@transitrix/diagrams 1.8.20 → 1.9.18

package/dist/versioned-attribute/types.d.ts

@@ -0,0 +1,12 @@
+/** One version entry in an attribute's history. `value: null` is a gap
+ *  marker — the attribute is unset from `valid_from` until the next entry. */
+export interface AttributeVersionEntry {
+    valid_from: string;
+    value: unknown;
+}
+/** A parsed sidecar document, keyed by attribute name. */
+export interface VersionedAttributeSidecar {
+    /** Canonical id of the primitive this sidecar versions. */
+    target: string;
+    attribute_versions: Record<string, AttributeVersionEntry[]>;
+}

package/dist/versioned-attribute/types.js

@@ -0,0 +1,6 @@
+// Versioned-attribute sidecar (CONTRACT.md §9) — shared shape across every
+// notation that declares a `time_varying` field. A sidecar is a co-located
+// `<primitive_id>.history.yaml` document: no `id`, no admission record, no
+// lifecycle of its own — its temporal window is governed by the target
+// primitive's own `valid_from`/`valid_to` (CONTRACT.md §9.1).
+export {};

package/dist/versioned-attribute/validate.d.ts

@@ -0,0 +1,17 @@
+import type { AttributeVersionEntry, VersionedAttributeSidecar } from './types.js';
+export interface AttributeArrayFinding {
+    code: 'VERSIONED-002' | 'VERSIONED-003' | 'VERSIONED-005';
+    severity: 'error' | 'warning';
+    message: string;
+}
+/** Parse a raw parsed-YAML mapping into a typed sidecar, or `null` if it
+ *  isn't shaped like one (missing `target` string or `attribute_versions`
+ *  map) — not every doc under `canon/elements/**` is a sidecar. */
+export declare function parseSidecar(data: Record<string, unknown> | null | undefined): VersionedAttributeSidecar | null;
+/** VERSIONED-002/003/005 for one attribute's version array.
+ *  `targetValidFrom`/`targetValidTo` bound VERSIONED-005 — pass `undefined`
+ *  for either to skip that half of the check (e.g. the target element could
+ *  not be found, which is already reported separately as VERSIONED-001). */
+export declare function validateAttributeArray(attributeName: string, entries: AttributeVersionEntry[], targetValidFrom?: string, targetValidTo?: string | null): AttributeArrayFinding[];
+/** Run VERSIONED-002/003/005 over every attribute in a parsed sidecar. */
+export declare function validateSidecar(sidecar: VersionedAttributeSidecar, targetValidFrom?: string, targetValidTo?: string | null): AttributeArrayFinding[];

package/dist/versioned-attribute/validate.js

@@ -0,0 +1,87 @@
+// Versioned-attribute sidecar validation — CONTRACT.md §9.3, `VERSIONED-00x`.
+//
+// Split by what each check needs to know:
+//   - `parseSidecar` + `validateAttributeArray` here cover VERSIONED-002/003/005,
+//     which only need the sidecar document itself (plus, for 005, the target
+//     primitive's own lifecycle window).
+//   - `VERSIONED-001` (target resolves to an admitted primitive) and
+//     `VERSIONED-004` (a time_varying field present inline on the primitive)
+//     both need cross-document knowledge — which ids exist, which notation a
+//     primitive is — that a single sidecar document doesn't carry. Those are
+//     repo-scope concerns; see `repo-validate/check-versioned-attributes.ts`.
+function isAttributeVersionEntry(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v) && typeof v['valid_from'] === 'string';
+}
+/** Parse a raw parsed-YAML mapping into a typed sidecar, or `null` if it
+ *  isn't shaped like one (missing `target` string or `attribute_versions`
+ *  map) — not every doc under `canon/elements/**` is a sidecar. */
+export function parseSidecar(data) {
+    if (!data)
+        return null;
+    const target = data['target'];
+    const attributeVersions = data['attribute_versions'];
+    if (typeof target !== 'string' || target.trim() === '')
+        return null;
+    if (typeof attributeVersions !== 'object' || attributeVersions === null || Array.isArray(attributeVersions))
+        return null;
+    const out = {};
+    for (const [name, value] of Object.entries(attributeVersions)) {
+        if (!Array.isArray(value))
+            continue;
+        out[name] = value.filter(isAttributeVersionEntry);
+    }
+    return { target, attribute_versions: out };
+}
+/** VERSIONED-002/003/005 for one attribute's version array.
+ *  `targetValidFrom`/`targetValidTo` bound VERSIONED-005 — pass `undefined`
+ *  for either to skip that half of the check (e.g. the target element could
+ *  not be found, which is already reported separately as VERSIONED-001). */
+export function validateAttributeArray(attributeName, entries, targetValidFrom, targetValidTo) {
+    const findings = [];
+    const seen = new Set();
+    let sorted = true;
+    let prev;
+    for (const entry of entries) {
+        if (seen.has(entry.valid_from)) {
+            findings.push({
+                code: 'VERSIONED-002',
+                severity: 'error',
+                message: `attribute '${attributeName}': duplicate valid_from '${entry.valid_from}'.`,
+            });
+        }
+        seen.add(entry.valid_from);
+        if (prev !== undefined && entry.valid_from < prev)
+            sorted = false;
+        prev = entry.valid_from;
+        if (targetValidFrom !== undefined && entry.valid_from < targetValidFrom) {
+            findings.push({
+                code: 'VERSIONED-005',
+                severity: 'error',
+                message: `attribute '${attributeName}': entry valid_from '${entry.valid_from}' is before the target's valid_from '${targetValidFrom}'.`,
+            });
+        }
+        if (targetValidTo !== undefined && targetValidTo !== null && entry.valid_from > targetValidTo) {
+            findings.push({
+                code: 'VERSIONED-005',
+                severity: 'error',
+                message: `attribute '${attributeName}': entry valid_from '${entry.valid_from}' is after the target's valid_to '${targetValidTo}'.`,
+            });
+        }
+    }
+    if (!sorted) {
+        findings.push({
+            code: 'VERSIONED-003',
+            severity: 'warning',
+            message: `attribute '${attributeName}': entries are not sorted by valid_from ascending.`,
+        });
+    }
+    return findings;
+}
+/** Run VERSIONED-002/003/005 over every attribute in a parsed sidecar. */
+export function validateSidecar(sidecar, targetValidFrom, targetValidTo) {
+    const findings = [];
+    for (const [name, entries] of Object.entries(sidecar.attribute_versions)) {
+        findings.push(...validateAttributeArray(name, entries, targetValidFrom, targetValidTo));
+    }
+    return findings;
+}

package/dist/webview/render-applications.d.ts

@@ -8,4 +8,18 @@
  * `#transitrix-root` exactly the way it drops the goals SVG (Step 3 contract).
  */
 import type { ApplicationsCatalogueHeader } from '../applications/types.js';
-export declare function renderApplicationsHtml(catalogue: ApplicationsCatalogueHeader): string;
+import type { ResolvedApplicationAttributes } from '../applications/resolve-maturity.js';
+/**
+ * Resolved values for owner_role/vendor/maturity — sidecar-bound
+ * (CONTRACT.md §9.4) and never inline on an admitted catalogue entry
+ * (VERSIONED-004). The host resolves these upstream (see
+ * `applications/resolve-maturity.ts`) and passes the result in; this
+ * function stays a pure renderer of whatever it's given — no I/O, no
+ * write-back. `asOf` is the date the resolution ran at, shown so the view
+ * never states an undated value.
+ */
+export interface ApplicationsMaturityResolution {
+    asOf: string;
+    byAppId: Map<string, ResolvedApplicationAttributes>;
+}
+export declare function renderApplicationsHtml(catalogue: ApplicationsCatalogueHeader, resolution?: ApplicationsMaturityResolution): string;

package/dist/webview/render-applications.js

@@ -1,3 +1,4 @@
+import { withResolvedAttributes } from '../applications/resolve-maturity.js';
 import { escHtml } from './render-util.js';
 const TYPE_LABEL = {
     application: 'Application',
@@ -68,8 +69,11 @@ function renderRow(a) {
   <td class="col-owner">${a.owner_role ? escHtml(a.owner_role) : '<span class="cell-empty">—</span>'}</td>
 </tr>`;
 }
-export function renderApplicationsHtml(catalogue) {
-    const rows = catalogue.applications.map(renderRow).join('\n');
+export function renderApplicationsHtml(catalogue, resolution) {
+    const applications = resolution
+        ? catalogue.applications.map((a) => withResolvedAttributes(a, resolution.byAppId))
+        : catalogue.applications;
+    const rows = applications.map(renderRow).join('\n');
     const emptyRow = catalogue.applications.length === 0
         ? `<tr><td colspan="7" class="empty-catalogue">No applications defined.</td></tr>`
         : '';
@@ -81,6 +85,7 @@ export function renderApplicationsHtml(catalogue) {
       ${catalogue.version ? `<span class="catalogue-version">v${escHtml(catalogue.version)}</span>` : ''}
     </div>
     ${catalogue.description ? `<div class="catalogue-subtitle">${escHtml(catalogue.description)}</div>` : ''}
+    ${resolution ? `<div class="catalogue-resolved-note">Owner Role, Vendor, Maturity resolved as of ${escHtml(resolution.asOf)}</div>` : ''}
   </header>`;
     return `<section class="tx-catalogue tx-applications">
 ${header}

package/dist/webview/render-blocks.js

@@ -115,8 +115,6 @@ export function renderBlocksSvg(doc, options = {}) {
  */
 const GRID_CELL_PAD_X = 8;
 const GRID_LINE_HEIGHT = 15;
-const GRID_EMBED_CSS = `
-.blocks-grid-border { fill: none; stroke: var(--ts-border, #cbd5e1); }`;
 function centeredGridCellTextSvg(lines, cls, cx, cellTop, cellHeight) {
     const ls = lines.length > 0 ? lines : [''];
     const firstY = cellTop + cellHeight / 2 - ((ls.length - 1) / 2) * GRID_LINE_HEIGHT;
@@ -174,7 +172,11 @@ export function renderGridBody(layout, ox, oy) {
         const colLineX = ox + col.x + col.width;
         parts.push(`<line class="diagram-edge" x1="${colLineX}" y1="${gridY1}" x2="${colLineX}" y2="${gridY2}"/>`);
     }
-    parts.push(`<rect class="blocks-grid-border" x="${ox}" y="${oy}" width="${tw}" height="${th}"/>`);
+    // Explicit fill="none" alongside the class: this rect covers the full grid
+    // bounds and is the last (topmost) element emitted, so if `.blocks-grid-border`
+    // is ever missing from a host's CSS (as it was in the VS Code webview path —
+    // see the grid-preview regression), it must not fall back to SVG's default opaque black fill.
+    parts.push(`<rect class="blocks-grid-border" fill="none" x="${ox}" y="${oy}" width="${tw}" height="${th}"/>`);
     return parts.join('\n');
 }
 /** The single grid (matrix subset) SVG emitter shared by every host. */
@@ -185,7 +187,7 @@ export function renderGridLayoutSvg(layout, options = {}) {
     const ox = PAD;
     const oy = PAD + topInset;
     const body = renderGridBody(layout, ox, oy);
-    const styleLine = embedCssTheme ? `\n<style>${generateSvgEmbedCss(embedCssTheme)}${GRID_EMBED_CSS}</style>` : '';
+    const styleLine = embedCssTheme ? `\n<style>${generateSvgEmbedCss(embedCssTheme)}</style>` : '';
     return `<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}">${styleLine}
 ${title}
 ${body}

package/dist/webview/render-capability-map.d.ts

@@ -4,4 +4,19 @@
  * HTML fragment for the JCEF host (Step 4 of ADR 0001).
  */
 import type { CapabilityMapHeader } from '../capability-map/types.js';
-export declare function renderCapabilityMapHtml(map: CapabilityMapHeader): string;
+import type { ResolvedCapabilityAttributes } from '../capability-map/resolve-maturity.js';
+/**
+ * Resolved values for current_maturity/target_maturity/owner_role/
+ * target_date — sidecar-bound (CONTRACT.md §9.4) on the standalone
+ * CAPABILITY-* primitive a nested entry references (the 2026-08-05
+ * packages decision). The host resolves
+ * these upstream (see `capability-map/resolve-maturity.ts`) and passes the
+ * result in; this function stays a pure renderer of whatever it's given —
+ * no I/O, no write-back. `asOf` is the date the resolution ran at, shown so
+ * the view never states an undated value.
+ */
+export interface CapabilityMapMaturityResolution {
+    asOf: string;
+    byId: Map<string, ResolvedCapabilityAttributes>;
+}
+export declare function renderCapabilityMapHtml(rawMap: CapabilityMapHeader, resolution?: CapabilityMapMaturityResolution): string;

package/dist/webview/render-capability-map.js

@@ -1,3 +1,4 @@
+import { withResolvedCapabilityMap } from '../capability-map/resolve-maturity.js';
 import { escHtml } from './render-util.js';
 const MATURITY_LABEL = {
     1: 'Initial',
@@ -52,7 +53,8 @@ function renderCapabilityCard(node, depth) {
   ${childBlock}
 </div>`;
 }
-export function renderCapabilityMapHtml(map) {
+export function renderCapabilityMapHtml(rawMap, resolution) {
+    const map = resolution ? withResolvedCapabilityMap(rawMap, resolution.byId) : rawMap;
     const header = `<header class="catalogue-header">
     <div class="catalogue-title">${escHtml(map.name)}</div>
     <div class="catalogue-meta">
@@ -60,6 +62,7 @@ export function renderCapabilityMapHtml(map) {
       <span class="catalogue-updated">Assessed ${escHtml(map.assessment_date)}</span>
     </div>
     ${map.description ? `<div class="catalogue-subtitle">${escHtml(map.description)}</div>` : ''}
+    ${resolution ? `<div class="catalogue-resolved-note">Current Maturity, Target Maturity, Owner Role, Target Date resolved as of ${escHtml(resolution.asOf)}</div>` : ''}
   </header>`;
     if (map.capabilities.length === 0) {
         return `<section class="tx-catalogue tx-capability-map">

package/dist/webview/render-process.d.ts

@@ -70,7 +70,7 @@ export interface RenderProcessOptions {
     /** Extra vertical space (px) reserved above the pool for a title block. */
     topInset?: number;
 }
-export declare const BPMN_PROCESS_CSS = "\n.bpmn-pool { fill: var(--ts-bg-surface,#f8fafc); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-pool-name { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-lane { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-lane-header { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-pool-label { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; font-weight: 700; }\n.bpmn-lane-label { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; font-weight: 600; }\n.bpmn-task { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-task-name { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; text-anchor: middle; }\n.bpmn-event { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); }\n.bpmn-event-start { stroke-width: 1.5; }\n.bpmn-event-end { stroke-width: 4; }\n.bpmn-event-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }\n.bpmn-gateway { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-gateway-marker { stroke: var(--ts-node-stroke,#004d67); stroke-width: 2.5; stroke-linecap: round; fill: none; }\n.bpmn-gateway-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }\n.bpmn-seq-flow { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-default-mark { stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; stroke-linecap: round; }\n.bpmn-assoc { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1; stroke-dasharray: 4 2; }\n.bpmn-data-obj { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1; }\n.bpmn-data-obj-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }\n.bpmn-event-intermediate { fill: none; stroke: var(--ts-node-stroke,#004d67); stroke-width: 1; }\n.bpmn-event-icon { fill: none; stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; stroke-linecap: round; stroke-linejoin: round; }\n";
+export declare const BPMN_PROCESS_CSS = "\n.bpmn-pool { fill: var(--ts-bg-surface,#f8fafc); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-pool-name { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-lane { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-lane-header { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }\n.bpmn-pool-label { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; font-weight: 700; }\n.bpmn-lane-label { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; font-weight: 600; }\n.bpmn-task { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-task-name { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; text-anchor: middle; }\n.bpmn-event { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); }\n.bpmn-event-start { stroke-width: 1.5; }\n.bpmn-event-end { stroke-width: 4; }\n.bpmn-event-label { fill: var(--ts-text-secondary,#516970); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 10px; text-anchor: middle; }\n.bpmn-gateway { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-gateway-marker { stroke: var(--ts-node-stroke,#004d67); stroke-width: 2.5; stroke-linecap: round; fill: none; }\n.bpmn-gateway-label { fill: var(--ts-text-secondary,#516970); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 10px; text-anchor: middle; }\n.bpmn-seq-flow { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; }\n.bpmn-default-mark { stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; stroke-linecap: round; }\n.bpmn-assoc { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1; stroke-dasharray: 4 2; }\n.bpmn-data-obj { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1; }\n.bpmn-data-obj-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }\n.bpmn-event-intermediate { fill: none; stroke: var(--ts-node-stroke,#004d67); stroke-width: 1; }\n.bpmn-event-icon { fill: none; stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; stroke-linecap: round; stroke-linejoin: round; }\n";
 /**
  * Canonical body emitter, shared by every host (VS Code, JCEF, static export).
  *

package/dist/webview/render-process.js

@@ -39,17 +39,17 @@ export const BPMN_PROCESS_CSS = `
 .bpmn-pool-name { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }
 .bpmn-lane { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }
 .bpmn-lane-header { fill: var(--ts-bg-elevated,#f1f5f9); stroke: var(--ts-node-stroke,#004d67); stroke-width: 0.75; }
-.bpmn-pool-label { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; font-weight: 700; }
-.bpmn-lane-label { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; font-weight: 600; }
+.bpmn-pool-label { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; font-weight: 700; }
+.bpmn-lane-label { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; font-weight: 600; }
 .bpmn-task { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }
-.bpmn-task-name { fill: var(--ts-text-primary,#0d2b35); font-size: 11px; text-anchor: middle; }
+.bpmn-task-name { fill: var(--ts-text-primary,#0d2b35); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 11px; text-anchor: middle; }
 .bpmn-event { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); }
 .bpmn-event-start { stroke-width: 1.5; }
 .bpmn-event-end { stroke-width: 4; }
-.bpmn-event-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }
+.bpmn-event-label { fill: var(--ts-text-secondary,#516970); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 10px; text-anchor: middle; }
 .bpmn-gateway { fill: var(--ts-bg,#ffffff); stroke: var(--ts-node-stroke,#004d67); stroke-width: 1.5; }
 .bpmn-gateway-marker { stroke: var(--ts-node-stroke,#004d67); stroke-width: 2.5; stroke-linecap: round; fill: none; }
-.bpmn-gateway-label { fill: var(--ts-text-secondary,#516970); font-size: 10px; text-anchor: middle; }
+.bpmn-gateway-label { fill: var(--ts-text-secondary,#516970); font-family: var(--vscode-font-family, system-ui, -apple-system, sans-serif); font-size: 10px; text-anchor: middle; }
 .bpmn-seq-flow { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; }
 .bpmn-default-mark { stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1.5; stroke-linecap: round; }
 .bpmn-assoc { fill: none; stroke: var(--ts-edge-stroke,#004d67); stroke-width: 1; stroke-dasharray: 4 2; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@transitrix/diagrams",
-  "version": "1.8.20",
+  "version": "1.9.18",
   "type": "module",
   "description": "Shared rendering, validation, and pure mutations for Transitrix custom diagram formats.",
   "license": "MIT",
@@ -15,6 +15,9 @@
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "engines": {
+    "node": ">=20"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -51,13 +54,13 @@
   "devDependencies": {
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
-    "@types/react": "^18.3.28",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.4",
     "jsdom": "^29.1.1",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "reactflow": "^11.11.4",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.10"
   }
 }

package/src/activity-card/types.ts

@@ -1,7 +1,7 @@
 // Activity Card notation — single-project narrative view.
 //
 // Spec: transitrix/methodology `notations/views/18-activity-card.md` (v0.1).
-// Epic vkgeorgia/strategy#97, Studio track #134.
+// Studio track #134.
 //
 // The Activity Card is the first MULTI-DOCUMENT Studio notation. The card
 // YAML itself holds only `id`, `project` (an Activity ID), `description`,

package/src/agreement.ts

@@ -0,0 +1,71 @@
+// Agreement axis — methodology CONTRACT.md §6.3 / §6.3.1 (AGREE-001..003).
+//
+// A closed three-value axis (`draft` | `agreed` | `disputed`) carried by
+// REQUIREMENT, CONSTRAINT, and NEED — independent of admission (§6.1),
+// recording whether the accountable party has committed to the statement.
+// Absent ⇒ `agreed` (back-compat; a human-authored element that predates
+// this axis needs no change).
+//
+// Ported from methodology's reference implementation
+// (`scripts/check-agreement.mjs`'s `checkAgreement`/`looksLikeTool`) so a
+// repo carrying the field validates identically here — same closed
+// vocabulary, same tool-id heuristic, same "AGREE-003 wins over AGREE-002
+// when both would fire" precedence.
+
+import type { ValidationError } from './validation-types.js';
+
+export const AGREEMENT_VALUES = ['draft', 'agreed', 'disputed'] as const;
+export type AgreementValue = (typeof AGREEMENT_VALUES)[number];
+
+/** Same convention as `ADMIT-007`'s footgun-catcher: an npm-scoped name, or
+ *  a hyphenated `*-cli` / `*-reviewer[-…]` / `*-bot` / `*-scanner` id, reads
+ *  as a tool; anything else reads as a human handle. Not a security
+ *  boundary — catches the common mistake of a tool defaulting or
+ *  copy-pasting `agreed`. */
+const TOOL_ID_RE = /^@|-cli$|-reviewer(?:-\w+)?$|-bot$|-scanner$/i;
+
+export function looksLikeTool(id: unknown): boolean {
+  return TOOL_ID_RE.test(String(id ?? ''));
+}
+
+/**
+ * AGREE-001..003 over an element's already-extracted `agreement` /
+ * `agreed_by` fields. Returns an empty list when `agreement` is absent
+ * (back-compat — absent ⇒ `agreed`, nothing to check) or when the fields
+ * are well-formed.
+ *
+ * AGREE-002 and AGREE-003 can both describe an `agreement: agreed` record
+ * with no `agreed_by` — this reports AGREE-003 only, the same choice
+ * `check-agreement.mjs` makes (CONTRACT.md §6.3.1 permits either or both).
+ */
+export function checkAgreement(record: Record<string, unknown>): ValidationError[] {
+  const agreement = record.agreement;
+  if (agreement === undefined) return [];
+
+  if (typeof agreement !== 'string' || !(AGREEMENT_VALUES as readonly string[]).includes(agreement)) {
+    return [{
+      code: 'AGREE-001',
+      message: `agreement "${String(agreement)}" must be one of ${AGREEMENT_VALUES.join(', ')}.`,
+      path: 'agreement',
+    }];
+  }
+
+  const agreedBy = record.agreed_by;
+  if (typeof agreedBy !== 'string' || agreedBy.trim() === '') {
+    return [{
+      code: 'AGREE-003',
+      message: 'agreed_by is required whenever agreement is present.',
+      path: 'agreed_by',
+    }];
+  }
+
+  if (agreement === 'agreed' && looksLikeTool(agreedBy)) {
+    return [{
+      code: 'AGREE-002',
+      message: `agreement: agreed but agreed_by "${agreedBy}" identifies a tool — a tool must never write "agreed".`,
+      path: 'agreed_by',
+    }];
+  }
+
+  return [];
+}

package/src/applications/index.ts

@@ -9,3 +9,6 @@ export type {
 } from './types.js';
 
 export { validateApplicationsCatalogue } from './validate.js';
+
+export type { ResolvedApplicationAttributes } from './resolve-maturity.js';
+export { resolveApplicationAttributes, withResolvedAttributes } from './resolve-maturity.js';

package/src/applications/resolve-maturity.ts

@@ -0,0 +1,66 @@
+// Render-time resolution of the applications-catalogue's sidecar-bound
+// time_varying fields (owner_role, vendor, maturity — notations/views/
+// 10-applications.md §5a, CONTRACT.md §9.4). VERSIONED-004 rejects these
+// inline on an admitted catalogue entry, so a compliant document never
+// carries them — a renderer that only reads the document straight shows
+// blank cells for every field the maturity decision moved out.
+//
+// Pure: no I/O, no repo walk. The host (VS Code extension, IntelliJ/JCEF,
+// CLI) already owns loading canon/elements/** (canon-loader.ts's shared FS
+// layer) — this module only knows how to pick sidecars out of that pool and
+// resolve them at a date.
+//
+// Per the 2026-08-05 hub decision (proposal #1022): this is a read model,
+// never storage. Callers render an augmented, ephemeral copy of the
+// application row and must never serialise it back — the sidecar stays the
+// only place these fields are written.
+
+import { parseSidecar, resolveAttributes } from '../versioned-attribute/index.js';
+import type { Application } from './types.js';
+
+export interface ResolvedApplicationAttributes {
+  owner_role?: string;
+  vendor?: string;
+  maturity?: number;
+}
+
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  owner_role/vendor/maturity at `atDate`, keyed by the sidecar's target id
+ *  (== an application's `app_id`, per the notation's element-file pairing). */
+export function resolveApplicationAttributes(
+  rawElementDocs: unknown[],
+  atDate: string,
+): Map<string, ResolvedApplicationAttributes> {
+  const byAppId = new Map<string, ResolvedApplicationAttributes>();
+  for (const doc of rawElementDocs) {
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) continue;
+    const sidecar = parseSidecar(doc as Record<string, unknown>);
+    if (!sidecar) continue;
+    const resolved = resolveAttributes(sidecar, atDate);
+    const entry: ResolvedApplicationAttributes = {};
+    if (typeof resolved['owner_role'] === 'string') entry.owner_role = resolved['owner_role'];
+    if (typeof resolved['vendor'] === 'string') entry.vendor = resolved['vendor'];
+    if (typeof resolved['maturity'] === 'number') entry.maturity = resolved['maturity'];
+    if (Object.keys(entry).length > 0) byAppId.set(sidecar.target, entry);
+  }
+  return byAppId;
+}
+
+/** Merge resolved sidecar values into a rendering copy of an application row.
+ *  An inline value would win if present, but VERSIONED-004 already forbids
+ *  that on an admitted document — this is a display fallback, not a
+ *  migration tool. The returned object is a plain copy; nothing here writes
+ *  it anywhere. */
+export function withResolvedAttributes(
+  app: Application,
+  resolved: Map<string, ResolvedApplicationAttributes>,
+): Application {
+  const r = resolved.get(app.app_id);
+  if (!r) return app;
+  return {
+    ...app,
+    owner_role: app.owner_role ?? r.owner_role,
+    vendor: app.vendor ?? r.vendor,
+    maturity: app.maturity ?? r.maturity,
+  };
+}

package/src/applications/validate.ts

@@ -12,6 +12,17 @@ const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 
 const IFACE_CONDITIONAL = ['protocol', 'payload_class', 'sensitivity', 'directionality'] as const;
 
+// VERSIONED-004 (CONTRACT.md §9.3) — `owner_role`, `vendor`, `maturity` are
+// declared `time_varying` by notations/views/10-applications.md §5/§5a and
+// belong in the sidecar `<app_id>.history.yaml`, not inline on the catalogue
+// entry. Unlike capability's VERSIONED-004 (packages/diagrams/src/
+// repo-validate/check-versioned-attributes.ts), which walks standalone
+// element files under canon/elements/**, an applications-catalogue entry has
+// no file of its own to check inline-vs-sidecar on — the entry lives in this
+// view document — so the check runs here, at the per-file notation
+// validator, rather than in the repo-scope element sweep.
+const TIME_VARYING_FIELDS = ['owner_role', 'vendor', 'maturity'] as const;
+
 export function validateApplicationsCatalogue(input: unknown): ValidationResult {
   const errors: ValidationError[] = [];
   const warnings: ValidationWarning[] = [];
@@ -114,6 +125,18 @@ export function validateApplicationsCatalogue(input: unknown): ValidationResult
       }
     }
 
+    // VERSIONED-004: time_varying fields must live in the sidecar, not inline.
+    for (const field of TIME_VARYING_FIELDS) {
+      if (a[field] !== undefined) {
+        errors.push({
+          code: 'VERSIONED-004',
+          message:
+            `${idx}: '${field}' is time_varying (CONTRACT.md §9) and belongs in the sidecar ` +
+            `'${typeof a['app_id'] === 'string' ? a['app_id'] : idx}.history.yaml', not inline on the catalogue entry.`,
+        });
+      }
+    }
+
     // APP-009: integrations[].direction enum
     if (Array.isArray(a['integrations'])) {
       const integrations = a['integrations'] as unknown[];

package/src/capability-map/index.ts

@@ -7,6 +7,13 @@ export type {
 
 export { validateCapabilityMap } from './validate.js';
 
+export type { ResolvedCapabilityAttributes } from './resolve-maturity.js';
+export {
+  resolveCapabilityAttributes,
+  withResolvedAttributes,
+  withResolvedCapabilityMap,
+} from './resolve-maturity.js';
+
 export type {
   CapabilityTreeNode,
   CapabilityTreeEdge,

package/src/capability-map/resolve-maturity.ts

@@ -0,0 +1,84 @@
+// Render-time resolution of a nested capability-map entry's sidecar-bound
+// time_varying fields (current_maturity, target_maturity, owner_role,
+// target_date — 05-capability-map.md §13/§14, CONTRACT.md §9.4).
+// check-versioned-attributes.ts's VERSIONED-004 already rejects these inline
+// on the standalone CAPABILITY-*.yaml primitive; a nested capability-map
+// entry references that same primitive by id (the 2026-08-05 packages
+// decision — no separate per-nested-entry sidecar convention), so this
+// resolves the same way applications/resolve-maturity.ts does for the
+// applications catalogue.
+//
+// Pure: no I/O, no repo walk. The host (VS Code extension, IntelliJ/JCEF,
+// CLI) already owns loading canon/elements/** — this module only knows how
+// to pick sidecars out of that pool and resolve them at a date.
+//
+// Per the 2026-08-05 packages decision: this is a read model, never
+// storage. Callers render an augmented, ephemeral copy of the capability
+// tree and must never serialise it back — the sidecar stays the only place
+// these fields are written.
+
+import { parseSidecar, resolveAttributes } from '../versioned-attribute/index.js';
+import type { CapabilityMapHeader, CapabilityNode } from './types.js';
+
+export interface ResolvedCapabilityAttributes {
+  current_maturity?: number;
+  target_maturity?: number;
+  owner_role?: string;
+  target_date?: string;
+}
+
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  current_maturity/target_maturity/owner_role/target_date at `atDate`,
+ *  keyed by the sidecar's target id (== a capability entry's `id`, per the
+ *  CAPABILITY-* primitive that entry references). */
+export function resolveCapabilityAttributes(
+  rawElementDocs: unknown[],
+  atDate: string,
+): Map<string, ResolvedCapabilityAttributes> {
+  const byId = new Map<string, ResolvedCapabilityAttributes>();
+  for (const doc of rawElementDocs) {
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) continue;
+    const sidecar = parseSidecar(doc as Record<string, unknown>);
+    if (!sidecar) continue;
+    const resolved = resolveAttributes(sidecar, atDate);
+    const entry: ResolvedCapabilityAttributes = {};
+    if (typeof resolved['current_maturity'] === 'number') entry.current_maturity = resolved['current_maturity'];
+    if (typeof resolved['target_maturity'] === 'number') entry.target_maturity = resolved['target_maturity'];
+    if (typeof resolved['owner_role'] === 'string') entry.owner_role = resolved['owner_role'];
+    if (typeof resolved['target_date'] === 'string') entry.target_date = resolved['target_date'];
+    if (Object.keys(entry).length > 0) byId.set(sidecar.target, entry);
+  }
+  return byId;
+}
+
+/** Merge resolved sidecar values into a rendering copy of a capability node
+ *  and its descendants. An inline value always wins if present — this is a
+ *  display fallback for fields the document doesn't carry inline, not a
+ *  migration tool. Returns a new node tree; nothing here writes it
+ *  anywhere. */
+export function withResolvedAttributes(
+  node: CapabilityNode,
+  resolved: Map<string, ResolvedCapabilityAttributes>,
+): CapabilityNode {
+  const r = resolved.get(node.id);
+  const merged: CapabilityNode = r
+    ? {
+        ...node,
+        current_maturity: node.current_maturity ?? r.current_maturity,
+        target_maturity: node.target_maturity ?? r.target_maturity,
+        owner_role: node.owner_role ?? r.owner_role,
+        target_date: node.target_date ?? r.target_date,
+      }
+    : node;
+  if (!node.children || node.children.length === 0) return merged;
+  return { ...merged, children: node.children.map((c) => withResolvedAttributes(c, resolved)) };
+}
+
+/** Same merge, applied across a capability map's whole top-level tree. */
+export function withResolvedCapabilityMap(
+  map: CapabilityMapHeader,
+  resolved: Map<string, ResolvedCapabilityAttributes>,
+): CapabilityMapHeader {
+  if (resolved.size === 0) return map;
+  return { ...map, capabilities: map.capabilities.map((c) => withResolvedAttributes(c, resolved)) };
+}

package/src/capability-map/validate.ts

@@ -8,8 +8,7 @@ const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 // Canonical form per `IDS_AND_REFERENCES.md` §2: `CAPABILITY-V…` /
 // `CAPABILITY-H…` with the dotted address (`V1`, `V1.2.1`, `H1`). The bare
 // legacy form (`V1`, `H1`) is still accepted so existing maps without the
-// canonical prefix do not break — migration is tracked under
-// vkgeorgia/strategy#36.
+// canonical prefix do not break; migration is tracked separately.
 const CAP_ID_RE = /^(CAPABILITY-)?(V|H)\d+(\.\d+)*$/;
 
 export function validateCapabilityMap(input: unknown): ValidationResult {