root) {
-  const path = join4(root, "tsconfig.json");
+  const path = join5(root, "tsconfig.json");
   let content;
   try {
-    content = await readFile5(path, "utf8");
+    content = await readFile6(path, "utf8");
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return { options: {}, diagnostics: [] };
     throw error;
@@ -927,7 +1021,7 @@ async function viteAliasDiagnostics(root, options, aliases) {
     var visit = visit2;
     let sourceText;
     try {
-      sourceText = await readFile5(join4(root, file), "utf8");
+      sourceText = await readFile6(join5(root, file), "utf8");
     } catch (error) {
       if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") continue;
       throw error;
@@ -958,12 +1052,12 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
   diagnostics.push(...await viteAliasDiagnostics(root, options, aliases));
   const files = new Set(modules.map((module) => module.path));
   for (const module of modules) {
-    const from = join4(root, module.path);
+    const from = join5(root, module.path);
     for (const imported of module.imports) {
       const specifier = imported.specifier.split("?")[0];
       const matchingAlias = Object.keys(aliases).sort((a, b) => b.length - a.length).find((prefix) => specifier.startsWith(prefix));
       const aliasTarget = matchingAlias ? resolve4(root, aliases[matchingAlias], specifier.slice(matchingAlias.length)) : void 0;
-      const candidate = aliasTarget ? relative4(dirname2(from), aliasTarget).replaceAll("\\", "/") : specifier;
+      const candidate = aliasTarget ? relative4(dirname3(from), aliasTarget).replaceAll("\\", "/") : specifier;
       const lookup = aliasTarget && !candidate.startsWith(".") ? `./${candidate}` : candidate;
       const result = ts2.resolveModuleName(lookup, from, options, ts2.sys).resolvedModule;
       const localAlias = Object.keys(options.paths ?? {}).some((pattern) => {
@@ -972,7 +1066,7 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
       });
       const isLocal = specifier.startsWith(".") || localAlias || aliasTarget !== void 0 || /^[~@#]\//.test(specifier);
       if (!result) {
-        const assetPath = aliasTarget ?? (specifier.startsWith(".") ? resolve4(dirname2(from), specifier) : void 0);
+        const assetPath = aliasTarget ?? (specifier.startsWith(".") ? resolve4(dirname3(from), specifier) : void 0);
         const assetRelative = assetPath ? relative4(root, assetPath) : void 0;
         if (assetRelative && (assetRelative === ".." || assetRelative.startsWith(`..${sep3}`))) {
           diagnostics.push(`${module.path}:${imported.line}: local import escapes app root ${imported.specifier}`);
@@ -998,7 +1092,7 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
 // src/analysis/scan.ts
 async function scanProjectDetailed(projectRoot, aliases = {}) {
   const root = resolve5(projectRoot);
-  const files = await fastGlob2("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+  const files = await fastGlob3("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
     cwd: root,
     onlyFiles: true,
     unique: true,
@@ -1008,7 +1102,7 @@ async function scanProjectDetailed(projectRoot, aliases = {}) {
   });
   const parsed = await Promise.all(files.sort().map(async (path) => {
     const normalized = path.replaceAll("\\", "/");
-    const contents = await readFile6(join5(root, path), "utf8");
+    const contents = await readFile7(join6(root, path), "utf8");
     return { module: parseModule(normalized, contents), diagnostics: moduleParseDiagnostics(normalized, contents) };
   }));
   const modules = parsed.map((item) => item.module);
@@ -1052,8 +1146,8 @@ function scoreFindings(findings2, config) {
 
 // src/governance/inventory.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile7, realpath } from "fs/promises";
-import { isAbsolute, join as join6, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
+import { readFile as readFile8, realpath } from "fs/promises";
+import { isAbsolute, join as join7, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
 var profiles2 = /* @__PURE__ */ new Set(["next", "vite-react", "react"]);
 async function loadInventory(source, scanRoot) {
   const absolute = resolve6(source);
@@ -1061,7 +1155,7 @@ async function loadInventory(source, scanRoot) {
   const inventoryPath = await realpath(absolute);
   const inventoryRelative = relative5(root, inventoryPath);
   if (inventoryRelative === ".." || inventoryRelative.startsWith(`..${sep4}`)) throw new Error("Inventory must be inside scan root");
-  const raw = await readFile7(inventoryPath, "utf8");
+  const raw = await readFile8(inventoryPath, "utf8");
   let value;
   try {
     value = JSON.parse(raw);
@@ -1086,7 +1180,7 @@ async function loadInventory(source, scanRoot) {
     if (seen.has(path)) throw new Error(`Duplicate inventory app ${path}`);
     seen.add(path);
     try {
-      const actual = await realpath(join6(root, path));
+      const actual = await realpath(join7(root, path));
       const rel = relative5(root, actual);
       if (rel === ".." || rel.startsWith(`..${sep4}`)) throw new Error(`App path escapes scan root: ${path}`);
     } catch (error) {
@@ -1112,8 +1206,8 @@ function compareInventory(inventory, discovered, scanRoot) {
 import { createHash as createHash3 } from "crypto";
 import { execFile } from "child_process";
 import { createReadStream } from "fs";
-import { lstat, readFile as readFile8, realpath as realpath2 } from "fs/promises";
-import { dirname as dirname3, join as join7, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { lstat, readFile as readFile9, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname4, join as join8, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
 import { promisify } from "util";
 import fg from "fast-glob";
 var execFileAsync = promisify(execFile);
@@ -1145,7 +1239,11 @@ function validateApp(value) {
   if (!object(quality) || !object(quality.lint) || !string(quality.lint.tool) || !string(quality.lint.version) || typeof quality.lint.complete !== "boolean" || !base(quality.typecheck) || !base(quality.tests) || !base(quality.coverage)) return false;
   if (!nonnegative(quality.lint.filesScanned) || !nonnegative(quality.lint.errorCount) || !nonnegative(quality.lint.warnings) || !errors(quality.lint.errorsDetail) || typeof quality.typecheck.passed !== "boolean" || quality.typecheck.applicable !== void 0 && typeof quality.typecheck.applicable !== "boolean" || !nonnegative(quality.tests.passed) || !nonnegative(quality.tests.failed) || typeof quality.coverage.linesPercent !== "number" || !Number.isFinite(quality.coverage.linesPercent) || quality.coverage.linesPercent < 0 || quality.coverage.linesPercent > 100) return false;
   if (!object(security) || !base(security.sast) || !base(security.secrets) || !nonnegative(security.sast.filesScanned) || !nonnegative(security.secrets.filesScanned) || !findings(security.sast.findings) || !findings(security.secrets.findings)) return false;
-  if (!base(compatibility) || !Array.isArray(compatibility.projects) || !compatibility.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  if (!base(compatibility) || !Array.isArray(compatibility.projects) || !compatibility.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.emulatedOs === void 0 || string(project.emulatedOs)) && (project.emulatedOsVersion === void 0 || string(project.emulatedOsVersion)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  if (value.accessibility !== void 0) {
+    const accessibility = value.accessibility;
+    if (!base(accessibility) || !Array.isArray(accessibility.scans) || !accessibility.scans.every((scan) => object(scan) && string(scan.project) && string(scan.route) && /^\/[^?#]*$/.test(scan.route) && string(scan.axeVersion) && /^\d+\.\d+\.\d+$/.test(scan.axeVersion) && Array.isArray(scan.tags) && scan.tags.length > 0 && scan.tags.every(string) && new Set(scan.tags).size === scan.tags.length && nonnegative(scan.checks) && scan.checks > 0 && nonnegative(scan.needsReview) && findings(scan.violations))) return false;
+  }
   return true;
 }
 async function hashFile(hash, path) {
@@ -1190,7 +1288,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
     hash.update("\0");
   }
   let ancestor = root;
-  while (ancestor === workspace || ancestor !== dirname3(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
+  while (ancestor === workspace || ancestor !== dirname4(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
     for (const name of [
       "package.json",
       "package-lock.json",
@@ -1215,7 +1313,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
       "semgrep.yml",
       "semgrep.yaml"
     ]) {
-      const path = join7(ancestor, name);
+      const path = join8(ancestor, name);
       try {
         const stat2 = await lstat(path);
         if (stat2.isSymbolicLink()) throw new Error(`Symlinked scanner configuration is unsupported: ${path}`);
@@ -1229,7 +1327,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
       }
     }
     if (ancestor === workspace) break;
-    ancestor = dirname3(ancestor);
+    ancestor = dirname4(ancestor);
   }
   return hash.digest("hex");
 }
@@ -1246,7 +1344,7 @@ async function loadScanEvidence(path, scanRoot, workspaceRoot, policySha256, max
   if (actualRelative !== ".." && !actualRelative.startsWith(`..${sep5}`)) throw new Error("Evidence file resolves inside the scan root");
   let parsed;
   try {
-    parsed = JSON.parse(await readFile8(source, "utf8"));
+    parsed = JSON.parse(await readFile9(source, "utf8"));
   } catch {
     throw new Error("Evidence is not valid JSON");
   }
@@ -1267,10 +1365,28 @@ async function validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha25
   return parsed;
 }
 var incomplete = (issues, tool, version, scanned) => ({ status: "incomplete", issues, tool, version, scanned });
+function numericVersion(value) {
+  if (!value || !/^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/.test(value)) return void 0;
+  const parts = value.split(".").map(Number);
+  return parts.every(Number.isSafeInteger) ? parts : void 0;
+}
+function belowVersion(actual, minimum) {
+  for (let index = 0; index < Math.max(actual.length, minimum.length); index++) {
+    if ((actual[index] ?? 0) < (minimum[index] ?? 0)) return true;
+    if ((actual[index] ?? 0) > (minimum[index] ?? 0)) return false;
+  }
+  return false;
+}
 function evaluateAppEvidence(app, policy) {
   if (!app) {
     const missing = incomplete(["No fresh scan evidence for this app"]);
-    return { dependencySecurity: { ...missing }, codeQuality: { ...missing }, codeSecurity: { ...missing }, compatibility: { ...missing } };
+    return {
+      dependencySecurity: { ...missing },
+      codeQuality: { ...missing },
+      codeSecurity: { ...missing },
+      compatibility: { ...missing },
+      ...policy.accessibility ? { accessibility: { ...missing } } : {}
+    };
   }
   const dependency = app.dependencySecurity;
   let dependencySecurity;
@@ -1360,6 +1476,28 @@ function evaluateAppEvidence(app, policy) {
   const invalidEngines = compatibility.projects.filter((project) => expectedEngines[project.name] && project.engine !== expectedEngines[project.name]);
   const invalidDevices = compatibility.projects.filter((project) => (project.name === "android-chrome" || project.name === "iphone-safari") && (project.mobile !== true || !project.device));
   const missingViewports = compatibility.projects.filter((project) => new Set(project.viewportWidths ?? []).size < 2);
+  const versionEvidenceMissing = [];
+  const versionFailures = [];
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumTestedBrowserVersions ?? {})) {
+    const project = compatibility.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const actual = numericVersion(project.browserVersion);
+    if (!actual) versionEvidenceMissing.push(`${name} did not record a valid measured browser version`);
+    else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} measured browser version ${project.browserVersion} is below minimum tested browser version ${minimum}`);
+    }
+  }
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumEmulatedOsVersions ?? {})) {
+    const project = compatibility.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const expectedOs = name === "android-chrome" ? "Android" : "iOS";
+    const actual = numericVersion(project.emulatedOsVersion);
+    if (project.emulatedOs !== expectedOs || !actual) {
+      versionEvidenceMissing.push(`${name} did not record a valid emulated ${expectedOs} version`);
+    } else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} emulated ${expectedOs} version ${project.emulatedOsVersion} is below minimum emulated ${expectedOs} version ${minimum}`);
+    }
+  }
   const compatibilityMissing = [
     ...!compatibility.complete ? ["Compatibility test run did not complete", ...compatibility.errors] : [],
     ...missingProjects.length ? [`Missing Playwright projects: ${missingProjects.join(", ")}`] : [],
@@ -1367,18 +1505,72 @@ function evaluateAppEvidence(app, policy) {
     ...missingBrowserVersions.map((project) => `${project.name} did not record its browser engine version`),
     ...invalidEngines.map((project) => `${project.name} used ${project.engine ?? "an unverified engine"} instead of ${expectedEngines[project.name]}`),
     ...invalidDevices.map((project) => `${project.name} did not verify mobile emulation settings`),
-    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`)
+    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`),
+    ...versionEvidenceMissing
   ];
   const failedProjects = compatibility.projects.filter((project) => project.failed > 0);
-  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`)], compatibility.tool, compatibility.version), matrix: compatibility.projects } : {
-    status: failedProjects.length ? "fail" : "pass",
-    issues: failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`),
+  const testFailures = failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`);
+  const matrix = compatibility.projects.map((project) => ({
+    ...project,
+    minimumTestedBrowserVersion: policy.compatibility.minimumTestedBrowserVersions?.[project.name],
+    minimumEmulatedOsVersion: policy.compatibility.minimumEmulatedOsVersions?.[project.name]
+  }));
+  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...testFailures, ...versionFailures], compatibility.tool, compatibility.version), matrix } : {
+    status: testFailures.length || versionFailures.length ? "fail" : "pass",
+    issues: [...testFailures, ...versionFailures],
     tool: compatibility.tool,
     version: compatibility.version,
     scanned: compatibility.projects.reduce((count, project) => count + project.passed + project.failed, 0),
-    matrix: compatibility.projects
+    matrix
+  };
+  let accessibilityDomain;
+  if (policy.accessibility) {
+    const rules = policy.accessibility;
+    const result = app.accessibility;
+    if (!result) accessibilityDomain = incomplete(["Accessibility scan evidence is missing"]);
+    else {
+      const missing = [...!result.complete || result.errors.length ? ["Accessibility scan did not complete", ...result.errors] : []];
+      for (const project of rules.requiredProjects) {
+        const scans = result.scans.filter((scan) => scan.project === project);
+        if (scans.length < rules.minimumScansPerProject) missing.push(`${project} has fewer than ${rules.minimumScansPerProject} accessibility scans`);
+      }
+      for (const scan of result.scans) {
+        if (scan.checks < rules.minimumChecksPerScan) missing.push(`${scan.project} ${scan.route} checked fewer than ${rules.minimumChecksPerScan} axe rules`);
+        if (rules.requiredTags.some((tag) => !scan.tags.includes(tag))) missing.push(`${scan.project} ${scan.route} omitted required WCAG tags`);
+        const measuredVersion2 = numericVersion(scan.axeVersion);
+        if (!measuredVersion2) missing.push(`${scan.project} ${scan.route} did not record a valid axe-core version`);
+        else if (belowVersion(measuredVersion2, numericVersion(rules.minimumAxeVersion))) {
+          missing.push(`${scan.project} ${scan.route} used axe-core ${scan.axeVersion} below ${rules.minimumAxeVersion}`);
+        }
+      }
+      const findings2 = result.scans.flatMap((scan) => scan.violations);
+      const needsReview = result.scans.reduce((sum, scan) => sum + scan.needsReview, 0);
+      if (needsReview > rules.maximumNeedsReview) missing.push(`${needsReview} axe checks need manual review (maximum ${rules.maximumNeedsReview})`);
+      const failures = findings2.length > rules.maximumViolations ? [`${findings2.length} accessibility violations exceed ${rules.maximumViolations}`] : [];
+      const details = {
+        tool: result.tool,
+        version: result.version,
+        scanned: result.scans.length,
+        findings: findings2,
+        metrics: { scans: result.scans.length, axeChecks: result.scans.reduce((sum, scan) => sum + scan.checks, 0), needsReview },
+        routes: result.scans.map((scan) => ({
+          project: scan.project,
+          route: scan.route,
+          axeVersion: scan.axeVersion,
+          checks: scan.checks,
+          needsReview: scan.needsReview
+        }))
+      };
+      accessibilityDomain = failures.length ? { status: "fail", issues: [...failures, ...missing], ...details } : missing.length ? { ...incomplete(missing, result.tool, result.version, result.scans.length), ...details } : { status: "pass", issues: [], ...details };
+    }
+  }
+  return {
+    dependencySecurity,
+    codeQuality,
+    codeSecurity,
+    compatibility: compatibilityDomain,
+    ...accessibilityDomain ? { accessibility: accessibilityDomain } : {}
   };
-  return { dependencySecurity, codeQuality, codeSecurity, compatibility: compatibilityDomain };
 }
 
 // src/governance/assess.ts
@@ -1408,7 +1600,8 @@ function renderAssessmentHtml(report) {
     dependencySecurity: "Dependency security",
     codeQuality: "Code quality",
     codeSecurity: "Code security",
-    compatibility: "Browser compatibility"
+    compatibility: "Browser compatibility",
+    accessibility: "Accessibility"
   };
   const domainNames = report.apps.length ? Object.keys(report.apps[0].domains) : [];
   const overview = domainNames.map((name) => {
@@ -1423,8 +1616,9 @@ function renderAssessmentHtml(report) {
       const identity = evidence.tool ? `<p><small>${escapeHtml(evidence.tool)} ${escapeHtml(evidence.version ?? "")} \xB7 scanned ${escapeHtml(evidence.scanned ?? "unknown")}</small></p>` : "";
       const metrics = evidence.metrics ? `<p><small>${Object.entries(evidence.metrics).map(([key, value]) => `${escapeHtml(key)}: ${escapeHtml(value)}`).join(" \xB7 ")}</small></p>` : "";
       const findings3 = evidence.findings?.length ? `<details><summary>${evidence.findings.length} finding(s)</summary><ul>${evidence.findings.map((item) => `<li><strong>${escapeHtml(item.severity)}</strong> ${escapeHtml(item.id)} \xB7 <code>${escapeHtml(item.subject)}</code> \u2014 ${escapeHtml(item.message)}${item.remediation ? ` \xB7 ${escapeHtml(item.remediation)}` : ""}</li>`).join("")}</ul></details>` : "";
-      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Browser / device</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml([item.browserVersion, item.device].filter(Boolean).join(" \xB7 ") || "Not recorded")}</td><td>${escapeHtml(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table></div>` : "";
-      return `<tr><th scope="row">${escapeHtml(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}</td></tr>`;
+      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Measured browser / minimum test environment</th><th>Mobile UA emulation / minimum</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml(item.browserVersion ?? "Not recorded")} / ${escapeHtml(item.minimumTestedBrowserVersion ?? "Not set")}</td><td>${escapeHtml(item.device ?? "None")} / ${escapeHtml(item.minimumEmulatedOsVersion ?? "Not set")}</td><td>${escapeHtml(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table><p><small>Version floors check the tested environment. Mobile OS values come from user-agent emulation, not physical devices or a promise of support for older versions.</small></p></div>` : "";
+      const routes = evidence.routes?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Scanned route</th><th>axe-core</th><th>Checks</th><th>Needs review</th></tr></thead><tbody>${evidence.routes.map((item) => `<tr><th scope="row">${escapeHtml(item.project)}</th><td><code>${escapeHtml(item.route)}</code></td><td>${escapeHtml(item.axeVersion)}</td><td>${item.checks}</td><td>${item.needsReview}</td></tr>`).join("")}</tbody></table><p><small>Only these visited routes were scanned automatically. Manual accessibility review remains outside this result.</small></p></div>` : "";
+      return `<tr><th scope="row">${escapeHtml(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}${routes}</td></tr>`;
     }).join("");
     const architecture = app.domains.architecture;
     const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml(category.id)}</th><td>${escapeHtml(category.weight)}%</td><td>${escapeHtml(category.score)}</td><td>${escapeHtml(category.findingCount)}</td></tr>`).join("") ?? "";
@@ -1443,8 +1637,8 @@ async function assessGovernance(options) {
   if (scanRelative === ".." || scanRelative.startsWith(`..${sep6}`)) throw new Error("Scan root must be inside workspace root");
   if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
   const assessment = parseAssessmentPolicy(options.policy.assessment);
-  const outputDirectory = resolve8(options.outputDirectory ?? join8(scanRoot, ".nklattice-governance"));
-  const inventorySource = resolve8(options.inventory ?? join8(scanRoot, ".nklattice-apps.json"));
+  const outputDirectory = resolve8(options.outputDirectory ?? join9(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve8(options.inventory ?? join9(scanRoot, ".nklattice-apps.json"));
   let inventory;
   const issues = [];
   try {
@@ -1543,16 +1737,39 @@ async function assessGovernance(options) {
     ...evidence ? { evidence: { source: options.evidence ? resolve8(options.evidence) : "in-process collector", generatedAt: evidence.generatedAt, commit: evidence.commit, inputSha256: evidence.inputSha256 } } : {},
     inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
     scope: {
-      domains: ["explicit app inventory", "dependency minimums", "source architecture", ...assessment.evidence ? ["known dependency advisories", "source quality", "source security", "browser and mobile emulation"] : []],
-      notEvaluated: assessment.evidence ? ["licenses", "physical Android/iOS devices", "runtime performance", "cryptographic evidence attestation", "branch protection", "repository access controls", "cross-repository rollout status"] : notEvaluated
+      domains: [
+        "explicit app inventory",
+        "dependency minimums",
+        ...options.policy.managedPackages ? ["conditional managed-library minimums"] : [],
+        "source architecture",
+        ...assessment.evidence ? [
+          "known dependency advisories",
+          "source quality",
+          "source security",
+          "browser and mobile emulation",
+          "tested browser and emulated OS version floors",
+          ...assessment.evidence.accessibility ? ["automated accessibility"] : []
+        ] : []
+      ],
+      notEvaluated: assessment.evidence ? [
+        "licenses",
+        "physical Android/iOS devices",
+        "older browser-version support",
+        "runtime performance",
+        ...assessment.evidence.accessibility ? ["manual accessibility review and unvisited routes"] : ["accessibility"],
+        "cryptographic evidence attestation",
+        "branch protection",
+        "repository access controls",
+        "cross-repository rollout status"
+      ] : notEvaluated
     },
     issues,
     apps: results
   };
   await mkdir(outputDirectory, { recursive: true });
-  await writeFile(join8(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+  await writeFile(join9(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
 `);
-  await writeFile(join8(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  await writeFile(join9(outputDirectory, "report.html"), renderAssessmentHtml(report));
   return report;
 }
 export {