@reqvire-org/ads 0.3.15 → 0.3.17

package/dist/mcp/resource-loader.js

@@ -31,14 +31,14 @@ export class PreviewResourceLoader {
         if (!record) throw new Error(`Unknown preview dependency: ${uri}`);
         let response;
         try { response = await this.read(uri); }
-        catch (error) { throw new Error(`Preview resource read failed for ${uri}: ${error.message}`, { cause: error }); }
+        catch (error) { throw Object.assign(new Error(`Preview resource read failed for ${uri}: ${error.message}`, { cause: error }), { code: "ADS_RESOURCE_READ", category: "transport", resourceUri: uri }); }
         if (this.closed) throw new Error("The preview App was closed.");
         const content = response.contents.find(item => item.uri === uri);
-        if (!content) throw new Error(`Missing preview dependency: ${uri}`);
+        if (!content) throw Object.assign(new Error(`Missing preview dependency: ${uri}`), { code: "ADS_RESOURCE_CONTENT", category: "build", resourceUri: uri });
         const bytes = typeof content.text === "string" ? new TextEncoder().encode(content.text) : Uint8Array.from(atob(content.blob), letter => letter.charCodeAt(0));
         const digest = await crypto.subtle.digest("SHA-256", bytes);
         const actual = "sha256:" + [...new Uint8Array(digest)].map(byte => byte.toString(16).padStart(2, "0")).join("");
-        if (bytes.length !== record.size || actual !== record.digest) throw new Error("Preview resource integrity check failed. Rebuild and reopen the preview.");
+        if (bytes.length !== record.size || actual !== record.digest) throw Object.assign(new Error("Preview resource integrity check failed. Rebuild and reopen the preview."), { code: "ADS_RESOURCE_INTEGRITY", category: "build", resourceUri: uri });
         return bytes;
       })();
       this.bytes.set(uri, task);

package/dist/mcp/server.mjs

@@ -6,6 +6,8 @@ import { z } from "zod";
 import { checkProject } from "../check.mjs";
 import { loadConfig, sourceFiles } from "../config.mjs";
 import { behaviorStatus, createVerificationController, BEHAVIOR_URI } from "../verification.mjs";
+import { INVESTIGATIONS_URI, investigationIndex, readInvestigation, readInvestigationResource } from "../investigations.mjs";
+import { failure } from "../evidence.mjs";
 import { inspectTokens } from "../tokens.mjs";
 import { inspectScenarios } from "../scenarios.mjs";
 import { startShowcaseHost } from "./showcase-host.mjs";
@@ -108,6 +110,7 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
     return [
       { uri: GUIDE_URI, name: "Start here: design-system workflow", description: "Read first for UI/ADS tasks, especially when only resource access is exposed. Explains the exact workspace, tool sequence, skill selection, previews, project commands and fallback.", mimeType: "text/markdown" },
       { uri: "ads://guides/behaviors", name: "Controller and behavioral verification guide", mimeType: "text/markdown" },
+      { uri: "ads://guides/evidence", name: "Failure boundaries and compact investigations", mimeType: "text/markdown" },
       { uri: "ads://guides/atomic-styles", name: "Atomic styles: composition conflicts and custom-property extraction", mimeType: "text/markdown" },
       { uri: "ads://guides/scenarios", name: "Scenario coverage and public class-helper contracts", mimeType: "text/markdown" },
       { uri: "ads://guides/captures", name: "On-demand captures and candidate visual review", mimeType: "text/markdown" },
@@ -117,15 +120,17 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
       { uri: `${PROJECT_URI}/catalog`, name: "Public components and patterns", mimeType: "application/json" },
       { uri: `${PROJECT_URI}/scenarios`, name: "Independently mountable scenarios", mimeType: "application/json" },
       { uri: BEHAVIOR_URI, name: "Behavior contracts, demonstrations and current verification evidence", mimeType: "application/json" },
+      { uri: INVESTIGATIONS_URI, name: "Latest per-check investigation evidence", mimeType: "application/json" },
       { uri: CAPTURES_URI, name: "On-demand current and candidate screenshots", mimeType: "application/json" },
       { uri: `${PROJECT_URI}/checks`, name: "Current ADS architecture diagnostics", mimeType: "application/json" },
+      // Keep fallback workflow metadata discoverable in the bounded first page.
+      ...skills.skills.map(({ uri, frontmatter }) => ({ uri, name: frontmatter.name, description: frontmatter.description, mimeType: "text/markdown" })),
       ...documents.filter(document => promoted.has(document.uri)).sort((a, b) => Number(b.uri === context.publicEntryUri) - Number(a.uri === context.publicEntryUri)).map(({ file: _file, ...document }) => document),
       { uri: TOKENS_APP_URI, name: "Experimental token widget", mimeType: APP_MIME },
       { uri: SCENARIO_APP_URI, name: "Experimental scenario widget", mimeType: APP_MIME },
       ...(options.config.mcp.previewManifest ? [{ uri: PREVIEW_APP_URI, name: "Shared-resource preview App", mimeType: APP_MIME }, { uri: PREVIEW_MANIFEST_URI, name: "Preview dependency graph", mimeType: "application/json" }] : []),
       ...(options.config.mcp.previewManifest ? resourceAssets() : []),
       ...allApps().map((app) => ({ uri: appUri(app.id), name: app.title, description: app.description, mimeType: APP_MIME })),
-      ...skills.skills.map(({ uri, frontmatter }) => ({ uri, name: frontmatter.name, description: frontmatter.description, mimeType: "text/markdown" })),
       ...documents.filter((document) => !promoted.has(document.uri)).map(({ file: _file, ...document }) => document),
       ...[...skills.files.values()].filter((file) => !skillEntries.has(file.uri)).map(({ uri, name, mimeType }) => ({ uri, name, mimeType })),
     ];
@@ -142,13 +147,14 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
       build: summarizeBuild(builds()),
       previews: previews(), skills: skills.skills.map(({ uri, frontmatter }) => ({ uri, name: frontmatter.name, description: frontmatter.description })),
       scenarios: { count: getRegistry().scenarios.length, diagnostics: getRegistry().diagnostics, resourceUri: `${PROJECT_URI}/scenarios`, tool: "ads_show_scenario" },
-      behaviors: { resourceUri: BEHAVIOR_URI, discoveryTool: "ads_behaviors", verificationTool: "ads_verify", ...verification.status() },
+      behaviors: { resourceUri: BEHAVIOR_URI, discoveryTool: "ads_behaviors", verificationTool: "ads_verify", investigationTool: "ads_investigate", investigationResourceUri: INVESTIGATIONS_URI, ...verification.status() },
       captures: { resourceUri: CAPTURES_URI, tool: "ads_capture", clearTool: "ads_capture_clear", ...captures.status() },
       experimental: { apps: true, nativeSkills: era === "modern", nativeSkillActivation: "host-controlled" } };
   }
   async function read(uri, signal) {
     if (uri === GUIDE_URI) return { contents: [{ uri, mimeType: "text/markdown", text: projectGuide(project(), [...previews(), ...scenarioApps()]) }] };
     if (uri === "ads://guides/behaviors") return { contents: [{ uri, mimeType: "text/markdown", text: readFileSync(new URL("../../docs/BEHAVIORS.md", import.meta.url), "utf8") }] };
+    if (uri === "ads://guides/evidence") return { contents: [{ uri, mimeType: "text/markdown", text: readFileSync(new URL("../skills/ads-designer/references/evidence.md", import.meta.url), "utf8") }] };
     if (uri === "ads://guides/atomic-styles") return { contents: [{ uri, mimeType: "text/markdown", text: readFileSync(new URL("../skills/ads-designer/references/atomic-styles.md", import.meta.url), "utf8") }] };
     if (uri === "ads://guides/scenarios") return { contents: [{ uri, mimeType: "text/markdown", text: readFileSync(new URL("../skills/ads-designer/references/scenarios.md", import.meta.url), "utf8") }] };
     if (uri === "ads://guides/captures") return { contents: [{ uri, mimeType: "text/markdown", text: readFileSync(new URL("../skills/ads-designer/references/captures.md", import.meta.url), "utf8") }] };
@@ -161,12 +167,17 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
     else if (uri === `${PROJECT_URI}/scenarios`) value = getRegistry();
     else if (uri === `${PROJECT_URI}/checks`) value = checkProject(root);
     else if (uri === BEHAVIOR_URI) value = behaviorStatus(options);
+    else if (uri === INVESTIGATIONS_URI) value = investigationIndex(root);
     else if (uri === CAPTURES_URI) value = captureIndex();
     else if (uri === PREVIEW_MANIFEST_URI && options.config.mcp.previewManifest) {
       value = readPreviewManifest(previewOptions());
       if (!value) throw new Error("Preview resources are not built yet. Invoke ads_show_scenario to start the managed compiler.");
     }
     if (value !== undefined) return { contents: [{ uri, mimeType: "application/json", text: JSON.stringify(value) }] };
+    if (uri.startsWith("ads://investigations/") || uri.startsWith("ads://verification-artifacts/")) {
+      try { return {contents:[readInvestigationResource(root,uri)]}; }
+      catch(error){throw new ResourceNotFoundError(uri,error.message);}
+    }
     if (uri.startsWith("ads://captures/")) {
       try { const inventory = captureInventory(); return { contents: [captures.store.readResource(uri, inventory.scenarios, inventory.revision, { allowUnknownTargets: !!inventory.diagnostics.length })] }; }
       catch (error) { if (error.code === "ADS_CAPTURE_NOT_FOUND") throw new ResourceNotFoundError(uri, error.message); throw error; }
@@ -244,7 +255,7 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
       } },
       { name: "ads_check", description: "Run read-only core ADS architecture checks; returns blocking diagnostics separately from nonblocking advisories, with warnings before informational limits. Atomic warnings include helper/forwarded-class paths and ads://guides/atomic-styles guidance; unresolved paths do not establish safe composition. Project Oxlint, typecheck, build and browser tests remain separate.", schema: z.object({ limit: z.number().int().min(1).max(50).default(20) }).strict(), call: ({ limit }) => {
         const result = checkProject(root);
-        return json({ ok: result.ok, total: result.diagnostics.length, diagnostics: result.diagnostics.slice(0, limit), advisoryCount: result.advisories?.length ?? 0, advisories: (result.advisories ?? []).slice(0, limit), resourceUri: `${PROJECT_URI}/checks` });
+        return json({ ok: result.ok, acceptance:result.acceptance, total: result.diagnostics.length, diagnostics: result.diagnostics.slice(0, limit), advisoryCount: result.advisories?.length ?? 0, advisories: (result.advisories ?? []).slice(0, limit), resourceUri: `${PROJECT_URI}/checks` });
       } },
       { name: "ads_skills", description: "Select one ADS workflow after ads_status: ads-designer for building/refining/debugging UI; ads-migrate for a library reference; ads-import for another project's ADS; ads-motion for animation; ads-break-ui for stress testing. Then read that workflow with ads_read_skill. Listing does not activate a native skill.", schema: empty, call: () => json({ skills: skills.skills.map(({ uri, frontmatter }) => ({ uri, ...frontmatter })) }) },
       { name: "ads_read_skill", description: "Read a selected skill or relative supporting text file in bounded chunks. This is explicit instruction access, not automatic native skill activation/install.", schema: z.object({ name: z.string().max(64), file: z.string().max(300).default("SKILL.md"), offset: z.number().int().min(0).default(0), limit: z.number().int().min(1).max(8000).default(6000) }).strict(), call: ({ name, file, offset, limit }) => {
@@ -284,7 +295,8 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
             demonstrations: demonstrations.slice(0, 10), demonstrationCount: demonstrations.length, checkCount: Object.keys(item.checks).length };
         }), diagnostics: inventory.diagnostics.slice(0, 50), resourceUri: BEHAVIOR_URI });
       } },
-      { name: "ads_verify", description: "Run one owner's registered development behavior checks using its configured runner/profile. Executes trusted project commands with bounded output, cancellation and process-tree cleanup; installs nothing. Progress and per-check timings are available through ads_status; a profile timeout bounds the whole run. Browser profiles use an isolated managed showcase/MCP App. React StrictMode requires a project development harness, not a production widget. Missing/skipped cases, stale inputs and process exit alone cannot produce passing evidence. Discover exact unit/check IDs with ads_behaviors first.", schema: z.object({ unit: z.string().min(1).max(256), checks: z.array(z.string().min(1).max(100)).min(1).max(100).optional() }).strict(), annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, call: async (args, signal, progress) => {
+      { name: "ads_investigate", title: "Inspect check evidence", description: "Read the latest compact investigation for an exact registered unit/check, including candidate runs. Returns failure boundary, exact input/observed preview revisions, source/failing step, observed viewport, failed startup requests and available artifact resource URIs. Does not rerun tests or infer root cause. Bundles replace the previous entry per check; compare revisions with ads_behaviors before claiming freshness.", schema: z.object({unit:z.string().min(1).max(256),check:z.string().min(1).max(100)}).strict(), call: args => json(readInvestigation(root,args)) },
+      { name: "ads_verify", description: "Run one owner's registered development behavior checks using its configured runner/profile. Executes trusted project commands with bounded output, cancellation and process-tree cleanup; installs nothing. Progress and per-check timings are available through ads_status; a profile timeout bounds the whole run. Browser profiles use an isolated managed showcase/MCP App. React StrictMode requires a project development harness, not a production widget. Missing/skipped cases, stale inputs and process exit alone cannot produce passing evidence. Results separate failure boundaries and explicit acceptance scope; inspect retained source/request/artifact evidence with ads_investigate. Discover exact unit/check IDs with ads_behaviors first.", schema: z.object({ unit: z.string().min(1).max(256), checks: z.array(z.string().min(1).max(100)).min(1).max(100).optional() }).strict(), annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, call: async (args, signal, progress) => {
         const result = await verification.run(args, signal, progress);
         await refresh();
         return { ...json(result), ...(!result.ok ? { isError: true } : {}) };
@@ -330,7 +342,7 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
       void context.mcpReq.notify({ method: "notifications/progress", params: { progressToken: token, progress: ++progress, message: value.message ?? `${value.profile}: ${value.completed}/${value.total} completed; ${value.active.map(item => `${item.unit}#${item.check}`).join(", ") || "no active check reported"}; ${value.elapsedMs} ms elapsed` } }).catch(() => {});
     };
     try { return await tool.call(input.data, context.mcpReq.signal, notify); }
-    catch (error) { return { isError: true, content: [{ type: "text", text: error.message }], ...(error.build ? { structuredContent: { message: error.message, build: error.build } } : {}) }; }
+    catch (error) { return { isError: true, content: [{ type: "text", text: error.message }], structuredContent: {ok:false,message:error.message,failure:failure(error.build?"build":"runner",error.build?"preview-build":"tool-execution",error.build?.code??"ADS_TOOL_ERROR",{certainty:"observed-boundary"}),...(error.build?{build:error.build}:{})} }; }
   });
   server.setRequestHandler("resources/list", ({ params = {} }) => {
     previewWatch?.start();
@@ -338,10 +350,16 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
     const listing = page(resources(), cursor, "resources");
     return { resources: listing.items, ...(listing.nextCursor ? { nextCursor: listing.nextCursor } : {}) };
   });
-  server.setRequestHandler("resources/templates/list", () => ({ resourceTemplates: [{ uriTemplate: "ads://captures/{key}/{slot}", name: "Current/candidate screenshot", description: "Exact keys and available slots come from ads://project/captures. Slots are replaced in place, not revision history.", mimeType: "image/png" }] }));
+  server.setRequestHandler("resources/templates/list", () => ({ resourceTemplates: [
+    { uriTemplate: "ads://captures/{key}/{slot}", name: "Current/candidate screenshot", description: "Exact keys and available slots come from ads://project/captures. Slots are replaced in place, not revision history.", mimeType: "image/png" },
+    { uriTemplate: "ads://investigations/{unit}/{check}", name: "Latest check investigation", description: "Use encoded unit/check segments from ads://project/investigations. One latest bundle per check, including candidate verification.", mimeType: "application/json" },
+  ] }));
   server.setRequestHandler("resources/read", ({ params: { uri } }, context) => read(uri, context.mcpReq.signal));
   server.setRequestHandler("resources/subscribe", ({ params: { uri } }) => {
     if (!resources().some((entry) => entry.uri === uri)) {
+      if(uri.startsWith("ads://investigations/")) {
+        try {readInvestigationResource(root,uri);subscribed.add(uri);return {};}catch{throw new ResourceNotFoundError(uri,"Unknown check investigation.");}
+      }
       if (!uri.startsWith("ads://captures/")) throw new ResourceNotFoundError(uri, "Unknown ADS resource subscription.");
       try { const inventory = captureInventory(); captures.store.readResource(uri, inventory.scenarios, inventory.revision, { allowUnknownTargets: !!inventory.diagnostics.length }); } catch { throw new ResourceNotFoundError(uri, "Unknown or absent screenshot slot."); }
     }
@@ -382,6 +400,8 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
   let previousBuild = JSON.stringify(builds());
   let previousCaptures = captures.store.fingerprint();
   let previousCaptureUris = captures.store.resourceUris();
+  const investigationFingerprint=()=>fileFingerprint([path.join(root,".ds/investigations.json")]);
+  let previousInvestigations=investigationFingerprint();
   async function refresh(force = false) {
     // Polling covers replaced files and new directories consistently across OSes.
     cache.documents = undefined;
@@ -394,7 +414,8 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
     const artifactsChanged = artifacts !== previousArtifacts;
     const assetsChanged = assets !== previousAssets;
     const capturesChanged = captures.store.fingerprint() !== previousCaptures;
-    if (!filesChanged && !buildChanged && !artifactsChanged && !assetsChanged && !capturesChanged) return false;
+    const investigationsChanged=investigationFingerprint()!==previousInvestigations;
+    if (!filesChanged && !buildChanged && !artifactsChanged && !assetsChanged && !capturesChanged && !investigationsChanged) return false;
     if (filesChanged) {
       const updated = loadConfig(root);
       await previewWatch?.reconfigure?.(updated.config.mcp);
@@ -411,7 +432,8 @@ export function createAdsMcp(directory, { era = "legacy", skillDirectory, pollIn
     previousAssets = assetFingerprint();
     previousBuild = JSON.stringify(builds());
     const targets = filesChanged ? era === "modern" ? resources().map((entry) => entry.uri).filter((uri) => !skills.files.has(uri)) : [...subscribed]
-      : [BUILD_URI, BEHAVIOR_URI, `${PROJECT_URI}/status`, ...(options.config.mcp.previewManifest ? [PREVIEW_MANIFEST_URI] : []), ...(artifactsChanged ? allApps().map(app => appUri(app.id)) : [])].filter((uri) => era === "modern" || subscribed.has(uri));
+      : [BUILD_URI, BEHAVIOR_URI, INVESTIGATIONS_URI, `${PROJECT_URI}/status`, ...(options.config.mcp.previewManifest ? [PREVIEW_MANIFEST_URI] : []), ...(artifactsChanged ? allApps().map(app => appUri(app.id)) : [])].filter((uri) => era === "modern" || subscribed.has(uri));
+    if(investigationsChanged){targets.push(...[INVESTIGATIONS_URI,...investigationIndex(root).entries.map(entry=>entry.resourceUri),...[...subscribed].filter(uri=>uri.startsWith("ads://investigations/"))].filter(uri=>era==="modern"||subscribed.has(uri)));previousInvestigations=investigationFingerprint();}
     if (capturesChanged || filesChanged) {
       const current = (captures.store.fingerprint() ? captureIndex().captures : []).flatMap(record => [record.current?.resourceUri, record.candidate?.resourceUri].filter(Boolean));
       targets.push(...[CAPTURES_URI, ...previousCaptureUris, ...current].filter(uri => era === "modern" || subscribed.has(uri)));

package/dist/scenario-selectors.mjs

@@ -0,0 +1,140 @@
+import path from "node:path";
+import ts from "typescript";
+import postcss from "postcss";
+import { isDevelopmentFile, isInside } from "./config.mjs";
+import { publicApi } from "./public-api.mjs";
+import { createSourceValues, reference, literal, isFunction } from "./source-values.mjs";
+import { uiOperation } from "./ui-framework.mjs";
+import { nestedSelectors, selectorWitness } from "./selector-match.mjs";
+
+/** Native semantics may be composed through actual public runtime styles.
+ * A matching tag relationship is evidence of ownership, not visual correctness. */
+export function createScenarioSelectors(program, options) {
+  const checker = program.getTypeChecker(), templates = new WeakMap(), cache = new WeakMap();
+  function imported(node, name, seen = new Set()) {
+    if (!node || seen.has(node)) return false;
+    seen.add(node);
+    const base = ts.isPropertyAccessExpression(node) ? node.expression : node;
+    return checker.getSymbolAtLocation(base)?.declarations?.some(declaration => {
+      if (ts.isImportSpecifier(declaration)) return (declaration.propertyName ?? declaration.name).text === name && ["@linaria/atomic", "@linaria/core"].includes(declaration.parent.parent.parent.moduleSpecifier.text);
+      if (ts.isNamespaceImport(declaration) && ts.isPropertyAccessExpression(node)) return node.name.text === name && ["@linaria/atomic", "@linaria/core"].includes(declaration.parent.parent.moduleSpecifier.text);
+      return ts.isVariableDeclaration(declaration) && imported(declaration.initializer, name, seen);
+    }) ?? false;
+  }
+  const isCx = node => imported(node, "cx");
+  const values = createSourceValues(program, options, { strict: true, preserveCall: node => isCx(node) || uiOperation(node, checker) === "createElement" });
+  const { state, next, resolve, get, keys, props, returns } = values;
+  const publicNodes = new Set(publicApi(program, options).filter(item => item.renderable).map(item => resolve(reference(item.declaration.name ?? item.declaration), state())).filter(value => value.kind === "node").map(value => value.node));
+  const runtime = node => !isDevelopmentFile(node.getSourceFile().fileName, options) && ["components", "patterns"].some(folder => isInside(path.join(options.dsRoot, folder), node.getSourceFile().fileName));
+  function selectors(node) {
+    if (templates.has(node)) return templates.get(node);
+    const result = []; templates.set(node, result);
+    if (!runtime(node) || !ts.isNoSubstitutionTemplateLiteral(node.template)) return result;
+    try {
+      function walk(container, parents) {
+        for (const child of container.nodes ?? []) {
+          if (child.type === "rule") {
+            const selected = nestedSelectors(parents, child.selector);
+            if (child.nodes.some(value => value.type === "decl" && !value.prop.startsWith("--"))) result.push(...selected);
+            walk(child, selected);
+          } else if (child.type === "atrule" && !/(?:^|-)keyframes$/.test(child.name)) walk(child, parents);
+        }
+      }
+      walk(postcss.parse(node.template.text), ["&"]);
+    } catch { /* The CSS syntax gate owns malformed templates. */ }
+    return result;
+  }
+  function classes(input, context) {
+    const value = resolve(input, next(context));
+    if (value.kind === "union") {
+      const all = value.values.map(branch => classes(branch, next(context)));
+      return all[0]?.filter(entry => all.every(branch => branch.includes(entry))) ?? [];
+    }
+    if (value.kind !== "node") return [];
+    if (ts.isTaggedTemplateExpression(value.node) && imported(value.node.tag, "css")) return [value.node];
+    if (ts.isCallExpression(value.node) && isCx(value.node.expression)) return value.node.arguments.flatMap(argument => classes(reference(argument, value.env, value.via), next(context)));
+    return [];
+  }
+  function element(node, env, via) {
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) {
+      const opening = ts.isJsxElement(node) ? node.openingElement : node;
+      const attributes = props(opening, env, via);
+      const children = ts.isJsxElement(node) ? node.children.filter(child => !ts.isJsxText(child) || child.text.trim()).filter(child => !ts.isJsxExpression(child) || child.expression) : [];
+      if (children.length) attributes.layers.push(new Map([["children", children.length === 1 ? reference(children[0], env, via) : { kind: "array", values: children.map(child => reference(child, env, via)) }]]));
+      return { tag: reference(opening.tagName, env, via), attributes, intrinsic: ts.isIdentifier(opening.tagName) && /^[a-z]/.test(opening.tagName.text) ? opening.tagName.text : null };
+    }
+    if (ts.isCallExpression(node) && uiOperation(node.expression, checker) === "createElement") {
+      const attributes = { kind: "object", layers: node.arguments[1] && node.arguments[1].kind !== ts.SyntaxKind.NullKeyword ? [reference(node.arguments[1], env, via)] : [] };
+      const children = node.arguments.slice(2).map(child => reference(child, env, via));
+      if (children.length) attributes.layers.push(new Map([["children", children.length === 1 ? children[0] : { kind: "array", values: children }]]));
+      return { tag: reference(node.arguments[0], env, via), attributes, intrinsic: ts.isStringLiteralLike(node.arguments[0]) ? node.arguments[0].text : null };
+    }
+    return null;
+  }
+  return site => {
+    if (cache.has(site)) return cache.get(site);
+    const native = ts.isJsxOpeningElement(site) ? site.parent : site;
+    let steps = 0, limited = false;
+    const witnesses = [];
+    function render(input, parent, context, owned = false) {
+      if (++steps > 700 || context.depth > 40) { limited = true; return []; }
+      const value = resolve(input, next(context));
+      context = value.context ?? input.context ?? context;
+      if (value.kind === "union") {
+        // Unknown render alternatives cannot silently authorize a native control.
+        limited = true; return [];
+      }
+      if (value.kind === "array") return value.values.flatMap(child => render(child, parent, next(context), owned));
+      if (value.kind !== "node") return [];
+      const {node, env, via} = value;
+      if (ts.isJsxExpression(node)) return render(reference(node.expression, env, via), parent, next(context), owned);
+      if (ts.isJsxFragment(node)) return node.children.flatMap(child => render(reference(child, env, via), parent, next(context), owned));
+      if (ts.isArrayLiteralExpression(node)) return node.elements.flatMap(child => render(reference(child, env, via), parent, next(context), owned));
+      const view = element(node, env, via);
+      if (!view) return [];
+      const target = view.intrinsic ? literal(view.intrinsic) : resolve(view.tag, next(context));
+      if (["provider", "context"].includes(target.kind)) return render(get(view.attributes, "children", next(context)), parent, next(context), owned);
+      if (target.kind === "node" && isFunction(target.node)) {
+        const outputs = returns(target, [view.attributes], next(context), "component");
+        if (outputs.length !== 1) { limited = true; return []; }
+        return render(outputs[0], parent, next(context), owned || publicNodes.has(target.node));
+      }
+      if (target.kind !== "literal" || typeof target.value !== "string") return [];
+      const attributes = new Map(),ownedAttributes=new Set();
+      for (const name of keys(view.attributes, next(context))) {
+        const input=get(view.attributes,name,next(context));
+        const value = resolve(input, next(context));
+        attributes.set(name, value.kind === "literal" ? value.value : undefined);
+        if(owned&&runtime(node)&&input.kind==="node"&&ts.isStringLiteralLike(input.node)&&runtime(input.node))ownedAttributes.add(name);
+      }
+      const result = {tag:target.value.toLowerCase(),attributes,ownedAttributes,parent,children:[],site:node,styles:owned ? classes(get(view.attributes,"className",next(context)),next(context)) : []};
+      if (node === native) witnesses.push(result);
+      result.children = render(get(view.attributes,"children",next(context)),result,next(context),owned);
+      return [result];
+    }
+    function proves(roots) {
+      function all(node) { return [node,...node.children.flatMap(all)]; }
+      const nodes = roots.flatMap(all);
+      return witnesses.some(witness => nodes.some(anchor => anchor.styles.some(template => selectors(template).some(selector => nodes.some(target => {
+        // Styles must target the native node itself or public UI inside it.
+        let inside = target === witness;
+        for (let parent = target.parent; parent && !inside; parent = parent.parent) inside = parent === witness;
+        return inside && selectorWitness(selector,target,anchor,witness);
+      })))));
+    }
+    // First follow the native wrapper into its public contents. This also works
+    // when a scenario helper returns it and is invoked under a public container.
+    let roots = render(reference(native),null,state());
+    let ok = proves(roots);
+    if (!ok) {
+      let parent = native.parent;
+      while (parent && (ts.isJsxExpression(parent) || ts.isParenthesizedExpression(parent))) parent = parent.parent;
+      if (parent && element(parent,new Map(),[])) {
+        const view = element(parent,new Map(),[]), target = resolve(view.tag,state());
+        if (target.kind === "node" && publicNodes.has(target.node)) { witnesses.length=0; steps=0; limited=false; roots=render(reference(parent),null,state()); ok=proves(roots); }
+      }
+    }
+    const result = {ok, reasons:ok ? [] : [limited ? "Selector composition reached an unresolved render branch or source work limit." : "No attached public-runtime Linaria selector proves this native tag or runtime-part relationship."], evidence:ok ? {kind:"selector-composition", established:["public-runtime-style-provenance","native-position-ownership"], unverified:["computed-styles","interaction","accessibility"]} : undefined};
+    cache.set(site,result);return result;
+  };
+}

package/dist/selector-match.mjs

@@ -0,0 +1,94 @@
+import selectorParser from "postcss-selector-parser";
+
+const states = new Set([":hover", ":active", ":focus", ":focus-visible", ":focus-within", ":visited", ":link", ":any-link", ":enabled", ":disabled", ":checked", ":indeterminate", ":required", ":optional", ":valid", ":invalid", ":placeholder-shown", ":open"]);
+
+/** Match bounded source DOM witnesses, not a browser cascade. Ownership requires
+ * a positive native tag or a :has binding to a real runtime-owned child marker. */
+export function selectorWitness(selector, target, anchor, native) {
+  let steps = 0;
+  const yes = typed => ({ typed });
+  const and = (a, b) => a === false || b === false ? false : !a || !b ? undefined : yes(a.typed || b.typed);
+  const any = results => results.find(value => value?.typed) ?? results.find(Boolean) ?? (results.includes(undefined) ? undefined : false);
+  const descendants = (element, found = []) => {
+    if (found.length > 128) return found;
+    for (const child of element.children) { found.push(child); descendants(child, found); }
+    return found;
+  };
+  function simple(node, element, scope, binding) {
+    if (++steps > 2000 || !element) return undefined;
+    if (node.type === "comment") return yes(false);
+    if (node.type === "nesting") return element === anchor ? yes(false) : false;
+    if (node.type === "universal") return yes(false);
+    if (node.type === "tag") return !node.namespace && node.value.toLowerCase() === element.tag ? yes(element === native) : false;
+    if (node.type === "attribute") {
+      if (node.namespace || !element.attributes.has(node.attribute)) return false;
+      const actual = element.attributes.get(node.attribute);
+      if (actual === undefined) return undefined;
+      const owned=binding&&element.parent===native&&element.ownedAttributes?.has(node.attribute);
+      if (!node.operator) return yes(owned);
+      if (node.operator !== "=" || node.insensitive) return undefined;
+      return String(actual) === node.value ? yes(owned) : false;
+    }
+    if (node.type === "class" || node.type === "id") {
+      const value = element.attributes.get(node.type === "class" ? "className" : "id");
+      if (typeof value !== "string") return undefined;
+      return (node.type === "class" ? value.split(/\s+/).includes(node.value) : value === node.value) ? yes(false) : false;
+    }
+    if (node.type !== "pseudo" || node.value.startsWith("::")) return undefined;
+    if (node.value === ":scope") return element === scope ? yes(false) : false;
+    if (states.has(node.value) && !node.nodes?.length) return yes(false);
+    if ([":is", ":where"].includes(node.value)) return any(node.nodes.map(branch => match(branch.nodes, element, scope, binding)));
+    if (node.value === ":not") {
+      const matched = any(node.nodes.map(branch => match(branch.nodes, element, scope)));
+      return matched === false ? yes(false) : matched ? false : undefined;
+    }
+    if (node.value === ":has") {
+      const children = descendants(element);
+      if (children.length > 128) return undefined;
+      return any(node.nodes.flatMap(branch => {
+        const nodes = [selectorParser.pseudo({ value: ":scope" }), ...(branch.nodes[0]?.type === "combinator" ? [] : [selectorParser.combinator({ value: " " })]), ...branch.nodes];
+        return children.map(child => match(nodes, child, element,element===native));
+      }));
+    }
+    return undefined;
+  }
+  function match(nodes, element, scope, binding=false) {
+    if (++steps > 2000 || !element) return undefined;
+    const groups = [[]], combinators = [];
+    for (const node of nodes) {
+      if (node.type === "combinator") { combinators.push(node.value.trim() || " "); groups.push([]); }
+      else groups.at(-1).push(node);
+    }
+    if (groups.some(group => !group.length)) return undefined;
+    function part(index, current) {
+      if (!current || ++steps > 2000) return current ? undefined : false;
+      let result = yes(false);
+      for (const node of groups[index]) result = and(result, simple(node, current, scope,binding));
+      if (!result || !index) return result;
+      const candidates = [];
+      if (combinators[index - 1] === ">") candidates.push(current.parent);
+      else if (combinators[index - 1] === " ") { for (let parent = current.parent; parent && candidates.length < 32; parent = parent.parent) candidates.push(parent); }
+      else if (["+", "~"].includes(combinators[index - 1])) {
+        const siblings = current.parent?.children ?? [], position = siblings.indexOf(current);
+        candidates.push(...siblings.slice(combinators[index - 1] === "+" ? Math.max(0, position - 1) : 0, position));
+      } else return undefined;
+      return and(result, any(candidates.map(candidate => part(index - 1, candidate))));
+    }
+    return part(groups.length - 1, element);
+  }
+  try { return selectorParser().astSync(selector).nodes.some(branch => match(branch.nodes, target, anchor)?.typed); }
+  catch { return false; }
+}
+
+/** Resolve CSS nesting with selector ASTs; never substitute project names. */
+export function nestedSelectors(parents, selector) {
+  const children = selectorParser().astSync(selector).nodes;
+  const result = [];
+  for (const parent of parents) for (const child of children) {
+    if (result.length >= 32) return [];
+    const copy = child.clone(); let nested = false;
+    copy.walkNesting(node => { nested = true; node.replaceWith(selectorParser.pseudo({ value: ":is", nodes: selectorParser().astSync(parent).nodes.map(value => value.clone()) })); });
+    result.push(nested ? copy.toString() : `${parent} ${copy}`);
+  }
+  return result;
+}