@bridge-ds/core 0.2.0 → 0.3.0

package/dist/{component-spec-B0V_D3gM.js → component-spec-IRFGJ7XK.js}

@@ -100,12 +100,12 @@ function previewComment(input) {
   }
   lines.push("");
   const ctx = { branch: input.branch, pr: input.pr, sha: input.sha };
-  const links = previewLinks(input.apps, ctx);
+  const previews = input.previews ?? resolveBranchPreviews(input.apps, ctx);
   lines.push("### Previews", "");
-  if (links.length) {
+  if (previews.length) {
     lines.push("| App | Preview |", "| --- | --- |");
-    for (const l of links) lines.push(`| ${l.label} | ${l.url} |`);
-    const docs = previewUrl(input.apps.docs, ctx);
+    for (const p of previews) lines.push(`| ${p.label} | ${p.url ?? "Link in the Vercel comment on this pull request"} |`);
+    const docs = previews.find((p) => p.app === "docs")?.url;
     if (docs) {
       lines.push("");
       lines.push(`Tokens only, no reinstall: open your staging with \`?bridge-tokens=${new URL("tokens.css", docs).href}\` (the staging app must allow this origin, see docs/PREVIEWS.md).`);
@@ -115,6 +115,449 @@ function previewComment(input) {
   }
   return lines.join("\n") + "\n";
 }
+function installCommandFromPreviewComment(body) {
+  if (!body || !body.trimStart().startsWith(PREVIEW_COMMENT_MARKER)) return null;
+  const m = /```(?:sh|bash|shell)[^\n]*\n([\s\S]*?)```/.exec(body);
+  if (!m) return null;
+  const command = m[1].split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).join(" ").replace(/\s*\\\s+/g, " ").replace(/\s+/g, " ").trim();
+  return command || null;
+}
+function readPreviewComment(body) {
+  if (!body || !body.trimStart().startsWith(PREVIEW_COMMENT_MARKER)) return null;
+  const command = installCommandFromPreviewComment(body);
+  const sha7 = /Snapshot of `([0-9a-f]{7,40})`/.exec(body)?.[1]?.slice(0, 7) ?? null;
+  const source = !command ? "none" : command.includes("https://pkg.pr.new/") ? "pkg.pr.new" : /\/releases\/download\/preview-pr-\d+\//.test(command) ? "release" : "other";
+  return { command, sha7, source };
+}
+function findPreviewComment(comments) {
+  return [...comments].reverse().find((c) => !!c.body && c.body.trimStart().startsWith(PREVIEW_COMMENT_MARKER));
+}
+const httpsUrl = (raw) => {
+  if (!raw || typeof raw !== "string") return null;
+  try {
+    const u = new URL(/^https?:\/\//i.test(raw) ? raw : `https://${raw}`);
+    return u.protocol === "https:" || u.protocol === "http:" ? u.href : null;
+  } catch {
+    return null;
+  }
+};
+const decodeBase64 = (b64) => {
+  const bin = atob(b64.replace(/\s/g, ""));
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder("utf-8").decode(bytes);
+};
+const isVercelComment = (body) => !!body && /^\[vc\]: #[^:\s]*:[A-Za-z0-9+/=]+/m.test(body);
+function parseVercelComment(body) {
+  if (!body) return null;
+  const m = /^\[vc\]: #[^:\s]*:([A-Za-z0-9+/=]+)/m.exec(body);
+  if (!m) return null;
+  let data;
+  try {
+    data = JSON.parse(decodeBase64(m[1]));
+  } catch {
+    return null;
+  }
+  if (!data || !Array.isArray(data.projects)) return null;
+  return data.projects.filter((p) => p && typeof p.name === "string").map((p) => ({ name: p.name, previewUrl: httpsUrl(typeof p.previewUrl === "string" ? p.previewUrl : null), status: typeof p.nextCommitStatus === "string" ? p.nextCommitStatus : null }));
+}
+function findVercelComment(comments) {
+  return [...comments].reverse().find((c) => isVercelComment(c.body));
+}
+function templateHostPrefix(template) {
+  if (!template) return null;
+  const host = /^https?:\/\/([^/?#]+)/i.exec(template)?.[1];
+  if (!host) return null;
+  return host.split(".")[0].split("{")[0].toLowerCase();
+}
+function appForProject(project, apps) {
+  const name = project.trim().toLowerCase();
+  if (!name) return null;
+  const keys = Object.keys(PREVIEW_APP_LABELS);
+  const prefixes = keys.map((app) => [app, templateHostPrefix(apps[app])]);
+  const exact = prefixes.find(([, p]) => p === `${name}-git-` || p === name);
+  if (exact) return exact[0];
+  const loose = prefixes.filter(([, p]) => p !== null && p.startsWith(`${name}-`));
+  return loose.length === 1 ? loose[0][0] : null;
+}
+function projectOfLabel(label) {
+  const m = /^\s*(?:preview|vercel)\s*[\u2013\u2014-]\s*(.+?)\s*$/i.exec(label);
+  return m ? m[1] : null;
+}
+const STATE_OF = {
+  success: "ready",
+  inactive: "ready",
+  deployed: "ready",
+  ready: "ready",
+  ignored: "ready",
+  // Vercel skipped the build (nothing changed for this app): the branch alias serves the last one.
+  pending: "building",
+  queued: "building",
+  in_progress: "building",
+  building: "building",
+  initializing: "building",
+  failure: "failed",
+  error: "failed",
+  failed: "failed",
+  canceled: "failed"
+};
+const stateOf = (s) => STATE_OF[(s ?? "").toLowerCase()] ?? "unknown";
+const isInspectorUrl = (u) => /^https:\/\/(?:www\.)?vercel\.com\//i.test(u);
+function resolveBranchPreviews(apps, ctx, sources = {}) {
+  const seen = /* @__PURE__ */ new Map();
+  const at = (app) => seen.get(app) ?? (seen.set(app, {}), seen.get(app));
+  const offer = (app, url, urlSource, state, stateRank) => {
+    if (!app) return;
+    const s = at(app);
+    if (url && !s.url) Object.assign(s, { url, urlSource });
+    if (state !== "unknown" && (s.stateRank === void 0 || stateRank < s.stateRank)) Object.assign(s, { state, stateRank });
+  };
+  const contexts = /* @__PURE__ */ new Set();
+  for (const st of sources.statuses ?? []) {
+    if (contexts.has(st.context)) continue;
+    contexts.add(st.context);
+    const project = projectOfLabel(st.context);
+    if (!project) continue;
+    const url = httpsUrl(st.target_url);
+    offer(appForProject(project, apps), url && !isInspectorUrl(url) ? url : null, "status", stateOf(st.state), 0);
+  }
+  for (const d of sources.deployments ?? []) {
+    const project = projectOfLabel(d.environment);
+    const app = project ? appForProject(project, apps) : null;
+    if (!app) continue;
+    const url = httpsUrl(d.environmentUrl);
+    const s = at(app);
+    if (url && s.urlSource !== "deployment") Object.assign(s, { url, urlSource: "deployment" });
+    const state = stateOf(d.state);
+    if (state !== "unknown" && (s.stateRank === void 0 || 1 < s.stateRank)) Object.assign(s, { state, stateRank: 1 });
+  }
+  for (const p of parseVercelComment(findVercelComment(sources.comments ?? [])?.body) ?? []) offer(appForProject(p.name, apps), p.previewUrl, "vercel-comment", stateOf(p.status), 2);
+  const out = [];
+  for (const app of Object.keys(PREVIEW_APP_LABELS)) {
+    if (!apps[app]) continue;
+    const s = seen.get(app) ?? {};
+    const url = s.url ?? previewUrl(apps[app], ctx);
+    const source = s.url ? s.urlSource : url ? "template" : null;
+    out.push({ app, label: PREVIEW_APP_LABELS[app], url, state: s.state ?? "unknown", source });
+  }
+  return out;
+}
+const previewLinksOf = (previews) => previews.filter((p) => !!p.url).map((p) => ({ app: p.app, label: p.label, url: p.url }));
+const previewsSettled = (previews) => previews.every((p) => !!p.url && (p.state === "ready" || p.state === "failed"));
+const LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+const SLUG = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+function parseOwnerEntry(raw) {
+  if (typeof raw !== "string") return null;
+  const s = raw.trim().replace(/^@/, "");
+  const slash = s.indexOf("/");
+  if (slash < 0) return LOGIN.test(s) ? { kind: "person", login: s } : null;
+  const org = s.slice(0, slash);
+  const slug = s.slice(slash + 1);
+  return LOGIN.test(org) && SLUG.test(slug) ? { kind: "team", org, slug } : null;
+}
+function formatOwnerEntry(e) {
+  return e.kind === "team" ? `@${e.org}/${e.slug}` : e.login;
+}
+const isTeamEntry = (raw) => parseOwnerEntry(raw)?.kind === "team";
+const teamKey = (org, slug) => `@${org.toLowerCase()}/${slug.toLowerCase()}`;
+function teamKeyOf(raw) {
+  const e = parseOwnerEntry(raw);
+  return e?.kind === "team" ? teamKey(e.org, e.slug) : void 0;
+}
+function ownerEntryProblems(raw) {
+  if (raw === void 0) return [];
+  const isObj2 = (x) => Boolean(x) && typeof x === "object" && !Array.isArray(x);
+  if (!isObj2(raw)) return ['"governance.owners" must be { "design": [people or teams], "tech": [people or teams] }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (k !== "design" && k !== "tech") {
+      out.push(`"governance.owners.${k}" is not an owner group (design, tech)`);
+      continue;
+    }
+    if (!Array.isArray(v)) {
+      out.push(`"governance.owners.${k}" must be a list of people or teams`);
+      continue;
+    }
+    v.forEach((x, i) => {
+      if (typeof x !== "string" || !parseOwnerEntry(x))
+        out.push(`"governance.owners.${k}[${i}]" (${JSON.stringify(x)}) is not a GitHub login or team. Write a person as "peterbono" or "@peterbono", a team as "@org/team-slug".`);
+    });
+  }
+  return out;
+}
+function teamUnreadableMessage(team, reason) {
+  const name = `@${team.org}/${team.slug}`;
+  switch (reason) {
+    case "personal-account":
+      return `${name} cannot be used: ${team.org} is a personal GitHub account, and teams only exist in organizations. List people instead, or move the repository to an organization.`;
+    case "missing-permission":
+      return `The members of ${name} cannot be read: the GitHub token needs read:org (classic token) or Members: Read on the ${team.org} organization (fine-grained token).`;
+    case "no-token":
+      return `The members of ${name} cannot be read without a working GitHub token. Connect GitHub with a token that has read:org.`;
+    case "not-found":
+      return `${name} was not found. Check the team slug on GitHub, or give the token read:org so it can see the team.`;
+    case "unreachable":
+      return `The members of ${name} cannot be read right now: GitHub did not answer. Try again in a moment.`;
+  }
+}
+function teamsIn(owners) {
+  const all = Array.isArray(owners) ? owners : [...owners.design ?? [], ...owners.tech ?? []];
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of all) {
+    const e = parseOwnerEntry(raw);
+    if (e?.kind === "team") out.set(teamKey(e.org, e.slug), { key: teamKey(e.org, e.slug), org: e.org, slug: e.slug });
+  }
+  return [...out.values()];
+}
+const norm$1 = (x) => x.trim().toLowerCase().replace(/^@/, "");
+function expandEntries(entries, teams) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (x) => {
+    const k = norm$1(x);
+    if (k && !seen.has(k)) {
+      seen.add(k);
+      out.push(x.replace(/^@(?=[^/]+$)/, ""));
+    }
+  };
+  for (const raw of entries) {
+    const e = parseOwnerEntry(raw);
+    if (!e) continue;
+    if (e.kind === "person") add(e.login);
+    else {
+      const state = teams?.[teamKey(e.org, e.slug)];
+      if (state?.status === "ok") state.members.forEach(add);
+      else add(teamKey(e.org, e.slug));
+    }
+  }
+  return out;
+}
+function expandOwners(owners, teams) {
+  return { design: expandEntries(owners.design, teams), tech: expandEntries(owners.tech, teams) };
+}
+const people = (n) => `${n} ${n === 1 ? "person" : "people"}`;
+function entryLabel(raw, teams) {
+  const e = parseOwnerEntry(raw);
+  if (!e) return raw;
+  if (e.kind === "person") return `@${e.login}`;
+  const state = teams?.[teamKey(e.org, e.slug)];
+  const name = `@${e.org}/${e.slug}`;
+  return state?.status === "ok" ? `${name} (${people(state.members.length)})` : name;
+}
+function entriesFor(entries, logins, teams) {
+  const want = new Set(logins.map(norm$1));
+  const out = [];
+  for (const raw of entries) {
+    const e = parseOwnerEntry(raw);
+    if (!e) continue;
+    if (e.kind === "person") {
+      if (want.has(norm$1(e.login))) out.push(entryLabel(raw, teams));
+      continue;
+    }
+    const state = teams?.[teamKey(e.org, e.slug)];
+    if (state?.status !== "ok" || state.members.some((m) => want.has(norm$1(m)))) out.push(entryLabel(raw, teams));
+  }
+  return [...new Set(out)];
+}
+function unreadableTeams(teams) {
+  return Object.values(teams ?? {}).filter((t) => t.status === "unreadable");
+}
+class TeamDirectory {
+  constructor(reader, opts = {}) {
+    this.reader = reader;
+    this.ttl = opts.ttlMs ?? 5 * 6e4;
+    this.now = opts.now ?? Date.now;
+  }
+  reader;
+  teams = /* @__PURE__ */ new Map();
+  accounts = /* @__PURE__ */ new Map();
+  memberships = /* @__PURE__ */ new Map();
+  ttl;
+  now;
+  accountType(org) {
+    const k = org.toLowerCase();
+    let p = this.accounts.get(k);
+    if (!p) {
+      p = this.reader.getAccountType(org).catch(() => null);
+      this.accounts.set(k, p);
+    }
+    return p;
+  }
+  /** The reason a read of `org` failed, as a state. A 404 on a personal account says so; a 403 is a missing permission. */
+  async failure(ref, err) {
+    const e = err ?? {};
+    let reason;
+    if (!this.reader.hasToken) reason = await this.accountType(ref.org) === "User" ? "personal-account" : "no-token";
+    else if (e.status === 401) reason = "no-token";
+    else if (e.status === 403 || e.auth === "missing-permission") reason = "missing-permission";
+    else if (e.status === 404) reason = await this.accountType(ref.org) === "User" ? "personal-account" : "not-found";
+    else reason = "unreachable";
+    return { ...ref, status: "unreadable", reason, message: teamUnreadableMessage(ref, reason) };
+  }
+  /** Members of one team, or why they cannot be read. Cached. */
+  team(org, slug) {
+    const ref = { key: teamKey(org, slug), org, slug };
+    const hit = this.teams.get(ref.key);
+    if (hit && this.now() - hit.at < this.ttl) return hit.value;
+    const value = (async () => {
+      if (!this.reader.hasToken) return this.failure(ref, void 0);
+      try {
+        const members = await this.reader.listTeamMembers(org, slug);
+        return { ...ref, status: "ok", members };
+      } catch (err) {
+        return this.failure(ref, err);
+      }
+    })();
+    this.teams.set(ref.key, { at: this.now(), value });
+    void value.then((s) => {
+      if (s.status === "unreadable" && s.reason === "unreachable") this.teams.delete(ref.key);
+    });
+    return value;
+  }
+  /** Every team named in the owner lists, read in parallel. Empty object when no team is named (no request). */
+  async resolve(owners) {
+    const refs = teamsIn(owners);
+    const states = await Promise.all(refs.map((r) => this.team(r.org, r.slug)));
+    return Object.fromEntries(states.map((s) => [s.key, s]));
+  }
+  /**
+   * Whether `login` is an active member of one team: from the cached member list when there is one, else one
+   * membership read (GET /orgs/{org}/teams/{slug}/memberships/{user}). An unreadable team returns its state.
+   */
+  async isMember(org, slug, login) {
+    const ref = { key: teamKey(org, slug), org, slug };
+    const cached = this.teams.get(ref.key);
+    if (cached && this.now() - cached.at < this.ttl) {
+      const s = await cached.value;
+      if (s.status === "ok") return s.members.some((m) => norm$1(m) === norm$1(login));
+    }
+    const k = `${ref.key}#${norm$1(login)}`;
+    const hit = this.memberships.get(k);
+    if (hit && this.now() - hit.at < this.ttl) return hit.value;
+    const value = (async () => {
+      if (!this.reader.hasToken) return this.failure(ref, void 0);
+      try {
+        return await this.reader.getTeamMembership(org, slug, login) === "active";
+      } catch (err) {
+        return this.failure(ref, err);
+      }
+    })();
+    this.memberships.set(k, { at: this.now(), value });
+    return value;
+  }
+  /**
+   * Whether `login` holds a right given to `entries` (people and teams): a person entry matches directly, a team
+   * through its membership. Teams are only read when no person entry matches.
+   */
+  async memberOfAny(entries, login) {
+    const unreadable = [];
+    const parsed = entries.map(parseOwnerEntry).filter((e) => Boolean(e));
+    if (parsed.some((e) => e.kind === "person" && norm$1(e.login) === norm$1(login))) return { member: true, unreadable };
+    for (const e of parsed) {
+      if (e.kind !== "team") continue;
+      const r = await this.isMember(e.org, e.slug, login);
+      if (r === true) return { member: true, unreadable };
+      if (typeof r === "object" && r.status === "unreadable") unreadable.push(r);
+    }
+    return { member: false, unreadable };
+  }
+  /** The organization's teams for a picker, or why they cannot be listed (a personal account has none). */
+  async orgTeams(org) {
+    if (await this.accountType(org) === "User") return { status: "unreadable", reason: "personal-account" };
+    if (!this.reader.hasToken) return { status: "unreadable", reason: "no-token" };
+    try {
+      return { status: "ok", teams: await this.reader.listOrgTeams(org) };
+    } catch (err) {
+      const s = await this.failure({ key: teamKey(org, "*"), org, slug: "*" }, err);
+      return { status: "unreadable", reason: s.status === "unreadable" ? s.reason : "unreachable" };
+    }
+  }
+  /** Drops every cached read (after the token changes). */
+  clear() {
+    this.teams.clear();
+    this.accounts.clear();
+    this.memberships.clear();
+  }
+}
+const OWNER_GROUPS = ["design", "tech"];
+const RIGHTS = ["approveDesign", "approveTech", "ship"];
+const RIGHT_LABEL = {
+  approveDesign: "Approve design",
+  approveTech: "Approve tech",
+  ship: "Ship"
+};
+const DEFAULT_RIGHTS = { approveDesign: ["design"], approveTech: ["tech"], ship: ["tech"] };
+const norm = (x) => x.trim().toLowerCase().replace(/^@/, "");
+const uniq = (xs) => [...new Set(xs)];
+function normalizeRights(input) {
+  const pick = (r) => {
+    const v = input?.[r];
+    if (!Array.isArray(v)) return [...DEFAULT_RIGHTS[r]];
+    return OWNER_GROUPS.filter((g) => v.includes(g));
+  };
+  return { approveDesign: pick("approveDesign"), approveTech: pick("approveTech"), ship: pick("ship") };
+}
+function rightsProblems(raw) {
+  if (raw === void 0) return [];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return ['"governance.rights" must be { "approveDesign": [groups], "approveTech": [groups], "ship": [groups] }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (!RIGHTS.includes(k)) out.push(`"governance.rights.${k}" is not a right (${RIGHTS.join(", ")})`);
+    else if (!Array.isArray(v) || v.length === 0 || !v.every((g) => OWNER_GROUPS.includes(g)))
+      out.push(`"governance.rights.${k}" must list one or more of "design", "tech"`);
+  }
+  return out;
+}
+function holdersOf(right, owners, rights) {
+  const groups = (rights ?? DEFAULT_RIGHTS)[right];
+  return uniq(groups.flatMap((g) => owners[g] ?? []));
+}
+function approverLists(owners, rights, teams) {
+  const entries = approverEntries(owners, rights);
+  return teams === void 0 ? entries : expandOwners(entries, teams);
+}
+function approverEntries(owners, rights) {
+  if (!rights) return { design: [...owners.design], tech: [...owners.tech] };
+  return { design: holdersOf("approveDesign", owners, rights), tech: holdersOf("approveTech", owners, rights) };
+}
+function shipPolicy(owners, rights, teams) {
+  if (!rights) return null;
+  const entries = holdersOf("ship", owners, rights);
+  if (!entries.length) return null;
+  const logins = expandEntries(entries, teams);
+  return { logins, groups: [...rights.ship], entries, ...teams ? { teams } : {} };
+}
+function unreadableShipTeams(policy) {
+  if (!policy?.teams) return [];
+  const keys = new Set((policy.entries ?? []).map((e) => e.trim().toLowerCase().replace(/^@?/, "@")));
+  return unreadableTeams(policy.teams).filter((t) => keys.has(t.key));
+}
+function canShip(login, policy) {
+  if (!policy) return true;
+  if (!login || login.includes("/")) return false;
+  return policy.logins.map(norm).includes(norm(login));
+}
+function groupsPhrase(groups) {
+  const g = OWNER_GROUPS.filter((x) => groups.includes(x));
+  if (g.length === 1) return `the ${g[0]} owner`;
+  return `a ${g.join(" or ")} owner`;
+}
+function whoCanShipSentence(policy) {
+  const names = (policy.entries ?? policy.logins).map((l) => entryLabel(l, policy.teams)).join(", ");
+  return `Only ${groupsPhrase(policy.groups)} can ship this${names ? ` (${names})` : ""}.`;
+}
+const DEFAULT_VISUAL_IMPACT = { mode: "auto" };
+const VISUAL_CHECK_LABEL = "visual-check";
+function visualImpactProblems(raw) {
+  if (raw === void 0) return [];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return ['"visualImpact" must be { "mode": "auto" | "on-demand" }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (k !== "mode") out.push(`"visualImpact.${k}" is not a setting (mode)`);
+    else if (v !== "auto" && v !== "on-demand") out.push('"visualImpact.mode" must be "auto" or "on-demand"');
+  }
+  return out;
+}
 const CONFIG_FILE = "bridge.config.json";
 const DEFAULT_OVERRIDE = { allowed: [], requireReason: true, minReasonLength: 20 };
 const DEFAULT_TOKEN_PATHS = {
@@ -251,9 +694,11 @@ function defineConfig(input) {
           requireReason: g.override.requireReason ?? DEFAULT_OVERRIDE.requireReason,
           minReasonLength: g.override.minReasonLength ?? DEFAULT_OVERRIDE.minReasonLength
         }
-      } : {}
+      } : {},
+      ...g.rights ? { rights: normalizeRights(g.rights) } : {}
     },
     ...input.audit ? { audit: { ...input.audit } } : {},
+    ...input.visualImpact ? { visualImpact: { mode: input.visualImpact.mode === "on-demand" ? "on-demand" : "auto" } } : {},
     ...input.integrations ? { integrations: { ...input.integrations } } : {},
     ...input.previews ? {
       previews: {
@@ -360,9 +805,7 @@ function loadConfig(source) {
     else {
       for (const k of ["protectedBranches", "labels", "guardrails"]) if (gov[k] !== void 0 && !(Array.isArray(gov[k]) && gov[k].every((x) => typeof x === "string"))) problems.push(`"governance.${k}" must be a list of strings`);
       if (gov.branchPrefix !== void 0 && !isStr(gov.branchPrefix)) problems.push('"governance.branchPrefix" must be a non-empty string');
-      const o = gov.owners;
-      if (o !== void 0 && (!isObj(o) || ["design", "tech"].some((k) => o[k] !== void 0 && !(Array.isArray(o[k]) && o[k].every((x) => typeof x === "string")))))
-        problems.push('"governance.owners" must be { "design": [logins], "tech": [logins] }');
+      problems.push(...ownerEntryProblems(gov.owners));
       const ov = gov.override;
       if (ov !== void 0) {
         if (!isObj(ov)) problems.push('"governance.override" must be an object');
@@ -372,8 +815,10 @@ function loadConfig(source) {
           if (ov.minReasonLength !== void 0 && !(Number.isInteger(ov.minReasonLength) && ov.minReasonLength >= 0)) problems.push('"governance.override.minReasonLength" must be a whole number, 0 or more');
         }
       }
+      problems.push(...rightsProblems(gov.rights));
     }
   }
+  problems.push(...visualImpactProblems(d.visualImpact));
   const audit = d.audit;
   if (audit !== void 0) {
     if (!isObj(audit)) problems.push('"audit" must be an object');
@@ -419,7 +864,8 @@ function toConfigJson(config, schema = "./packages/core/bridge.config.schema.jso
     cssVar: config.cssVar,
     governance: config.governance,
     ...config.audit ? { audit: config.audit } : {},
-    ...config.previews ? { previews: config.previews } : {}
+    ...config.previews ? { previews: config.previews } : {},
+    ...config.visualImpact ? { visualImpact: config.visualImpact } : {}
   };
 }
 class JsonParseError extends Error {
@@ -2480,7 +2926,7 @@ function parseComponentSpecs(text) {
 }
 const tokenCssVar = (path, prefix = "--", separator = "-") => `${prefix}${path.split(".").join(separator)}`;
 export {
-  checkLayeredPair as $,
+  parseContrastChecks as $,
   removeToken as A,
   moveToken as B,
   COMPONENT_SPECS_VERSION as C,
@@ -2504,117 +2950,159 @@ export {
   DEFAULT_TOKEN_PATHS as U,
   applyTokenEdits as V,
   buildHistoryEntry as W,
-  tokensPath as X,
-  coerceValue as Y,
-  toConfigJson as Z,
-  parseContrastChecks as _,
+  resolveBranchPreviews as X,
+  tokensPath as Y,
+  coerceValue as Z,
+  toConfigJson as _,
   assertSafeBranch as a,
-  findToken as a$,
-  classifyRisk as a0,
-  formatChangeset as a1,
-  RISK_LABELS as a2,
-  parseJson as a3,
-  serializeJson as a4,
-  plainEqual as a5,
-  toPlain as a6,
-  getEntry as a7,
-  fromPlain as a8,
-  snapshotUrl as a9,
-  branchSlug as aA,
-  changeKind as aB,
-  changeTable as aC,
-  changedModes as aD,
-  changesetBump as aE,
-  classifyLayered as aF,
-  clearRawDeep as aG,
-  commitMessage as aH,
-  composeChangeset as aI,
-  composePrBody as aJ,
-  composeProposalBody as aK,
-  composite as aL,
-  contextFor as aM,
-  contrastDelta as aN,
-  contrastDeltaTable as aO,
-  contrastLevel as aP,
-  contrastPair as aQ,
-  contrastRatio as aR,
-  countChanges as aS,
-  defaultContext as aT,
-  defaultTitle as aU,
-  defineConfig as aV,
-  detectLayout as aW,
-  diffLayered as aX,
-  fieldChanges as aY,
-  fileModes as aZ,
-  filterHistory as a_,
-  tarballUrl as aa,
-  previewLinks as ab,
-  slugify as ac,
-  installCommand as ad,
-  AAA_MIN as ae,
-  AA_MIN as af,
-  BULK_LIMIT as ag,
-  CONTRAST_CELL_MAX as ah,
-  CONTRAST_CHECKS_FILE as ai,
-  DEFAULT_COMPONENT_SPECS_FILE as aj,
-  DEFAULT_GOVERNANCE as ak,
-  DEFAULT_OVERRIDE as al,
-  JsonParseError as am,
-  PREVIEW_APP_LABELS as an,
-  PREVIEW_COMMENT_MARKER as ao,
-  PREVIEW_PLACEHOLDERS as ap,
-  PRIMITIVE_MODE as aq,
-  RISK_TIER as ar,
-  SPEC_FIELDS as as,
-  TIER_ORDER as at,
-  UNRELEASED as au,
-  affectedContrast as av,
-  appUrl as aw,
-  assignVersions as ax,
-  baseBranchOf as ay,
-  branchName as az,
+  contrastLevel as a$,
+  checkLayeredPair as a0,
+  classifyRisk as a1,
+  formatChangeset as a2,
+  RISK_LABELS as a3,
+  parseJson as a4,
+  serializeJson as a5,
+  plainEqual as a6,
+  toPlain as a7,
+  getEntry as a8,
+  fromPlain as a9,
+  TeamDirectory as aA,
+  UNRELEASED as aB,
+  VISUAL_CHECK_LABEL as aC,
+  affectedContrast as aD,
+  appForProject as aE,
+  appUrl as aF,
+  approverEntries as aG,
+  approverLists as aH,
+  assignVersions as aI,
+  baseBranchOf as aJ,
+  branchName as aK,
+  branchSlug as aL,
+  canShip as aM,
+  changeKind as aN,
+  changeTable as aO,
+  changedModes as aP,
+  changesetBump as aQ,
+  classifyLayered as aR,
+  clearRawDeep as aS,
+  commitMessage as aT,
+  composeChangeset as aU,
+  composePrBody as aV,
+  composeProposalBody as aW,
+  composite as aX,
+  contextFor as aY,
+  contrastDelta as aZ,
+  contrastDeltaTable as a_,
+  previewLinks as aa,
+  slugify as ab,
+  readPreviewComment as ac,
+  findPreviewComment as ad,
+  previewsSettled as ae,
+  AAA_MIN as af,
+  AA_MIN as ag,
+  BULK_LIMIT as ah,
+  CONTRAST_CELL_MAX as ai,
+  CONTRAST_CHECKS_FILE as aj,
+  DEFAULT_COMPONENT_SPECS_FILE as ak,
+  DEFAULT_GOVERNANCE as al,
+  DEFAULT_OVERRIDE as am,
+  DEFAULT_RIGHTS as an,
+  DEFAULT_VISUAL_IMPACT as ao,
+  JsonParseError as ap,
+  OWNER_GROUPS as aq,
+  PREVIEW_APP_LABELS as ar,
+  PREVIEW_COMMENT_MARKER as as,
+  PREVIEW_PLACEHOLDERS as at,
+  PRIMITIVE_MODE as au,
+  RIGHTS as av,
+  RIGHT_LABEL as aw,
+  RISK_TIER as ax,
+  SPEC_FIELDS as ay,
+  TIER_ORDER as az,
   parseChangelog as b,
-  firstParagraph as b0,
-  flattenTokens as b1,
-  formatNumber as b2,
-  getChild as b3,
-  indexByPath as b4,
-  inheritedTypeAt as b5,
-  isGuardrail as b6,
-  isTokenFile as b7,
-  kindForMin as b8,
-  layeredImpact as b9,
-  tokenNode as bA,
-  valueIn as bB,
-  variantName as bC,
-  versionTimeline as bD,
-  luminance as ba,
-  modeLabel as bb,
-  nodesEqual as bc,
-  overrideKey as bd,
-  pairKey as be,
-  parseChangesetText as bf,
-  parseComponentSpecs as bg,
-  planRestore as bh,
-  planRevert as bi,
-  planToJson as bj,
-  previewComment as bk,
-  previewUrl as bl,
-  protectedBranchesOf as bm,
-  renderedColor as bn,
-  resolve as bo,
-  runLayeredContrast as bp,
-  sameToken as bq,
-  specHash as br,
-  summarizeTokenChange as bs,
-  tarballAssetName as bt,
-  threeWayDiff as bu,
-  titleOf as bv,
-  toChangeSummary as bw,
-  toMap as bx,
-  tokenBump as by,
-  tokenHistory as bz,
+  tarballUrl as b$,
+  contrastPair as b0,
+  contrastRatio as b1,
+  countChanges as b2,
+  defaultContext as b3,
+  defaultTitle as b4,
+  defineConfig as b5,
+  detectLayout as b6,
+  diffLayered as b7,
+  entriesFor as b8,
+  entryLabel as b9,
+  nodesEqual as bA,
+  normalizeRights as bB,
+  overrideKey as bC,
+  ownerEntryProblems as bD,
+  pairKey as bE,
+  parseChangesetText as bF,
+  parseComponentSpecs as bG,
+  parseOwnerEntry as bH,
+  parseVercelComment as bI,
+  planRestore as bJ,
+  planRevert as bK,
+  planToJson as bL,
+  previewComment as bM,
+  previewLinksOf as bN,
+  previewUrl as bO,
+  projectOfLabel as bP,
+  protectedBranchesOf as bQ,
+  renderedColor as bR,
+  resolve as bS,
+  rightsProblems as bT,
+  runLayeredContrast as bU,
+  sameToken as bV,
+  shipPolicy as bW,
+  snapshotUrl as bX,
+  specHash as bY,
+  summarizeTokenChange as bZ,
+  tarballAssetName as b_,
+  expandEntries as ba,
+  expandOwners as bb,
+  fieldChanges as bc,
+  fileModes as bd,
+  filterHistory as be,
+  findToken as bf,
+  findVercelComment as bg,
+  firstParagraph as bh,
+  flattenTokens as bi,
+  formatNumber as bj,
+  formatOwnerEntry as bk,
+  getChild as bl,
+  groupsPhrase as bm,
+  holdersOf as bn,
+  indexByPath as bo,
+  inheritedTypeAt as bp,
+  installCommand as bq,
+  installCommandFromPreviewComment as br,
+  isGuardrail as bs,
+  isTeamEntry as bt,
+  isTokenFile as bu,
+  isVercelComment as bv,
+  kindForMin as bw,
+  layeredImpact as bx,
+  luminance as by,
+  modeLabel as bz,
   collectHistory as c,
+  teamKey as c0,
+  teamKeyOf as c1,
+  teamUnreadableMessage as c2,
+  teamsIn as c3,
+  threeWayDiff as c4,
+  titleOf as c5,
+  toChangeSummary as c6,
+  toMap as c7,
+  tokenBump as c8,
+  tokenHistory as c9,
+  tokenNode as ca,
+  unreadableShipTeams as cb,
+  unreadableTeams as cc,
+  valueIn as cd,
+  variantName as ce,
+  versionTimeline as cf,
+  visualImpactProblems as cg,
+  whoCanShipSentence as ch,
   buildReport as d,
   prNumberFromSubject as e,
   CONFIG_FILE as f,
@@ -2639,4 +3127,4 @@ export {
   contextLabel as y,
   pathId as z
 };
-//# sourceMappingURL=component-spec-B0V_D3gM.js.map
+//# sourceMappingURL=component-spec-IRFGJ7XK.js.map