@bridge-ds/mcp 0.0.0-stage → 0.3.0

package/dist/chunk-X455XY4E.js

@@ -0,0 +1,1718 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../core/src/previews.ts
+var PREVIEW_APP_LABELS = { docs: "Docs", storybook: "Storybook", admin: "Admin demo" };
+function branchSlug(branch) {
+  return branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function previewUrl(template, ctx) {
+  if (!template) return null;
+  const values = {
+    branch: branchSlug(ctx.branch),
+    rawBranch: encodeURIComponent(ctx.branch),
+    pr: ctx.pr === void 0 ? void 0 : String(ctx.pr),
+    sha: ctx.sha,
+    sha7: ctx.sha?.slice(0, 7)
+  };
+  let missing = false;
+  const filled = template.replace(/\{(\w+)\}/g, (_, key) => {
+    const v = values[key];
+    if (!v) missing = true;
+    return v ?? "";
+  });
+  if (missing) return null;
+  let url;
+  try {
+    url = new URL(filled);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  if (url.hostname.split(".").some((label) => label.length > 63)) return null;
+  return url.href;
+}
+function previewLinks(apps, ctx) {
+  const out = [];
+  for (const app of Object.keys(PREVIEW_APP_LABELS)) {
+    const url = previewUrl(apps[app], ctx);
+    if (url) out.push({ app, label: PREVIEW_APP_LABELS[app], url });
+  }
+  return out;
+}
+var PREVIEW_COMMENT_MARKER = "<!-- bridge-branch-preview -->";
+function installCommandFromPreviewComment(body) {
+  if (!body || !body.trimStart().startsWith(PREVIEW_COMMENT_MARKER)) return null;
+  const m = /```(?:sh|bash|shell)[^\n]*\n([\s\S]*?)```/.exec(body);
+  if (!m) return null;
+  const command = m[1].split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).join(" ").replace(/\s*\\\s+/g, " ").replace(/\s+/g, " ").trim();
+  return command || null;
+}
+function readPreviewComment(body) {
+  if (!body || !body.trimStart().startsWith(PREVIEW_COMMENT_MARKER)) return null;
+  const command = installCommandFromPreviewComment(body);
+  const sha7 = /Snapshot of `([0-9a-f]{7,40})`/.exec(body)?.[1]?.slice(0, 7) ?? null;
+  const source = !command ? "none" : command.includes("https://pkg.pr.new/") ? "pkg.pr.new" : /\/releases\/download\/preview-pr-\d+\//.test(command) ? "release" : "other";
+  return { command, sha7, source };
+}
+function findPreviewComment(comments) {
+  return [...comments].reverse().find((c) => !!c.body && c.body.trimStart().startsWith(PREVIEW_COMMENT_MARKER));
+}
+var httpsUrl = (raw) => {
+  if (!raw || typeof raw !== "string") return null;
+  try {
+    const u = new URL(/^https?:\/\//i.test(raw) ? raw : `https://${raw}`);
+    return u.protocol === "https:" || u.protocol === "http:" ? u.href : null;
+  } catch {
+    return null;
+  }
+};
+var decodeBase64 = (b64) => {
+  const bin = atob(b64.replace(/\s/g, ""));
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder("utf-8").decode(bytes);
+};
+var isVercelComment = (body) => !!body && /^\[vc\]: #[^:\s]*:[A-Za-z0-9+/=]+/m.test(body);
+function parseVercelComment(body) {
+  if (!body) return null;
+  const m = /^\[vc\]: #[^:\s]*:([A-Za-z0-9+/=]+)/m.exec(body);
+  if (!m) return null;
+  let data;
+  try {
+    data = JSON.parse(decodeBase64(m[1]));
+  } catch {
+    return null;
+  }
+  if (!data || !Array.isArray(data.projects)) return null;
+  return data.projects.filter((p) => p && typeof p.name === "string").map((p) => ({ name: p.name, previewUrl: httpsUrl(typeof p.previewUrl === "string" ? p.previewUrl : null), status: typeof p.nextCommitStatus === "string" ? p.nextCommitStatus : null }));
+}
+function findVercelComment(comments) {
+  return [...comments].reverse().find((c) => isVercelComment(c.body));
+}
+function templateHostPrefix(template) {
+  if (!template) return null;
+  const host = /^https?:\/\/([^/?#]+)/i.exec(template)?.[1];
+  if (!host) return null;
+  return host.split(".")[0].split("{")[0].toLowerCase();
+}
+function appForProject(project, apps) {
+  const name = project.trim().toLowerCase();
+  if (!name) return null;
+  const keys = Object.keys(PREVIEW_APP_LABELS);
+  const prefixes = keys.map((app) => [app, templateHostPrefix(apps[app])]);
+  const exact = prefixes.find(([, p]) => p === `${name}-git-` || p === name);
+  if (exact) return exact[0];
+  const loose = prefixes.filter(([, p]) => p !== null && p.startsWith(`${name}-`));
+  return loose.length === 1 ? loose[0][0] : null;
+}
+function projectOfLabel(label) {
+  const m = /^\s*(?:preview|vercel)\s*[\u2013\u2014-]\s*(.+?)\s*$/i.exec(label);
+  return m ? m[1] : null;
+}
+var STATE_OF = {
+  success: "ready",
+  inactive: "ready",
+  deployed: "ready",
+  ready: "ready",
+  ignored: "ready",
+  // Vercel skipped the build (nothing changed for this app): the branch alias serves the last one.
+  pending: "building",
+  queued: "building",
+  in_progress: "building",
+  building: "building",
+  initializing: "building",
+  failure: "failed",
+  error: "failed",
+  failed: "failed",
+  canceled: "failed"
+};
+var stateOf = (s) => STATE_OF[(s ?? "").toLowerCase()] ?? "unknown";
+var isInspectorUrl = (u) => /^https:\/\/(?:www\.)?vercel\.com\//i.test(u);
+function resolveBranchPreviews(apps, ctx, sources = {}) {
+  const seen = /* @__PURE__ */ new Map();
+  const at = (app) => seen.get(app) ?? (seen.set(app, {}), seen.get(app));
+  const offer = (app, url, urlSource, state, stateRank) => {
+    if (!app) return;
+    const s = at(app);
+    if (url && !s.url) Object.assign(s, { url, urlSource });
+    if (state !== "unknown" && (s.stateRank === void 0 || stateRank < s.stateRank)) Object.assign(s, { state, stateRank });
+  };
+  const contexts = /* @__PURE__ */ new Set();
+  for (const st of sources.statuses ?? []) {
+    if (contexts.has(st.context)) continue;
+    contexts.add(st.context);
+    const project = projectOfLabel(st.context);
+    if (!project) continue;
+    const url = httpsUrl(st.target_url);
+    offer(appForProject(project, apps), url && !isInspectorUrl(url) ? url : null, "status", stateOf(st.state), 0);
+  }
+  for (const d of sources.deployments ?? []) {
+    const project = projectOfLabel(d.environment);
+    const app = project ? appForProject(project, apps) : null;
+    if (!app) continue;
+    const url = httpsUrl(d.environmentUrl);
+    const s = at(app);
+    if (url && s.urlSource !== "deployment") Object.assign(s, { url, urlSource: "deployment" });
+    const state = stateOf(d.state);
+    if (state !== "unknown" && (s.stateRank === void 0 || 1 < s.stateRank)) Object.assign(s, { state, stateRank: 1 });
+  }
+  for (const p of parseVercelComment(findVercelComment(sources.comments ?? [])?.body) ?? []) offer(appForProject(p.name, apps), p.previewUrl, "vercel-comment", stateOf(p.status), 2);
+  const out = [];
+  for (const app of Object.keys(PREVIEW_APP_LABELS)) {
+    if (!apps[app]) continue;
+    const s = seen.get(app) ?? {};
+    const url = s.url ?? previewUrl(apps[app], ctx);
+    const source = s.url ? s.urlSource : url ? "template" : null;
+    out.push({ app, label: PREVIEW_APP_LABELS[app], url, state: s.state ?? "unknown", source });
+  }
+  return out;
+}
+var previewsSettled = (previews) => previews.every((p) => !!p.url && (p.state === "ready" || p.state === "failed"));
+
+// ../core/src/teams.ts
+var LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+var SLUG = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+function parseOwnerEntry(raw) {
+  if (typeof raw !== "string") return null;
+  const s = raw.trim().replace(/^@/, "");
+  const slash = s.indexOf("/");
+  if (slash < 0) return LOGIN.test(s) ? { kind: "person", login: s } : null;
+  const org = s.slice(0, slash);
+  const slug = s.slice(slash + 1);
+  return LOGIN.test(org) && SLUG.test(slug) ? { kind: "team", org, slug } : null;
+}
+var teamKey = (org, slug) => `@${org.toLowerCase()}/${slug.toLowerCase()}`;
+function ownerEntryProblems(raw) {
+  if (raw === void 0) return [];
+  const isObj2 = (x) => Boolean(x) && typeof x === "object" && !Array.isArray(x);
+  if (!isObj2(raw)) return ['"governance.owners" must be { "design": [people or teams], "tech": [people or teams] }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (k !== "design" && k !== "tech") {
+      out.push(`"governance.owners.${k}" is not an owner group (design, tech)`);
+      continue;
+    }
+    if (!Array.isArray(v)) {
+      out.push(`"governance.owners.${k}" must be a list of people or teams`);
+      continue;
+    }
+    v.forEach((x, i) => {
+      if (typeof x !== "string" || !parseOwnerEntry(x))
+        out.push(`"governance.owners.${k}[${i}]" (${JSON.stringify(x)}) is not a GitHub login or team. Write a person as "peterbono" or "@peterbono", a team as "@org/team-slug".`);
+    });
+  }
+  return out;
+}
+function teamUnreadableMessage(team, reason) {
+  const name = `@${team.org}/${team.slug}`;
+  switch (reason) {
+    case "personal-account":
+      return `${name} cannot be used: ${team.org} is a personal GitHub account, and teams only exist in organizations. List people instead, or move the repository to an organization.`;
+    case "missing-permission":
+      return `The members of ${name} cannot be read: the GitHub token needs read:org (classic token) or Members: Read on the ${team.org} organization (fine-grained token).`;
+    case "no-token":
+      return `The members of ${name} cannot be read without a working GitHub token. Connect GitHub with a token that has read:org.`;
+    case "not-found":
+      return `${name} was not found. Check the team slug on GitHub, or give the token read:org so it can see the team.`;
+    case "unreachable":
+      return `The members of ${name} cannot be read right now: GitHub did not answer. Try again in a moment.`;
+  }
+}
+function teamsIn(owners) {
+  const all = Array.isArray(owners) ? owners : [...owners.design ?? [], ...owners.tech ?? []];
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of all) {
+    const e = parseOwnerEntry(raw);
+    if (e?.kind === "team") out.set(teamKey(e.org, e.slug), { key: teamKey(e.org, e.slug), org: e.org, slug: e.slug });
+  }
+  return [...out.values()];
+}
+var norm = (x) => x.trim().toLowerCase().replace(/^@/, "");
+function expandEntries(entries, teams) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (x) => {
+    const k = norm(x);
+    if (k && !seen.has(k)) {
+      seen.add(k);
+      out.push(x.replace(/^@(?=[^/]+$)/, ""));
+    }
+  };
+  for (const raw of entries) {
+    const e = parseOwnerEntry(raw);
+    if (!e) continue;
+    if (e.kind === "person") add(e.login);
+    else {
+      const state = teams?.[teamKey(e.org, e.slug)];
+      if (state?.status === "ok") state.members.forEach(add);
+      else add(teamKey(e.org, e.slug));
+    }
+  }
+  return out;
+}
+function expandOwners(owners, teams) {
+  return { design: expandEntries(owners.design, teams), tech: expandEntries(owners.tech, teams) };
+}
+var people = (n) => `${n} ${n === 1 ? "person" : "people"}`;
+function entryLabel(raw, teams) {
+  const e = parseOwnerEntry(raw);
+  if (!e) return raw;
+  if (e.kind === "person") return `@${e.login}`;
+  const state = teams?.[teamKey(e.org, e.slug)];
+  const name = `@${e.org}/${e.slug}`;
+  return state?.status === "ok" ? `${name} (${people(state.members.length)})` : name;
+}
+function unreadableTeams(teams) {
+  return Object.values(teams ?? {}).filter((t) => t.status === "unreadable");
+}
+var TeamDirectory = class {
+  constructor(reader, opts = {}) {
+    this.reader = reader;
+    this.ttl = opts.ttlMs ?? 5 * 6e4;
+    this.now = opts.now ?? Date.now;
+  }
+  reader;
+  teams = /* @__PURE__ */ new Map();
+  accounts = /* @__PURE__ */ new Map();
+  memberships = /* @__PURE__ */ new Map();
+  ttl;
+  now;
+  accountType(org) {
+    const k = org.toLowerCase();
+    let p = this.accounts.get(k);
+    if (!p) {
+      p = this.reader.getAccountType(org).catch(() => null);
+      this.accounts.set(k, p);
+    }
+    return p;
+  }
+  /** The reason a read of `org` failed, as a state. A 404 on a personal account says so; a 403 is a missing permission. */
+  async failure(ref, err) {
+    const e = err ?? {};
+    let reason;
+    if (!this.reader.hasToken) reason = await this.accountType(ref.org) === "User" ? "personal-account" : "no-token";
+    else if (e.status === 401) reason = "no-token";
+    else if (e.status === 403 || e.auth === "missing-permission") reason = "missing-permission";
+    else if (e.status === 404) reason = await this.accountType(ref.org) === "User" ? "personal-account" : "not-found";
+    else reason = "unreachable";
+    return { ...ref, status: "unreadable", reason, message: teamUnreadableMessage(ref, reason) };
+  }
+  /** Members of one team, or why they cannot be read. Cached. */
+  team(org, slug) {
+    const ref = { key: teamKey(org, slug), org, slug };
+    const hit = this.teams.get(ref.key);
+    if (hit && this.now() - hit.at < this.ttl) return hit.value;
+    const value = (async () => {
+      if (!this.reader.hasToken) return this.failure(ref, void 0);
+      try {
+        const members = await this.reader.listTeamMembers(org, slug);
+        return { ...ref, status: "ok", members };
+      } catch (err) {
+        return this.failure(ref, err);
+      }
+    })();
+    this.teams.set(ref.key, { at: this.now(), value });
+    void value.then((s) => {
+      if (s.status === "unreadable" && s.reason === "unreachable") this.teams.delete(ref.key);
+    });
+    return value;
+  }
+  /** Every team named in the owner lists, read in parallel. Empty object when no team is named (no request). */
+  async resolve(owners) {
+    const refs = teamsIn(owners);
+    const states = await Promise.all(refs.map((r) => this.team(r.org, r.slug)));
+    return Object.fromEntries(states.map((s) => [s.key, s]));
+  }
+  /**
+   * Whether `login` is an active member of one team: from the cached member list when there is one, else one
+   * membership read (GET /orgs/{org}/teams/{slug}/memberships/{user}). An unreadable team returns its state.
+   */
+  async isMember(org, slug, login) {
+    const ref = { key: teamKey(org, slug), org, slug };
+    const cached = this.teams.get(ref.key);
+    if (cached && this.now() - cached.at < this.ttl) {
+      const s = await cached.value;
+      if (s.status === "ok") return s.members.some((m) => norm(m) === norm(login));
+    }
+    const k = `${ref.key}#${norm(login)}`;
+    const hit = this.memberships.get(k);
+    if (hit && this.now() - hit.at < this.ttl) return hit.value;
+    const value = (async () => {
+      if (!this.reader.hasToken) return this.failure(ref, void 0);
+      try {
+        return await this.reader.getTeamMembership(org, slug, login) === "active";
+      } catch (err) {
+        return this.failure(ref, err);
+      }
+    })();
+    this.memberships.set(k, { at: this.now(), value });
+    return value;
+  }
+  /**
+   * Whether `login` holds a right given to `entries` (people and teams): a person entry matches directly, a team
+   * through its membership. Teams are only read when no person entry matches.
+   */
+  async memberOfAny(entries, login) {
+    const unreadable = [];
+    const parsed = entries.map(parseOwnerEntry).filter((e) => Boolean(e));
+    if (parsed.some((e) => e.kind === "person" && norm(e.login) === norm(login))) return { member: true, unreadable };
+    for (const e of parsed) {
+      if (e.kind !== "team") continue;
+      const r = await this.isMember(e.org, e.slug, login);
+      if (r === true) return { member: true, unreadable };
+      if (typeof r === "object" && r.status === "unreadable") unreadable.push(r);
+    }
+    return { member: false, unreadable };
+  }
+  /** The organization's teams for a picker, or why they cannot be listed (a personal account has none). */
+  async orgTeams(org) {
+    if (await this.accountType(org) === "User") return { status: "unreadable", reason: "personal-account" };
+    if (!this.reader.hasToken) return { status: "unreadable", reason: "no-token" };
+    try {
+      return { status: "ok", teams: await this.reader.listOrgTeams(org) };
+    } catch (err) {
+      const s = await this.failure({ key: teamKey(org, "*"), org, slug: "*" }, err);
+      return { status: "unreadable", reason: s.status === "unreadable" ? s.reason : "unreachable" };
+    }
+  }
+  /** Drops every cached read (after the token changes). */
+  clear() {
+    this.teams.clear();
+    this.accounts.clear();
+    this.memberships.clear();
+  }
+};
+
+// ../core/src/rights.ts
+var OWNER_GROUPS = ["design", "tech"];
+var RIGHTS = ["approveDesign", "approveTech", "ship"];
+var DEFAULT_RIGHTS = { approveDesign: ["design"], approveTech: ["tech"], ship: ["tech"] };
+var uniq = (xs) => [...new Set(xs)];
+function normalizeRights(input) {
+  const pick = (r) => {
+    const v = input?.[r];
+    if (!Array.isArray(v)) return [...DEFAULT_RIGHTS[r]];
+    return OWNER_GROUPS.filter((g) => v.includes(g));
+  };
+  return { approveDesign: pick("approveDesign"), approveTech: pick("approveTech"), ship: pick("ship") };
+}
+function rightsProblems(raw) {
+  if (raw === void 0) return [];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return ['"governance.rights" must be { "approveDesign": [groups], "approveTech": [groups], "ship": [groups] }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (!RIGHTS.includes(k)) out.push(`"governance.rights.${k}" is not a right (${RIGHTS.join(", ")})`);
+    else if (!Array.isArray(v) || v.length === 0 || !v.every((g) => OWNER_GROUPS.includes(g)))
+      out.push(`"governance.rights.${k}" must list one or more of "design", "tech"`);
+  }
+  return out;
+}
+function holdersOf(right, owners, rights) {
+  const groups = (rights ?? DEFAULT_RIGHTS)[right];
+  return uniq(groups.flatMap((g) => owners[g] ?? []));
+}
+function approverEntries(owners, rights) {
+  if (!rights) return { design: [...owners.design], tech: [...owners.tech] };
+  return { design: holdersOf("approveDesign", owners, rights), tech: holdersOf("approveTech", owners, rights) };
+}
+function shipPolicy(owners, rights, teams) {
+  if (!rights) return null;
+  const entries = holdersOf("ship", owners, rights);
+  if (!entries.length) return null;
+  const logins = expandEntries(entries, teams);
+  return { logins, groups: [...rights.ship], entries, ...teams ? { teams } : {} };
+}
+function groupsPhrase(groups) {
+  const g = OWNER_GROUPS.filter((x) => groups.includes(x));
+  if (g.length === 1) return `the ${g[0]} owner`;
+  return `a ${g.join(" or ")} owner`;
+}
+function whoCanShipSentence(policy) {
+  const names = (policy.entries ?? policy.logins).map((l) => entryLabel(l, policy.teams)).join(", ");
+  return `Only ${groupsPhrase(policy.groups)} can ship this${names ? ` (${names})` : ""}.`;
+}
+function visualImpactProblems(raw) {
+  if (raw === void 0) return [];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return ['"visualImpact" must be { "mode": "auto" | "on-demand" }'];
+  const out = [];
+  for (const [k, v] of Object.entries(raw)) {
+    if (k !== "mode") out.push(`"visualImpact.${k}" is not a setting (mode)`);
+    else if (v !== "auto" && v !== "on-demand") out.push('"visualImpact.mode" must be "auto" or "on-demand"');
+  }
+  return out;
+}
+
+// ../core/src/config.ts
+var CONFIG_FILE = "bridge.config.json";
+var DEFAULT_OVERRIDE = { allowed: [], requireReason: true, minReasonLength: 20 };
+var DEFAULT_TOKEN_PATHS = {
+  root: "tokens",
+  primitives: "primitives",
+  brands: "brands",
+  semantic: "semantic",
+  base: "base",
+  density: "density",
+  components: "components",
+  contrastChecks: "contrast.checks.json"
+};
+var DEFAULT_GOVERNANCE = {
+  protectedBranches: ["main", "master"],
+  branchPrefix: "bridge/",
+  labels: ["source: mcp"],
+  guardrails: ["AGENTS.md", "CLAUDE.md", "docs/GOVERNANCE.md", ".stylelintrc.json", ".github/", CONFIG_FILE],
+  owners: { design: [], tech: [] }
+};
+var FLAT_TOKEN_KEYS = ["primitives", "brands", "semantic", "base", "density", "components", "contrastChecks"];
+var CANONICAL_TOKEN_KEYS = ["root", "include", "exclude", "tiers", "layers"];
+var FLAT_MODE_KEYS = ["brands", "themes", "densities", "defaults"];
+var AXIS_OF = { brands: "brand", themes: "theme", densities: "density" };
+var ConfigError = class extends Error {
+  constructor(problems) {
+    super(`${CONFIG_FILE} is invalid: ${problems.join("; ")}`);
+    this.problems = problems;
+    this.name = "ConfigError";
+  }
+  problems;
+};
+var trimSlashes = (p) => p.trim().replace(/^\.?\/+|\/+$/g, "");
+var list = (v) => v === void 0 ? [] : Array.isArray(v) ? v : [v];
+var isFlatModes = (m) => Object.keys(m).some((k) => FLAT_MODE_KEYS.includes(k)) || Object.keys(m).length === 0;
+function parseRepoInput(repo, branch) {
+  if (!repo) return void 0;
+  if (typeof repo === "string") {
+    const [owner, name] = repo.split("/");
+    return { owner, name, defaultBranch: branch ?? "main" };
+  }
+  return { owner: repo.owner, name: repo.name, defaultBranch: repo.defaultBranch ?? branch ?? "main" };
+}
+function conventionalLayers(p) {
+  return [
+    { files: `${p.primitives}/*.tokens.json`, optional: false },
+    { files: `${p.semantic}/${p.base}.tokens.json`, optional: true },
+    { files: `${p.brands}/{brand}.tokens.json`, optional: false },
+    { files: `${p.semantic}/{theme}.tokens.json`, optional: false },
+    { files: `${p.brands}/{brand}.{theme}.tokens.json`, optional: true },
+    { files: `${p.density}/{density}.tokens.json`, optional: false },
+    { files: `${p.components}/*.tokens.json`, optional: false }
+  ];
+}
+function defineConfig(input) {
+  const t = input.tokens ?? {};
+  const root = trimSlashes(t.root ?? DEFAULT_TOKEN_PATHS.root) || ".";
+  const tiersIn = t.tiers ? Object.fromEntries(Object.entries(t.tiers).map(([k, v]) => [k, list(v).map(trimSlashes)])) : void 0;
+  const firstDir = (tier) => tiersIn?.[tier]?.find((d) => !d.endsWith(".json"));
+  const baseFile = tiersIn?.base?.find((d) => d.endsWith(".json"));
+  const contrastPath = input.contrast?.path ? trimSlashes(input.contrast.path) : void 0;
+  const underRoot = (p) => root === "." ? p : p.startsWith(`${root}/`) ? p.slice(root.length + 1) : void 0;
+  const paths = {
+    root,
+    primitives: trimSlashes(t.primitives ?? firstDir("primitive") ?? DEFAULT_TOKEN_PATHS.primitives),
+    brands: trimSlashes(t.brands ?? firstDir("brand") ?? DEFAULT_TOKEN_PATHS.brands),
+    semantic: trimSlashes(t.semantic ?? firstDir("semantic") ?? DEFAULT_TOKEN_PATHS.semantic),
+    base: trimSlashes(t.base ?? (baseFile ? baseFile.split("/").pop().replace(/(\.tokens)?\.json$/, "") : DEFAULT_TOKEN_PATHS.base)),
+    density: trimSlashes(t.density ?? firstDir("density") ?? DEFAULT_TOKEN_PATHS.density),
+    components: trimSlashes(t.components ?? firstDir("component") ?? DEFAULT_TOKEN_PATHS.components),
+    contrastChecks: trimSlashes(t.contrastChecks ?? (contrastPath ? underRoot(contrastPath) ?? contrastPath : DEFAULT_TOKEN_PATHS.contrastChecks))
+  };
+  const tiers = tiersIn ?? {
+    primitive: [paths.primitives],
+    brand: [paths.brands],
+    base: [`${paths.semantic}/${paths.base}.tokens.json`],
+    semantic: [paths.semantic],
+    density: [paths.density],
+    component: [paths.components]
+  };
+  const layers = t.layers?.length ? t.layers.map((l) => typeof l === "string" ? { files: l, optional: false } : { files: l.files, optional: l.optional ?? false }) : conventionalLayers(paths);
+  const axes = {};
+  const m = input.modes ?? {};
+  if (isFlatModes(m)) {
+    for (const key of ["brands", "themes", "densities"]) {
+      const values = m[key] ?? [];
+      if (!values.length) continue;
+      const axis = AXIS_OF[key];
+      const def = m.defaults?.[axis] ?? values[0];
+      axes[axis] = { values, default: def, parity: axis === "theme" };
+    }
+  } else {
+    for (const [name, a] of Object.entries(m)) axes[name] = { values: a.values, default: a.default ?? a.values[0], parity: a.parity ?? false };
+  }
+  const ordered = (axis) => {
+    const a = axes[axis];
+    return a ? [a.default, ...a.values.filter((v) => v !== a.default)] : [];
+  };
+  const modes = {
+    brands: ordered("brand"),
+    themes: ordered("theme"),
+    densities: ordered("density"),
+    defaults: { brand: axes.brand?.default, theme: axes.theme?.default, density: axes.density?.default }
+  };
+  const pkg = input.changesets?.package ?? input.changeset?.package;
+  const g = input.governance ?? {};
+  const contrastFile = contrastPath ?? [root === "." ? "" : root, paths.contrastChecks].filter(Boolean).join("/");
+  return {
+    repo: parseRepoInput(input.repo, input.branch),
+    tokens: { ...paths, include: input.tokens?.include ?? ["**/*.tokens.json"], exclude: input.tokens?.exclude ?? [], tiers, layers },
+    axes,
+    modes,
+    contrast: { path: contrastFile, modes: input.contrast?.modes },
+    components: input.components ? {
+      dir: trimSlashes(input.components.dir),
+      docsSuffix: input.components.docsSuffix ?? ".docs.json",
+      styleSuffix: input.components.styleSuffix ?? ".module.css",
+      reference: input.components.reference,
+      index: input.components.index,
+      specs: input.components.specs
+    } : void 0,
+    docs: { ...input.docs },
+    changesets: pkg ? { dir: trimSlashes(input.changesets?.dir ?? ".changeset"), package: pkg } : void 0,
+    changeset: pkg ? { package: pkg } : void 0,
+    cssVar: { prefix: input.cssVar?.prefix ?? "--", separator: input.cssVar?.separator ?? "-" },
+    governance: {
+      protectedBranches: g.protectedBranches ?? DEFAULT_GOVERNANCE.protectedBranches,
+      branchPrefix: g.branchPrefix ?? DEFAULT_GOVERNANCE.branchPrefix,
+      labels: g.labels ?? DEFAULT_GOVERNANCE.labels,
+      guardrails: g.guardrails ?? [...DEFAULT_GOVERNANCE.guardrails, contrastFile],
+      owners: { design: g.owners?.design ?? [], tech: g.owners?.tech ?? [] },
+      ...g.override ? {
+        override: {
+          allowed: g.override.allowed ?? DEFAULT_OVERRIDE.allowed,
+          requireReason: g.override.requireReason ?? DEFAULT_OVERRIDE.requireReason,
+          minReasonLength: g.override.minReasonLength ?? DEFAULT_OVERRIDE.minReasonLength
+        }
+      } : {},
+      ...g.rights ? { rights: normalizeRights(g.rights) } : {}
+    },
+    ...input.audit ? { audit: { ...input.audit } } : {},
+    ...input.visualImpact ? { visualImpact: { mode: input.visualImpact.mode === "on-demand" ? "on-demand" : "auto" } } : {},
+    ...input.integrations ? { integrations: { ...input.integrations } } : {},
+    ...input.previews ? {
+      previews: {
+        packages: input.previews.packages ?? [],
+        apps: { ...input.previews.apps },
+        ...input.previews.production ? { production: { ...input.previews.production } } : {}
+      }
+    } : {}
+  };
+}
+var isStr = (x) => typeof x === "string" && x.trim().length > 0;
+var isStrList = (x) => Array.isArray(x) && x.every(isStr);
+var isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+function loadConfig(source) {
+  let data = source;
+  if (typeof source === "string") {
+    try {
+      data = JSON.parse(source);
+    } catch (err) {
+      throw new ConfigError([`not valid JSON (${err.message})`]);
+    }
+  }
+  if (!isObj(data)) throw new ConfigError(["top level must be an object"]);
+  const problems = [];
+  const d = data;
+  const repo = d.repo;
+  if (typeof repo === "string") {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) problems.push('"repo" must be "owner/name" or { "owner", "name" }');
+  } else if (repo !== void 0) {
+    if (!isObj(repo)) problems.push('"repo" must be "owner/name" or { "owner", "name" }');
+    else {
+      if (!isStr(repo.owner)) problems.push('"repo.owner" must be a non-empty string');
+      if (!isStr(repo.name)) problems.push('"repo.name" must be a non-empty string');
+      if (repo.defaultBranch !== void 0 && !isStr(repo.defaultBranch)) problems.push('"repo.defaultBranch" must be a non-empty string');
+    }
+  }
+  if (d.branch !== void 0 && !isStr(d.branch)) problems.push('"branch" must be a non-empty string');
+  const tokens = d.tokens;
+  if (tokens !== void 0) {
+    if (!isObj(tokens)) problems.push('"tokens" must be an object');
+    else
+      for (const [k, v] of Object.entries(tokens)) {
+        if (FLAT_TOKEN_KEYS.includes(k) || k === "root") {
+          if (!isStr(v)) problems.push(`"tokens.${k}" must be a non-empty string`);
+        } else if (k === "include" || k === "exclude") {
+          if (!isStrList(v)) problems.push(`"tokens.${k}" must be a list of globs`);
+        } else if (k === "tiers") {
+          if (!isObj(v) || !Object.values(v).every((x) => isStr(x) || isStrList(x))) problems.push('"tokens.tiers" must map tier names to directories');
+        } else if (k === "layers") {
+          if (!Array.isArray(v) || !v.length || !v.every((l) => isStr(l) || isObj(l) && isStr(l.files) && (l.optional === void 0 || typeof l.optional === "boolean")))
+            problems.push('"tokens.layers" must be a non-empty list of { "files", "optional"? }');
+        } else if (!CANONICAL_TOKEN_KEYS.includes(k)) problems.push(`"tokens.${k}" is not a known key`);
+      }
+  }
+  const modes = d.modes;
+  let axisNames = [];
+  if (modes !== void 0) {
+    if (!isObj(modes)) problems.push('"modes" must be an object');
+    else if (isFlatModes(modes)) {
+      for (const k of ["brands", "themes", "densities"]) {
+        if (modes[k] !== void 0 && !isStrList(modes[k])) problems.push(`"modes.${k}" must be a list of names`);
+      }
+      const defs = modes.defaults;
+      const lists = { brand: "brands", theme: "themes", density: "densities" };
+      for (const [k, l] of Object.entries(lists)) {
+        const v = defs?.[k];
+        if (v === void 0) continue;
+        if (!isStr(v)) problems.push(`"modes.defaults.${k}" must be a string`);
+        else if (isStrList(modes[l]) && !modes[l].includes(v)) problems.push(`"modes.defaults.${k}" ("${v}") is not in "modes.${l}"`);
+      }
+      axisNames = Object.entries(lists).filter(([, l]) => isStrList(modes[l]) && modes[l].length).map(([k]) => k);
+    } else {
+      for (const [name, a] of Object.entries(modes)) {
+        if (!isObj(a) || !isStrList(a.values) || !a.values.length) {
+          problems.push(`"modes.${name}.values" must be a non-empty list of names`);
+          continue;
+        }
+        if (a.default !== void 0 && (!isStr(a.default) || !a.values.includes(a.default))) problems.push(`"modes.${name}.default" ("${String(a.default)}") is not in "modes.${name}.values"`);
+        if (a.parity !== void 0 && typeof a.parity !== "boolean") problems.push(`"modes.${name}.parity" must be true or false`);
+        axisNames.push(name);
+      }
+    }
+  }
+  if (isObj(tokens) && Array.isArray(tokens.layers)) {
+    for (const l of tokens.layers) {
+      const files = typeof l === "string" ? l : isObj(l) ? String(l.files) : "";
+      for (const ph of files.match(/\{([^}]+)\}/g) ?? []) {
+        if (!axisNames.includes(ph.slice(1, -1))) problems.push(`layer "${files}" uses ${ph} but "modes.${ph.slice(1, -1)}" is not defined`);
+      }
+    }
+  }
+  const contrast = d.contrast;
+  if (contrast !== void 0 && (!isObj(contrast) || !isStr(contrast.path) || contrast.modes !== void 0 && !isStrList(contrast.modes)))
+    problems.push('"contrast" must be { "path", "modes"? }');
+  const comps = d.components;
+  if (comps !== void 0 && (!isObj(comps) || !isStr(comps.dir))) problems.push('"components.dir" must be a non-empty string');
+  const cs = d.changeset;
+  if (cs !== void 0 && (!isObj(cs) || !isStr(cs.package))) problems.push('"changeset.package" must be a non-empty string');
+  const css = d.changesets;
+  if (css !== void 0 && (!isObj(css) || !isStr(css.package))) problems.push('"changesets.package" must be a non-empty string');
+  const gov = d.governance;
+  if (gov !== void 0) {
+    if (!isObj(gov)) problems.push('"governance" must be an object');
+    else {
+      for (const k of ["protectedBranches", "labels", "guardrails"]) if (gov[k] !== void 0 && !(Array.isArray(gov[k]) && gov[k].every((x) => typeof x === "string"))) problems.push(`"governance.${k}" must be a list of strings`);
+      if (gov.branchPrefix !== void 0 && !isStr(gov.branchPrefix)) problems.push('"governance.branchPrefix" must be a non-empty string');
+      problems.push(...ownerEntryProblems(gov.owners));
+      const ov = gov.override;
+      if (ov !== void 0) {
+        if (!isObj(ov)) problems.push('"governance.override" must be an object');
+        else {
+          if (ov.allowed !== void 0 && !isStrList(ov.allowed)) problems.push('"governance.override.allowed" must be a list of GitHub logins');
+          if (ov.requireReason !== void 0 && typeof ov.requireReason !== "boolean") problems.push('"governance.override.requireReason" must be true or false');
+          if (ov.minReasonLength !== void 0 && !(Number.isInteger(ov.minReasonLength) && ov.minReasonLength >= 0)) problems.push('"governance.override.minReasonLength" must be a whole number, 0 or more');
+        }
+      }
+      problems.push(...rightsProblems(gov.rights));
+    }
+  }
+  problems.push(...visualImpactProblems(d.visualImpact));
+  const audit = d.audit;
+  if (audit !== void 0) {
+    if (!isObj(audit)) problems.push('"audit" must be an object');
+    else for (const k of ["packages", "foreignLibraries", "nativeElements", "exclude"]) if (audit[k] !== void 0 && !isStrList(audit[k])) problems.push(`"audit.${k}" must be a list of strings`);
+  }
+  const pv = d.previews;
+  if (pv !== void 0) {
+    if (!isObj(pv)) problems.push('"previews" must be an object');
+    else {
+      if (pv.packages !== void 0 && !isStrList(pv.packages)) problems.push('"previews.packages" must be a list of package names');
+      for (const field of ["apps", "production"]) {
+        const apps = pv[field];
+        if (apps === void 0) continue;
+        if (!isObj(apps)) {
+          problems.push(`"previews.${field}" must be an object`);
+          continue;
+        }
+        for (const [k, v] of Object.entries(apps)) {
+          if (!(k in PREVIEW_APP_LABELS)) problems.push(`"previews.${field}.${k}" is not a known app (${Object.keys(PREVIEW_APP_LABELS).join(", ")})`);
+          else if (!isStr(v) || !/^https?:\/\//.test(v)) problems.push(`"previews.${field}.${k}" must be an http(s) URL${field === "apps" ? " template" : ""}`);
+          else if (field === "production" && /\{\w+\}/.test(v)) problems.push(`"previews.production.${k}" is a fixed URL: placeholders such as {branch} belong in "previews.apps"`);
+        }
+      }
+    }
+  }
+  if (problems.length) throw new ConfigError(problems);
+  return defineConfig(d);
+}
+var tokensPath = (config, rel = "") => [config.tokens.root === "." ? "" : config.tokens.root, rel].filter(Boolean).join("/");
+var protectedBranchesOf = (config) => [.../* @__PURE__ */ new Set([...config.governance.protectedBranches, ...config.repo ? [config.repo.defaultBranch] : []])];
+var baseBranchOf = (config) => config.repo?.defaultBranch ?? "main";
+function toConfigJson(config, schema = "./packages/core/bridge.config.schema.json") {
+  return {
+    $schema: schema,
+    version: 1,
+    ...config.repo ? { repo: config.repo } : {},
+    tokens: { root: config.tokens.root, include: config.tokens.include, ...config.tokens.exclude.length ? { exclude: config.tokens.exclude } : {}, tiers: config.tokens.tiers, layers: config.tokens.layers.map((l) => l.optional ? l : { files: l.files }) },
+    modes: Object.fromEntries(Object.entries(config.axes).map(([k, a]) => [k, a.parity ? a : { values: a.values, default: a.default }])),
+    ...config.contrast ? { contrast: config.contrast.modes ? config.contrast : { path: config.contrast.path } } : {},
+    ...config.components ? { components: Object.fromEntries(Object.entries(config.components).filter(([, v]) => v !== void 0)) } : {},
+    docs: Object.fromEntries(Object.entries(config.docs).filter(([, v]) => v !== void 0)),
+    ...config.changesets ? { changesets: config.changesets } : {},
+    cssVar: config.cssVar,
+    governance: config.governance,
+    ...config.audit ? { audit: config.audit } : {},
+    ...config.previews ? { previews: config.previews } : {},
+    ...config.visualImpact ? { visualImpact: config.visualImpact } : {}
+  };
+}
+
+// ../core/src/values.ts
+var ALIAS_RE = /^\{([^{}]+)\}$/;
+var isAlias = (v) => typeof v === "string" && ALIAS_RE.test(v);
+var aliasTarget = (v) => ALIAS_RE.exec(v)?.[1] ?? v;
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var round = (n, digits) => {
+  const f = 10 ** digits;
+  return Math.round(n * f) / f;
+};
+function hexToRgba(hex) {
+  const m = /^#?([0-9a-f]{3,8})$/i.exec(hex.trim());
+  if (!m) return void 0;
+  let h = m[1];
+  if (h.length === 3 || h.length === 4) h = [...h].map((c) => c + c).join("");
+  if (h.length !== 6 && h.length !== 8) return void 0;
+  const n = (idx) => parseInt(h.slice(idx, idx + 2), 16) / 255;
+  return { r: n(0), g: n(2), b: n(4), a: h.length === 8 ? n(6) : 1 };
+}
+var to255 = (n) => Math.round(clamp01(n) * 255);
+var rgbaToHex = (c) => "#" + [c.r, c.g, c.b].map((x) => to255(x).toString(16).padStart(2, "0")).join("");
+function parseColor(value) {
+  if (typeof value === "string") return isAlias(value) ? void 0 : hexToRgba(value);
+  if (!value || typeof value !== "object") return void 0;
+  const v = value;
+  const alpha = typeof v.alpha === "number" ? v.alpha : 1;
+  if (v.colorSpace === "srgb" && Array.isArray(v.components) && v.components.length === 3) {
+    const [r, g, b] = v.components;
+    if ([r, g, b].every((x) => typeof x === "number")) return { r, g, b, a: alpha };
+  }
+  if (typeof v.hex === "string") {
+    const c = hexToRgba(v.hex);
+    if (c) return { ...c, a: alpha };
+  }
+  return void 0;
+}
+function rgbaToDtcg(c) {
+  const out = {
+    colorSpace: "srgb",
+    components: [round(clamp01(c.r), 3), round(clamp01(c.g), 3), round(clamp01(c.b), 3)]
+  };
+  if (c.a < 0.9995) out.alpha = round(clamp01(c.a), 3);
+  out.hex = rgbaToHex(c);
+  return out;
+}
+function colorsEqual(a, b) {
+  return rgbaToHex(a) === rgbaToHex(b) && Math.abs(a.a - b.a) < 2e-3;
+}
+function parseDimension(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const v = value;
+    if (typeof v.value === "number" && typeof v.unit === "string") return { value: v.value, unit: v.unit };
+  }
+  if (typeof value === "string") {
+    const m = /^(-?\d+(?:\.\d+)?)(px|rem)$/.exec(value.trim());
+    if (m) return { value: Number(m[1]), unit: m[2] };
+  }
+  if (typeof value === "number") return { value, unit: "px" };
+  return void 0;
+}
+var numbersEqual = (a, b) => Math.abs(a - b) < 1e-4;
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a === "number" && typeof b === "number") return numbersEqual(a, b);
+  if (typeof a !== typeof b || !a || !b || typeof a !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((v, idx) => deepEqual(v, b[idx]));
+  const ka = Object.keys(a).filter((k) => a[k] !== void 0);
+  const kb = Object.keys(b).filter((k) => b[k] !== void 0);
+  if (ka.length !== kb.length) return false;
+  return ka.every((k) => deepEqual(a[k], b[k]));
+}
+function valuesEqual(type, a, b) {
+  if (a === void 0 || b === void 0) return a === b;
+  if (isAlias(a) || isAlias(b)) return isAlias(a) && isAlias(b) && aliasTarget(a) === aliasTarget(b);
+  if (type === "color") {
+    const ca = parseColor(a);
+    const cb = parseColor(b);
+    if (ca && cb) return colorsEqual(ca, cb);
+  }
+  if (type === "dimension") {
+    const da = parseDimension(a);
+    const db = parseDimension(b);
+    if (da && db) return da.unit === db.unit && numbersEqual(da.value, db.value);
+  }
+  return deepEqual(a, b);
+}
+
+// ../core/src/wcag.ts
+var AA_MIN = { text: 4.5, "large-text": 3, ui: 3 };
+var channel = (c) => c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+function luminance(c) {
+  const q = (x) => Math.round(Math.min(1, Math.max(0, x)) * 255) / 255;
+  return 0.2126 * channel(q(c.r)) + 0.7152 * channel(q(c.g)) + 0.0722 * channel(q(c.b));
+}
+function composite(fg, bg) {
+  const a = fg.a;
+  return { r: fg.r * a + bg.r * (1 - a), g: fg.g * a + bg.g * (1 - a), b: fg.b * a + bg.b * (1 - a), a: 1 };
+}
+function contrastRatio(fg, bg) {
+  const f = typeof fg === "string" ? hexToRgba(fg) : fg;
+  const b = typeof bg === "string" ? hexToRgba(bg) : bg;
+  if (!f || !b) throw new Error("Invalid color");
+  const opaqueBg = { ...b, a: 1 };
+  const l1 = luminance(composite(f, opaqueBg));
+  const l2 = luminance(opaqueBg);
+  const [hi, lo] = l1 > l2 ? [l1, l2] : [l2, l1];
+  return (hi + 0.05) / (lo + 0.05);
+}
+function renderedColor(value) {
+  const c = parseColor(value);
+  const hex = value && typeof value === "object" ? value.hex : void 0;
+  const fromHex = typeof hex === "string" ? hexToRgba(hex) : void 0;
+  return c && fromHex ? { ...fromHex, a: c.a } : c;
+}
+var kindForMin = (min) => min >= AA_MIN.text ? "text" : "ui";
+var contrastPair = (foreground, background, min = AA_MIN.text) => ({ foreground, background, min, kind: kindForMin(min) });
+function parseContrastChecks(text) {
+  if (!text) return [];
+  const data = JSON.parse(text);
+  const list2 = Array.isArray(data) ? data : Array.isArray(data.pairs) ? data.pairs : [];
+  const out = [];
+  for (const p of list2) {
+    let fg, bg, min;
+    if (Array.isArray(p)) [fg, bg, min] = p;
+    else if (p && typeof p === "object") {
+      const o = p;
+      fg = o.fg ?? o.foreground;
+      bg = o.bg ?? o.background;
+      min = o.min ?? o.ratio ?? AA_MIN.text;
+    }
+    if (typeof fg !== "string" || typeof bg !== "string" || typeof min !== "number" || !(min > 0)) continue;
+    out.push(contrastPair(fg, bg, min));
+  }
+  return out;
+}
+
+// ../core/src/layered.ts
+var DTCG_TYPES = /* @__PURE__ */ new Set(["color", "dimension", "fontFamily", "fontWeight", "duration", "cubicBezier", "number", "strokeStyle", "border", "transition", "shadow", "gradient", "typography", "fontStyle", "string", "boolean"]);
+var aliasOf = (v) => isAlias(v) ? aliasTarget(v) : null;
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*" && glob[i + 1] === "*") {
+      if (glob[i + 2] === "/") {
+        re += "(?:.*/)?";
+        i += 2;
+      } else {
+        re += ".*";
+        i += 1;
+      }
+    } else if (c === "*") re += "[^/]*";
+    else if (c === "?") re += "[^/]";
+    else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+var comboKey = (c) => Object.entries(c).map(([k, v]) => `${k}=${v}`).join(",") || "default";
+function flattenLayerFile(json, file, issues) {
+  const out = [];
+  const walk = (node, path, inheritedType) => {
+    if (!node || typeof node !== "object" || Array.isArray(node)) return;
+    const n = node;
+    const type = typeof n.$type === "string" ? n.$type : inheritedType;
+    if ("$value" in n) {
+      out.push({
+        path: path.join("."),
+        ...type ? { type } : {},
+        value: n.$value,
+        ...typeof n.$description === "string" ? { description: n.$description } : {},
+        ...n.$extensions && typeof n.$extensions === "object" ? { extensions: n.$extensions } : {},
+        ...n.$deprecated !== void 0 ? { deprecated: n.$deprecated } : {},
+        file
+      });
+      return;
+    }
+    for (const [k, v] of Object.entries(n)) {
+      if (k.startsWith("$")) continue;
+      const p = [...path, k].join(".");
+      if (/[{}.]/.test(k)) issues.push({ level: "error", code: "invalid-name", message: `Name "${k}" contains {, } or . which DTCG forbids.`, path: p, file });
+      if (v && typeof v === "object" && !Array.isArray(v)) walk(v, [...path, k], type);
+      else issues.push({ level: "error", code: "not-a-token", message: `"${p}" is neither a token (no $value) nor a group.`, path: p, file });
+    }
+  };
+  walk(json, []);
+  return out;
+}
+var toHex2 = (n) => Math.round(Math.max(0, Math.min(1, n)) * 255).toString(16).padStart(2, "0");
+function compactJson(v) {
+  if (Array.isArray(v)) return `[${v.map(compactJson).join(", ")}]`;
+  if (v && typeof v === "object") {
+    const e = Object.entries(v);
+    return e.length ? `{ ${e.map(([k, x]) => `${JSON.stringify(k)}: ${compactJson(x)}`).join(", ")} }` : "{}";
+  }
+  return JSON.stringify(v);
+}
+function colorToCss(c) {
+  if (typeof c === "string") return c;
+  if (!c || typeof c !== "object") return String(c);
+  const o = c;
+  const [r, g, b] = (o.components ?? []).map((x) => typeof x === "number" ? x : 0);
+  const alpha = o.alpha ?? 1;
+  if (alpha < 1) return `rgb(${[r, g, b].map((x) => Math.round((x ?? 0) * 255)).join(" ")} / ${alpha})`;
+  return o.hex ?? `#${[r, g, b].map((x) => toHex2(x ?? 0)).join("")}`;
+}
+var dimToCss = (d) => d && typeof d === "object" && "value" in d ? `${d.value}${d.unit}` : String(d);
+function valueToCss(type, v, ext) {
+  if (v === void 0 || v === null) return "";
+  switch (type) {
+    case "color":
+      return colorToCss(v);
+    case "dimension":
+    case "duration":
+      return dimToCss(v);
+    case "cubicBezier":
+      return Array.isArray(v) ? `cubic-bezier(${v.join(", ")})` : String(v);
+    case "fontFamily":
+      return Array.isArray(v) ? v.map((n) => /\s/.test(String(n)) ? `"${n}"` : String(n)).join(", ") : String(v);
+    case "shadow": {
+      if (typeof v === "string") return v;
+      const layers = Array.isArray(v) ? v : [v];
+      return layers.map((l) => [l.inset ? "inset" : "", dimToCss(l.offsetX), dimToCss(l.offsetY), dimToCss(l.blur), dimToCss(l.spread ?? { value: 0, unit: "px" }), colorToCss(l.color)].filter(Boolean).join(" ")).join(", ");
+    }
+    default: {
+      const unit = ext?.["dev.bridge.unit"];
+      if (typeof v === "number" && typeof unit === "string") return `${v}${unit}`;
+      return typeof v === "object" ? compactJson(v) : String(v);
+    }
+  }
+}
+var LayeredTokenSet = class {
+  /** `files`: token file path relative to tokens.root -> file text. */
+  constructor(config, files) {
+    this.config = config;
+    this.files = files;
+    this.fileNames = [...files.keys()].sort();
+    for (const f of this.fileNames) {
+      let json;
+      try {
+        json = JSON.parse(files.get(f));
+      } catch (e) {
+        this.issues.push({ level: "error", code: "invalid-json", message: `Invalid JSON: ${e.message}`, file: f });
+        continue;
+      }
+      this.defs.push(...flattenLayerFile(json, f, this.issues));
+    }
+  }
+  config;
+  files;
+  defs = [];
+  issues = [];
+  fileNames;
+  views = /* @__PURE__ */ new Map();
+  get modeNames() {
+    return Object.keys(this.config.axes);
+  }
+  get defaultCombo() {
+    return Object.fromEntries(Object.entries(this.config.axes).map(([k, m]) => [k, m.default]));
+  }
+  /** Every combination of the given modes (all modes when omitted); other modes stay at default. */
+  combos(only) {
+    let out = [this.defaultCombo];
+    for (const [name, m] of Object.entries(this.config.axes)) {
+      if (only && !only.includes(name)) continue;
+      out = out.flatMap((c) => m.values.map((v) => ({ ...c, [name]: v })));
+    }
+    return out;
+  }
+  normalizeCombo(partial = {}) {
+    const c = { ...this.defaultCombo };
+    for (const [k, v] of Object.entries(partial)) {
+      if (v === void 0) continue;
+      const m = this.config.axes[k];
+      if (!m) throw new Error(`Unknown mode "${k}". Modes: ${this.modeNames.join(", ") || "none"}.`);
+      if (!m.values.includes(v)) throw new Error(`Unknown ${k} "${v}". Values: ${m.values.join(", ")}.`);
+      c[k] = v;
+    }
+    return c;
+  }
+  tierOfFile(file) {
+    for (const [tier, dirs] of Object.entries(this.config.tokens.tiers)) {
+      if (dirs.some((d) => file === d || file.startsWith(`${d.replace(/\/$/, "")}/`) || globToRegExp(d).test(file))) return tier;
+    }
+    return void 0;
+  }
+  /** Tier of a token: the lowest layer that defines it in the default mode (an override does not change its tier). */
+  tierOf(path) {
+    const d = this.view(this.defaultCombo).get(path)?.[0] ?? this.defs.find((x) => x.path === path);
+    return d ? this.tierOfFile(d.file) : void 0;
+  }
+  /** Files of each layer for a combo, in resolution order. */
+  layerFiles(combo) {
+    const files = [];
+    const missing = [];
+    for (const l of this.config.tokens.layers) {
+      const pattern = l.files.replace(/\{([^}]+)\}/g, (_, k) => combo[k] ?? `{${k}}`);
+      const re = globToRegExp(pattern);
+      const hit = this.fileNames.filter((f) => re.test(f));
+      if (!hit.length && !l.optional) missing.push(pattern);
+      for (const f of hit) if (!files.includes(f)) files.push(f);
+    }
+    return { files, missing };
+  }
+  /** path -> definitions in layer order (last one wins) for a combo. */
+  view(combo) {
+    const key = comboKey(combo);
+    let v = this.views.get(key);
+    if (!v) {
+      const { files, missing } = this.layerFiles(combo);
+      const map = /* @__PURE__ */ new Map();
+      const byFile = /* @__PURE__ */ new Map();
+      for (const d of this.defs) (byFile.get(d.file) ?? byFile.set(d.file, []).get(d.file)).push(d);
+      for (const f of files) for (const d of byFile.get(f) ?? []) (map.get(d.path) ?? map.set(d.path, []).get(d.path)).push(d);
+      v = { map, missing };
+      this.views.set(key, v);
+    }
+    return v.map;
+  }
+  missingLayers(combo) {
+    this.view(combo);
+    return this.views.get(comboKey(combo)).missing;
+  }
+  /** Every token path defined in any combo. */
+  allPaths() {
+    return [...new Set(this.defs.map((d) => d.path))].sort();
+  }
+  defsOf(path) {
+    return this.defs.filter((d) => d.path === path);
+  }
+  /** First combo whose layers include `file`, preferring the default. */
+  comboForFile(file) {
+    const all = [this.defaultCombo, ...this.combos()];
+    return all.find((c) => this.layerFiles(c).files.includes(file)) ?? this.defaultCombo;
+  }
+  resolve(path, combo) {
+    const view = this.view(combo);
+    const chain = [path];
+    const top = view.get(path);
+    if (!top) return { path, value: void 0, css: "", chain, definedIn: [], error: `"${path}" is not defined for ${comboKey(combo)}` };
+    const def = top[top.length - 1];
+    let type = def.type;
+    let error;
+    const deref = (target, stack) => {
+      if (stack.includes(target)) {
+        error = `circular alias: ${[...stack, target].join(" -> ")}`;
+        return void 0;
+      }
+      const t = view.get(target);
+      if (!t) {
+        error = `broken alias {${target}}`;
+        return void 0;
+      }
+      const td = t[t.length - 1];
+      type ??= td.type;
+      return walk(td.value, [...stack, target]);
+    };
+    const walk = (v, stack) => {
+      const a = aliasOf(v);
+      if (a) return deref(a, stack);
+      if (Array.isArray(v)) return v.map((x) => walk(x, stack));
+      if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x, stack)]));
+      return v;
+    };
+    let cur = def.value;
+    const seen = /* @__PURE__ */ new Set([path]);
+    for (let a = aliasOf(cur); a; a = aliasOf(cur)) {
+      chain.push(a);
+      if (seen.has(a)) break;
+      seen.add(a);
+      const t = view.get(a);
+      if (!t) break;
+      cur = t[t.length - 1].value;
+    }
+    const value = walk(def.value, [path]);
+    return { path, ...type ? { type } : {}, value, css: error ? "" : valueToCss(type, value, def.extensions), chain, definedIn: top.map((d) => d.file), ...error ? { error } : {} };
+  }
+  /** Tokens whose own value aliases `path` directly, across all files. */
+  referencedBy(path) {
+    const needle = `{${path}}`;
+    return this.defs.filter((d) => JSON.stringify(d.value).includes(needle)).map((d) => ({ path: d.path, file: d.file }));
+  }
+  cssVarName(path) {
+    return `${this.config.cssVar.prefix}${path.split(".").join(this.config.cssVar.separator)}`;
+  }
+  /** Repo-relative path of a token file. */
+  repoPath(file) {
+    const root = this.config.tokens.root;
+    return root === "." || !root ? file : `${root.replace(/\/$/, "")}/${file}`;
+  }
+};
+function selectTokenFiles(config, repoFiles) {
+  const root = config.tokens.root.replace(/\/$/, "");
+  const rel = (f) => root === "." || !root ? f : f.startsWith(`${root}/`) ? f.slice(root.length + 1) : null;
+  const inc = config.tokens.include.map(globToRegExp);
+  const exc = config.tokens.exclude.map(globToRegExp);
+  return repoFiles.filter((f) => f !== config.contrast?.path).map(rel).filter((f) => f !== null && inc.some((r) => r.test(f)) && !exc.some((r) => r.test(f)));
+}
+function checkShape(type, v) {
+  if (aliasOf(v)) return null;
+  const isObj2 = (x) => Boolean(x) && typeof x === "object" && !Array.isArray(x);
+  switch (type) {
+    case "color":
+      if (typeof v === "string") return /^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(v) ? "warn:color as a hex string: DTCG 2025.10 uses { colorSpace, components, hex }" : "color must be { colorSpace, components } (or a hex string)";
+      if (!isObj2(v) || typeof v.colorSpace !== "string" || !Array.isArray(v.components)) return "color must be { colorSpace, components, alpha?, hex? }";
+      if (v.components.length !== 3 || !v.components.every((c) => typeof c === "number" || c === "none" || aliasOf(c))) return "color components must be 3 numbers";
+      if (v.alpha !== void 0 && (typeof v.alpha !== "number" || v.alpha < 0 || v.alpha > 1)) return "color alpha must be between 0 and 1";
+      if (v.hex !== void 0 && !/^#[0-9a-f]{6}$/i.test(String(v.hex))) return "color hex must be #rrggbb";
+      return null;
+    case "dimension":
+      if (typeof v === "string" || typeof v === "number") return "warn:dimension as a plain value: DTCG 2025.10 uses { value, unit }";
+      return isObj2(v) && typeof v.value === "number" && ["px", "rem"].includes(String(v.unit)) ? null : 'dimension must be { value: number, unit: "px" | "rem" }';
+    case "duration":
+      if (typeof v === "string") return "warn:duration as a string: DTCG 2025.10 uses { value, unit }";
+      return isObj2(v) && typeof v.value === "number" && ["ms", "s"].includes(String(v.unit)) ? null : 'duration must be { value: number, unit: "ms" | "s" }';
+    case "cubicBezier":
+      return Array.isArray(v) && v.length === 4 && v.every((x) => typeof x === "number") && v[0] >= 0 && v[0] <= 1 && v[2] >= 0 && v[2] <= 1 ? null : "cubicBezier must be [x1, y1, x2, y2] with x in 0..1";
+    case "fontFamily":
+      return typeof v === "string" || Array.isArray(v) && v.every((x) => typeof x === "string") ? null : "fontFamily must be a string or an array of strings";
+    case "fontWeight":
+      return typeof v === "number" && v >= 1 && v <= 1e3 || typeof v === "string" ? null : "fontWeight must be 1..1000 or a keyword";
+    case "number":
+      return typeof v === "number" ? null : "number must be a number";
+    case "shadow": {
+      const layers = Array.isArray(v) ? v : [v];
+      return layers.every((l) => isObj2(l) && "color" in l && "offsetX" in l && "offsetY" in l && "blur" in l) ? null : "shadow must be { color, offsetX, offsetY, blur, spread? } or an array of them";
+    }
+    default:
+      return null;
+  }
+}
+function validateLayered(set) {
+  const issues = [...set.issues];
+  for (const d of set.defs) {
+    if (d.type && !DTCG_TYPES.has(d.type)) issues.push({ level: "error", code: "unknown-type", message: `Unknown $type "${d.type}".`, path: d.path, file: d.file });
+    if (d.type) {
+      const s = checkShape(d.type, d.value);
+      if (s) issues.push({ level: s.startsWith("warn:") ? "warning" : "error", code: "invalid-value", message: s.replace(/^warn:/, ""), path: d.path, file: d.file });
+    }
+  }
+  const merged = /* @__PURE__ */ new Map();
+  const add = (i, combo) => {
+    const k = `${i.code}|${i.path}|${i.message}`;
+    const prev = merged.get(k);
+    if (prev) prev.modes.push(comboKey(combo));
+    else merged.set(k, { ...i, modes: [comboKey(combo)] });
+  };
+  for (const combo of set.combos()) {
+    for (const miss of set.missingLayers(combo)) add({ level: "error", code: "missing-layer", message: `No file matches layer "${miss}".` }, combo);
+    for (const [path, defs] of set.view(combo)) {
+      const r = set.resolve(path, combo);
+      const def = defs[defs.length - 1];
+      if (r.error) add({ level: "error", code: r.error.startsWith("circular") ? "circular-alias" : "broken-alias", message: r.error, path, file: def.file }, combo);
+      else if (!r.type) add({ level: "error", code: "missing-type", message: "No $type on the token, its groups or its alias target.", path, file: def.file }, combo);
+      else if (def.type && aliasOf(def.value)) {
+        const target = set.view(combo).get(aliasOf(def.value));
+        const tt = target?.[target.length - 1]?.type;
+        if (tt && tt !== def.type) add({ level: "error", code: "type-mismatch", message: `$type ${def.type} aliases a ${tt} token (${String(def.value)}).`, path, file: def.file }, combo);
+      }
+    }
+  }
+  const total = set.combos().length;
+  for (const i of merged.values()) {
+    if (i.modes.length === total) delete i.modes;
+    issues.push(i);
+  }
+  issues.push(...layeredParityIssues(set));
+  return issues;
+}
+function layeredParityIssues(set) {
+  const out = [];
+  const pathsOf = (file) => new Set(set.defs.filter((d) => d.file === file).map((d) => d.path));
+  for (const [mode, m] of Object.entries(set.config.axes)) {
+    if (!m.parity) continue;
+    for (const layer of set.config.tokens.layers) {
+      if (!layer.files.includes(`{${mode}}`) || layer.optional) continue;
+      const others = (layer.files.match(/\{([^}]+)\}/g) ?? []).map((p) => p.slice(1, -1)).filter((k) => k !== mode);
+      let fixed = [{}];
+      for (const o of others) fixed = fixed.flatMap((c) => (set.config.axes[o]?.values ?? []).map((v) => ({ ...c, [o]: v })));
+      for (const c of fixed) {
+        const filesByValue = m.values.map((v) => {
+          const re = globToRegExp(layer.files.replace(/\{([^}]+)\}/g, (_, k) => k === mode ? v : c[k]));
+          return { v, files: set.fileNames.filter((f) => re.test(f)) };
+        });
+        const present = filesByValue.filter((x) => x.files.length);
+        if (!present.length) continue;
+        for (const x of filesByValue) {
+          if (!x.files.length) out.push({ level: "error", code: "mode-parity", message: `${mode} "${x.v}" has no file for layer "${layer.files}" while ${present.map((p) => p.v).join(", ")} do.` });
+        }
+        const sets = present.map((x) => ({ v: x.v, files: x.files, paths: new Set(x.files.flatMap((f) => [...pathsOf(f)])) }));
+        const union = new Set(sets.flatMap((s) => [...s.paths]));
+        for (const p of union) {
+          const lacking = sets.filter((s) => !s.paths.has(p));
+          if (lacking.length) {
+            const having = sets.find((s) => s.paths.has(p));
+            out.push({ level: "error", code: "mode-parity", message: `Defined for ${mode} ${sets.filter((s) => s.paths.has(p)).map((s) => s.v).join(", ")} but not ${lacking.map((s) => s.v).join(", ")} (${lacking.map((s) => s.files.join(", ")).join("; ")}).`, path: p, file: having.files[0] });
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+
+// ../core/src/scopes.ts
+var has = (segments, ...names) => names.some((n) => segments.includes(n));
+function defaultScopes(path, type, tier) {
+  const s = path.split(".");
+  switch (type) {
+    case "color":
+      if (tier === "primitive" || tier === "brand" && s[0] === "palette") return [];
+      if (has(s, "text")) return ["TEXT_FILL"];
+      if (has(s, "border", "ring", "outline")) return ["STROKE_COLOR"];
+      if (has(s, "bg", "surface", "background")) return ["FRAME_FILL", "SHAPE_FILL"];
+      if (has(s, "shadow")) return ["EFFECT_COLOR"];
+      return ["FRAME_FILL", "SHAPE_FILL", "TEXT_FILL", "STROKE_COLOR"];
+    case "dimension":
+      if (has(s, "radius")) return ["CORNER_RADIUS"];
+      if (has(s, "border", "width", "stroke")) return ["STROKE_FLOAT"];
+      if (has(s, "space", "spacing", "gap")) return ["GAP", "WIDTH_HEIGHT"];
+      if (has(s, "size") && has(s, "font")) return ["FONT_SIZE"];
+      if (has(s, "letter-spacing")) return ["LETTER_SPACING"];
+      return ["WIDTH_HEIGHT", "GAP"];
+    case "fontWeight":
+      return ["FONT_WEIGHT"];
+    case "fontFamily":
+      return ["FONT_FAMILY"];
+    case "number":
+      if (has(s, "line-height", "lineHeight")) return ["LINE_HEIGHT"];
+      if (has(s, "opacity")) return ["OPACITY"];
+      return ["WIDTH_HEIGHT", "GAP"];
+    case "string":
+      return ["TEXT_CONTENT"];
+    default:
+      return [];
+  }
+}
+var sameScopes = (a, b) => {
+  const sa = [...new Set(a)].sort();
+  const sb = [...new Set(b)].sort();
+  return sa.length === sb.length && sa.every((x, i) => x === sb[i]);
+};
+var effectiveScopes = (t) => t.scopes ?? defaultScopes(t.path, t.type, t.tier);
+
+// ../core/src/diff-engine.ts
+var normDesc = (d) => (d ?? "").trim();
+function fieldChanges(a, b) {
+  const out = [];
+  if (a.path !== b.path) out.push({ field: "path", before: a.path, after: b.path });
+  if (a.type !== b.type) out.push({ field: "type", before: a.type, after: b.type });
+  const modes = [.../* @__PURE__ */ new Set([...Object.keys(a.values), ...Object.keys(b.values)])];
+  for (const mode of modes) {
+    if (!valuesEqual(b.type, a.values[mode], b.values[mode])) out.push({ field: "value", mode, before: a.values[mode], after: b.values[mode] });
+  }
+  if (normDesc(a.description) !== normDesc(b.description)) out.push({ field: "description", before: a.description, after: b.description });
+  const sa = effectiveScopes(a);
+  const sb = effectiveScopes(b);
+  if (!sameScopes(sa, sb)) out.push({ field: "scopes", before: sa, after: sb });
+  return out;
+}
+
+// ../core/src/risk.ts
+var RISK_LABELS = {
+  1: "Tier 1: low risk, one code owner",
+  2: "Tier 2: medium risk, design review then design + tech approval",
+  3: "Tier 3: token change, needs design + tech approval"
+};
+var BUMP_RANK = { patch: 0, minor: 1, major: 2 };
+var LOW = [/\.md$/, /^docs\//, /\.stories\.tsx?$/, /\.docs\.json$/, /\.test\.tsx?$/, /^\.changeset\//];
+var isSummary = (c) => "kind" in c;
+function summarizeTokenChange(c) {
+  if (isSummary(c)) return c;
+  const path = (c.target ?? c.current).path;
+  if (!c.target) return { kind: "removed", path };
+  if (!c.current) return { kind: "added", path };
+  if (c.current.path !== c.target.path) return { kind: "renamed", path };
+  const fields = fieldChanges(c.current, c.target);
+  return { kind: "changed", path, descriptionOnly: fields.length > 0 && fields.every((f) => f.field === "description") };
+}
+function tokenBump(changes) {
+  let bump;
+  for (const c of changes.map(summarizeTokenChange)) {
+    const b = c.kind === "removed" || c.kind === "renamed" ? "major" : c.kind === "changed" && c.descriptionOnly ? "patch" : "minor";
+    if (!bump || BUMP_RANK[b] > BUMP_RANK[bump]) bump = b;
+  }
+  return bump;
+}
+function isGuardrail(path, config) {
+  const list2 = config ? [...config.governance.guardrails, CONFIG_FILE, ...config.contrast ? [config.contrast.path] : []] : DEFAULT_GOVERNANCE.guardrails;
+  return list2.some((g) => g.endsWith("/") ? path.startsWith(g) : path === g) || path.startsWith(".github/") || path.endsWith("/contrast.checks.json") || path === "contrast.checks.json";
+}
+function classifyRisk(input) {
+  const reasons = [];
+  const tokenChanges = (input.tokenChanges ?? []).map(summarizeTokenChange);
+  for (const c of tokenChanges) {
+    if (c.kind === "changed" && c.descriptionOnly) reasons.push({ tier: 1, text: `Token description changed: ${c.path}` });
+    else reasons.push({ tier: 3, text: `Token ${c.kind}: ${c.path}` });
+  }
+  const bump = tokenBump(tokenChanges);
+  const componentsDir = input.config?.components?.dir;
+  for (const f of input.files ?? []) {
+    const p = f.path.replace(/^\/+/, "");
+    if (p.endsWith(".tokens.json")) {
+      if (!input.tokenChanges) reasons.push({ tier: 3, text: `Token file ${f.status ?? "changed"}: ${p}` });
+    } else if (isGuardrail(p, input.config)) reasons.push({ tier: 3, text: `Guardrail file changed: ${p}` });
+    else if (LOW.some((r) => r.test(p))) reasons.push({ tier: 1, text: `Docs, story or test: ${p}` });
+    else if (componentsDir && p.startsWith(`${componentsDir}/`)) reasons.push({ tier: 2, text: `Component source ${f.status ?? "changed"}: ${p}` });
+    else reasons.push({ tier: 2, text: `Source file changed: ${p}` });
+  }
+  reasons.sort((a, b) => b.tier - a.tier);
+  const tier = reasons[0]?.tier ?? 1;
+  return { tier, label: RISK_LABELS[tier], reasons: reasons.map((r) => r.text), bump };
+}
+
+// ../core/src/layered-review.ts
+function checkLayeredPair(set, pair, combo) {
+  const base = { fg: pair.foreground, bg: pair.background, min: pair.min, modes: comboKey(combo) };
+  const f = set.resolve(pair.foreground, combo);
+  const b = set.resolve(pair.background, combo);
+  if (f.error || b.error) return { ...base, ratio: null, pass: false, note: f.error ?? b.error };
+  const fc = renderedColor(f.value);
+  const bc = renderedColor(b.value);
+  if (!fc || !bc) return { ...base, ratio: null, pass: false, note: "not a color Bridge can measure (needs srgb or hex)" };
+  if (bc.a < 1) return { ...base, ratio: null, pass: false, note: "background is translucent: contrast depends on what is behind it" };
+  const ratio = Math.round(contrastRatio(fc, bc) * 100) / 100;
+  return { ...base, ratio, pass: ratio >= pair.min, fgValue: rgbaToHex(fc), bgValue: rgbaToHex(bc), ...fc.a < 1 ? { note: "foreground alpha composited over background" } : {} };
+}
+function runLayeredContrast(set, pairs, modes) {
+  const combos = set.combos(modes ?? set.config.contrast?.modes);
+  return combos.flatMap((c) => pairs.map((p) => checkLayeredPair(set, p, c)));
+}
+function contrastDelta(before, after) {
+  const key = (r) => `${r.fg}|${r.bg}|${r.modes}`;
+  const prev = new Map(before.map((r) => [key(r), r]));
+  return after.map((a) => {
+    const b = prev.get(key(a));
+    return { fg: a.fg, bg: a.bg, min: a.min, modes: a.modes, before: b?.ratio ?? null, after: a.ratio, passBefore: b?.pass ?? true, passAfter: a.pass };
+  }).filter((d) => d.before !== d.after || !d.passAfter);
+}
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function diffLayered(before, after) {
+  const key = (d) => `${d.file}\0${d.path}`;
+  const b = new Map(before.defs.map((d) => [key(d), d]));
+  const a = new Map(after.defs.map((d) => [key(d), d]));
+  const css = (set, d) => set.resolve(d.path, set.comboForFile(d.file)).css;
+  const tierOf = (set, f) => {
+    const t = set.tierOfFile(f);
+    return t ? { tier: t } : {};
+  };
+  const changes = [];
+  const removed = [];
+  const added = [];
+  for (const [k, d] of b) {
+    const n = a.get(k);
+    if (!n) {
+      removed.push(d);
+      continue;
+    }
+    const fields = [];
+    if (!same(d.value, n.value)) fields.push("value");
+    if (d.type !== n.type) fields.push("type");
+    if (d.description !== n.description) fields.push("description");
+    if (!same(d.extensions, n.extensions)) fields.push("extensions");
+    if (!fields.length) continue;
+    changes.push({
+      kind: "changed",
+      path: d.path,
+      file: d.file,
+      ...tierOf(after, d.file),
+      ...n.type ? { type: n.type } : {},
+      fields,
+      before: d.value,
+      after: n.value,
+      beforeCss: css(before, d),
+      afterCss: css(after, n),
+      ...d.description !== n.description ? { descriptionBefore: d.description ?? "", descriptionAfter: n.description ?? "" } : {}
+    });
+  }
+  for (const [k, d] of a) if (!b.has(k)) added.push(d);
+  for (const r of [...removed]) {
+    const i = added.findIndex((x) => x.file === r.file && same(x.value, r.value) && x.type === r.type);
+    if (i < 0) continue;
+    const n = added.splice(i, 1)[0];
+    removed.splice(removed.indexOf(r), 1);
+    changes.push({ kind: "renamed", path: n.path, from: r.path, file: n.file, ...n.type ? { type: n.type } : {}, fields: [], before: r.value, after: n.value, afterCss: css(after, n), ...tierOf(after, n.file) });
+  }
+  for (const d of removed) changes.push({ kind: "removed", path: d.path, file: d.file, ...d.type ? { type: d.type } : {}, fields: [], before: d.value, beforeCss: css(before, d), ...d.description ? { descriptionBefore: d.description } : {}, ...tierOf(before, d.file) });
+  for (const d of added) changes.push({ kind: "added", path: d.path, file: d.file, ...d.type ? { type: d.type } : {}, fields: [], after: d.value, afterCss: css(after, d), ...d.description ? { descriptionAfter: d.description } : {}, ...tierOf(after, d.file) });
+  return changes.sort((x, y) => x.path.localeCompare(y.path) || x.file.localeCompare(y.file));
+}
+function layeredImpact(before, after, direct, limit = 60) {
+  const skip = new Set(direct.map((c) => c.path));
+  const byPath = /* @__PURE__ */ new Map();
+  for (const combo of after.combos()) {
+    const paths = /* @__PURE__ */ new Set([...before.view(combo).keys(), ...after.view(combo).keys()]);
+    for (const p of paths) {
+      if (skip.has(p)) continue;
+      const x = before.resolve(p, combo).css;
+      const y = after.resolve(p, combo).css;
+      if (x === y) continue;
+      const e = byPath.get(p);
+      if (e) e.modes.push(comboKey(combo));
+      else byPath.set(p, { path: p, modes: [comboKey(combo)], before: x, after: y });
+    }
+  }
+  const all = [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
+  return { total: all.length, entries: all.slice(0, limit) };
+}
+var toChangeSummary = (c) => ({
+  kind: c.kind,
+  path: c.path,
+  ...c.kind === "changed" ? { descriptionOnly: c.fields.length > 0 && c.fields.every((f) => f === "description") } : {}
+});
+function classifyLayered(changes, otherFiles = [], config) {
+  const r = classifyRisk({ tokenChanges: changes.map(toChangeSummary), files: otherFiles.map((path) => ({ path })), config });
+  return { tier: r.tier, bump: r.bump ?? "patch", reasons: r.reasons.length ? r.reasons : ["No token or guardrail change"], label: r.label };
+}
+var short = (v) => {
+  if (v === void 0) return "";
+  const s = typeof v === "string" ? v : JSON.stringify(v);
+  return s.length > 60 ? `${s.slice(0, 57)}...` : s;
+};
+var cell = (s) => s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+var swatch = (css) => css ? `\`${cell(css)}\`` : "";
+var aliasNote = (v) => typeof v === "string" && v.startsWith("{") ? ` (${cell(short(v))})` : "";
+function changeTable(changes) {
+  if (!changes.length) return "_No token changes._";
+  const rows = changes.map((c) => {
+    const what = c.kind === "renamed" ? `renamed from \`${c.from}\`` : c.kind === "changed" ? c.fields.join(", ") : c.kind;
+    const before = c.kind === "added" || c.kind === "renamed" ? "" : `${swatch(c.beforeCss)}${aliasNote(c.before)}`;
+    const after = c.kind === "removed" ? "" : `${swatch(c.afterCss)}${aliasNote(c.after)}`;
+    return `| \`${c.path}\` | ${what} | ${before} | ${after} | ${c.file} |`;
+  });
+  return ["| Token | Change | Before | After | File |", "| --- | --- | --- | --- | --- |", ...rows].join("\n");
+}
+function contrastDeltaTable(deltas, limit = 40) {
+  if (!deltas.length) return "_No contrast pair moved._";
+  const rows = deltas.slice(0, limit).map((d) => `| \`${d.fg}\` on \`${d.bg}\` | ${d.modes} | ${d.before ?? "n/a"} | ${d.after ?? "n/a"} | ${d.min} | ${d.passAfter ? "pass" : "**fail**"} |`);
+  const more = deltas.length > limit ? `
+
+_${deltas.length - limit} more pair(s) not shown._` : "";
+  return ["| Pair | Mode | Before | After | Min | Result |", "| --- | --- | --- | --- | --- | --- |", ...rows].join("\n") + more;
+}
+function composeProposalBody(args) {
+  const t = args.tier.tier;
+  const box = (n) => `- ${n === t ? "[x]" : "[ ]"} ${RISK_LABELS[n]}`;
+  const impactList = args.impact.entries.slice(0, 15).map((e) => `- \`${e.path}\`: ${swatch(e.before)} -> ${swatch(e.after)} (${e.modes.length} mode${e.modes.length > 1 ? "s" : ""})`);
+  return [
+    "## What changed and why",
+    "",
+    args.summary.trim(),
+    "",
+    `Proposed through ${args.tool ?? "Bridge MCP"}${args.author ? ` by ${args.author}` : ""}. Agent-authored: a human design owner and tech owner review and merge.`,
+    "",
+    "## Risk tier",
+    "",
+    box(1),
+    box(2),
+    box(3),
+    "",
+    ...args.tier.reasons.map((r) => `- ${r}`),
+    `- Semver bump: \`${args.tier.bump}\``,
+    "",
+    "## Token changes",
+    "",
+    changeTable(args.changes),
+    "",
+    "## Contrast before and after",
+    "",
+    contrastDeltaTable(args.contrast),
+    "",
+    "## Downstream impact",
+    "",
+    args.impact.total ? [`${args.impact.total} token(s) resolve to a new value because they alias an edited token.`, "", ...impactList, args.impact.total > 15 ? `- and ${args.impact.total - 15} more` : ""].filter(Boolean).join("\n") : "_No other token changes value._",
+    "",
+    "## Checks",
+    "",
+    `- Token validation: ${args.validationErrors ? `**${args.validationErrors} error(s)**` : "no errors"} (DTCG schema, aliases, light and dark parity)`,
+    `- Contrast gate: ${args.contrast.some((d) => !d.passAfter) ? "**failing pairs, see table**" : "all pairs pass"}`,
+    "",
+    "## Authored by",
+    "",
+    "- [ ] Human",
+    "- [x] AI agent (Claude), reviewed by a human before merge",
+    "",
+    "## Design review checklist",
+    "",
+    "- [ ] Checked in light and dark themes and in every brand",
+    "- [ ] Contrast table reviewed, no pair loosened",
+    "- [ ] Changeset bump matches the tier",
+    ""
+  ].join("\n");
+}
+
+// ../core/src/node/git-local.ts
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// ../core/src/governance.ts
+var DEFAULT_PROTECTED_BRANCHES = ["main", "master"];
+var ProtectedBranchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProtectedBranchError";
+  }
+};
+function assertSafeBranch(branch, rules = {}) {
+  const name = branch.replace(/^refs\/heads\//, "").trim();
+  const blocked = /* @__PURE__ */ new Set([...rules.protectedBranches ?? DEFAULT_PROTECTED_BRANCHES, ...rules.base ? [rules.base] : []]);
+  if (!name || blocked.has(name)) {
+    throw new ProtectedBranchError(`Refusing to write to protected branch "${name}". Bridge only creates new branches and pull requests.`);
+  }
+  if (rules.branchPrefix && !name.startsWith(rules.branchPrefix)) {
+    throw new ProtectedBranchError(`Branch "${name}" must start with "${rules.branchPrefix}".`);
+  }
+}
+
+// ../core/src/node/git-local.ts
+function git(root, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const child = execFile("git", args, { cwd: root, env: { ...process.env, ...opts.env }, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err) reject(new Error(`git ${args.join(" ")}: ${stderr || err.message}`.trim()));
+      else resolve(stdout);
+    });
+    if (opts.input !== void 0) child.stdin.end(opts.input);
+  });
+}
+async function isGitRepo(root) {
+  try {
+    return (await git(root, ["rev-parse", "--is-inside-work-tree"])).trim() === "true";
+  } catch {
+    return false;
+  }
+}
+async function currentBranch(root) {
+  return (await git(root, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+}
+async function branchExists(root, branch) {
+  try {
+    await git(root, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function showFile(root, ref, path) {
+  try {
+    return await git(root, ["show", `${ref}:${path}`]);
+  } catch {
+    return null;
+  }
+}
+async function listFilesAt(root, ref) {
+  return (await git(root, ["ls-tree", "-r", "--name-only", ref])).split("\n").filter(Boolean);
+}
+async function originRepo(root) {
+  try {
+    const url = (await git(root, ["remote", "get-url", "origin"])).trim();
+    return /github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?$/.exec(url)?.[1];
+  } catch {
+    return void 0;
+  }
+}
+async function commitToNewLocalBranch(root, args) {
+  try {
+    assertSafeBranch(args.branch, args);
+  } catch (err) {
+    throw new Error(`Refusing to write branch "${args.branch}": ${err.message}`);
+  }
+  if (await branchExists(root, args.branch)) throw new Error(`Branch "${args.branch}" already exists. Pick another title or delete it first.`);
+  const baseSha = (await git(root, ["rev-parse", "--verify", `${args.base}^{commit}`])).trim();
+  const dir = await mkdtemp(join(tmpdir(), "bridge-index-"));
+  const env = { GIT_INDEX_FILE: join(dir, "index") };
+  try {
+    await git(root, ["read-tree", baseSha], { env });
+    for (const f of args.files) {
+      if (f.content === null) {
+        await git(root, ["update-index", "--force-remove", f.path], { env });
+        continue;
+      }
+      const blob = (await git(root, ["hash-object", "-w", "--stdin"], { input: f.content })).trim();
+      await git(root, ["update-index", "--add", "--cacheinfo", `100644,${blob},${f.path}`], { env });
+    }
+    const tree = (await git(root, ["write-tree"], { env })).trim();
+    const ident = await identityEnv(root);
+    const sha = (await git(root, ["commit-tree", tree, "-p", baseSha, "-F", "-"], { input: args.message, env: ident })).trim();
+    await git(root, ["update-ref", `refs/heads/${args.branch}`, sha, ""]);
+    const diff = await git(root, ["diff", baseSha, sha]);
+    return { sha, diff };
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+async function identityEnv(root) {
+  const get = async (k) => (await git(root, ["config", k]).catch(() => "")).trim();
+  const name = await get("user.name") || "Bridge";
+  const email = await get("user.email") || "bridge@users.noreply.github.com";
+  return { GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_COMMITTER_NAME: name, GIT_COMMITTER_EMAIL: email };
+}
+
+export {
+  __export,
+  previewLinks,
+  readPreviewComment,
+  findPreviewComment,
+  resolveBranchPreviews,
+  previewsSettled,
+  expandOwners,
+  entryLabel,
+  unreadableTeams,
+  TeamDirectory,
+  DEFAULT_RIGHTS,
+  approverEntries,
+  shipPolicy,
+  whoCanShipSentence,
+  CONFIG_FILE,
+  loadConfig,
+  tokensPath,
+  protectedBranchesOf,
+  baseBranchOf,
+  toConfigJson,
+  hexToRgba,
+  rgbaToHex,
+  rgbaToDtcg,
+  renderedColor,
+  contrastPair,
+  parseContrastChecks,
+  RISK_LABELS,
+  classifyRisk,
+  aliasOf,
+  globToRegExp,
+  comboKey,
+  LayeredTokenSet,
+  selectTokenFiles,
+  validateLayered,
+  layeredParityIssues,
+  checkLayeredPair,
+  runLayeredContrast,
+  contrastDelta,
+  diffLayered,
+  layeredImpact,
+  classifyLayered,
+  changeTable,
+  contrastDeltaTable,
+  composeProposalBody,
+  DEFAULT_PROTECTED_BRANCHES,
+  ProtectedBranchError,
+  assertSafeBranch,
+  git,
+  isGitRepo,
+  currentBranch,
+  branchExists,
+  showFile,
+  listFilesAt,
+  originRepo,
+  commitToNewLocalBranch
+};