@usefragments/core 1.10.2 → 1.11.0

package/dist/{chunk-MZ4SW3TP.js → chunk-3IOWHECM.js}

@@ -301,6 +301,13 @@ var GOVERNANCE_TELEMETRY_FIELDS = [
     carriage: "derived",
     topLevelField: "adoption"
   },
+  {
+    path: "adoption.adopted[].{componentKey,displayName,canonicalTarget,usageCount}",
+    type: "bounded adopted component-identity summaries",
+    purpose: "Explains which canonical components account for current adopted call sites without uploading source.",
+    carriage: "derived",
+    topLevelField: "adoption"
+  },
   {
     path: "adoption.shadows[].{componentKey,displayName,canonicalTarget,usageCount}",
     type: "bounded component-identity summaries",
@@ -372,4 +379,4 @@ export {
   GOVERNANCE_TELEMETRY_FIELDS,
   GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE
 };
-//# sourceMappingURL=chunk-MZ4SW3TP.js.map
+//# sourceMappingURL=chunk-3IOWHECM.js.map

package/dist/{chunk-MZ4SW3TP.js.map → chunk-3IOWHECM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/governance-telemetry.ts"],"sourcesContent":["/**\n * Public disclosure contract for `fragments-governance-report:v1`.\n *\n * Brace groups enumerate closed sibling fields without hiding additions behind\n * `*`. The three named placeholder fields are the only intentionally open\n * records: configured ignore reasons, configured categories, and rule-specific\n * evidence facts.\n */\nexport type GovernanceTelemetryCarriage =\n  | \"none\"\n  | \"derived\"\n  | \"source-literal\"\n  | \"structured-source\";\n\nexport interface GovernanceTelemetryField {\n  path: string;\n  type: string;\n  purpose: string;\n  carriage: GovernanceTelemetryCarriage;\n  topLevelField: GovernanceTelemetryTopLevelField;\n}\n\nexport const GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS = [\n  \"contractHash\",\n  \"schemaVersion\",\n  \"generatedAt\",\n  \"root\",\n  \"hook\",\n  \"git\",\n  \"summary\",\n  \"groups\",\n  \"suppressions\",\n  \"bypassEvents\",\n  \"hookEvents\",\n  \"packageVocabularies\",\n  \"adoption\",\n  \"health\",\n  \"topology\",\n  \"source\",\n  \"gateRung\",\n  \"diffOnly\",\n  \"failOnWarnings\",\n] as const;\n\nexport type GovernanceTelemetryTopLevelField =\n  (typeof GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS)[number];\n\nexport const GOVERNANCE_TELEMETRY_FIELDS = [\n  {\n    path: \"schemaVersion\",\n    type: '\"fragments-governance-report:v1\"',\n    purpose: \"Pins the accepted wire shape and compatibility policy.\",\n    carriage: \"none\",\n    topLevelField: \"schemaVersion\",\n  },\n  {\n    path: \"generatedAt\",\n    type: \"ISO-8601 string\",\n    purpose: \"Records when the CLI produced the report.\",\n    carriage: \"none\",\n    topLevelField: \"generatedAt\",\n  },\n  {\n    path: \"root.{workspaceRoot,packageRoot,packageName}\",\n    type: \"string fields\",\n    purpose: \"Identifies the scanned workspace and package roots.\",\n    carriage: \"none\",\n    topLevelField: \"root\",\n  },\n  {\n    path: \"hook.{installedAt,mode,agents[]}\",\n    type: \"installation metadata\",\n    purpose: \"Describes the local hook installation that produced evidence.\",\n    carriage: \"none\",\n    topLevelField: \"hook\",\n  },\n  {\n    path: \"git.{baseRef,headSha,branch,repoFullName,pullRequestNumber}\",\n    type: \"Git and provider identifiers\",\n    purpose: \"Attaches results to the correct repository, commit and pull request.\",\n    carriage: \"none\",\n    topLevelField: \"git\",\n  },\n  {\n    path: \"summary.{filesScanned,rulesActive,presetsLoaded[],groupCount,occurrenceCount,ignoredCount,classnamesScanned,classnamesDynamic,classnamesResolved,totalFindings,errorCount,warnCount,infoCount,passed}\",\n    type: \"counts, verdict and active preset names\",\n    purpose: \"Reports scan volume and result totals without finding rows.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.ignoredByReason.{reason}\",\n    type: \"configured reason name → count\",\n    purpose: \"Counts ignored findings by the reason configured by the repository.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsBySeverity.{error,warn,info}\",\n    type: \"severity counts\",\n    purpose: \"Counts findings in each fixed severity bucket.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsByCategory.{category}\",\n    type: \"configured category name → count\",\n    purpose: \"Counts findings by the rule categories present in the scan.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.{status,declared,fatalForCi,blockingCapable,summary}\",\n    type: \"governance-integrity verdict\",\n    purpose: \"Explains whether the resolved policy is capable of enforcement.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.families[].{id,armed,reason,remediation}\",\n    type: \"integrity-family status\",\n    purpose: \"Explains the enforcement readiness of each governance family.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.families[].rules[]\",\n    type: \"rule identifiers\",\n    purpose: \"Names the active rules contributing to an integrity family.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.armed[]\",\n    type: \"integrity-family identifiers\",\n    purpose: \"Names the governance families capable of enforcement.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.remediations[]\",\n    type: \"remediation messages\",\n    purpose: \"Explains how to make an inert or degraded policy effective.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.configDiagnostics[].{code,kind,severity,path,message}\",\n    type: \"configuration diagnostics\",\n    purpose: \"Reports inert or conflicting authored governance configuration.\",\n    carriage: \"structured-source\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.roster.{configured,active,inert}\",\n    type: \"rule roster counts\",\n    purpose: \"Counts configured, active and inert governance rules.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsByBaselineState.{baselined,new}\",\n    type: \"baseline-state counts\",\n    purpose: \"Separates accepted baseline debt from newly introduced findings.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"groups[].{groupId,ruleId,category,severity,packageRoot,filePath}\",\n    type: \"finding group metadata\",\n    purpose: \"Identifies each grouped rule failure and repository-relative path.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].message\",\n    type: \"string\",\n    purpose: \"Explains the failure and may quote the offending source literal.\",\n    carriage: \"source-literal\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.kind\",\n    type: \"normalized-offense category\",\n    purpose: \"Names the kind of source offense represented by the group.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.raw\",\n    type: \"normalized source offense\",\n    purpose: \"Carries the exact offending source substring.\",\n    carriage: \"source-literal\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.canonical\",\n    type: \"normalized source offense\",\n    purpose: \"Carries the derived canonical representation of the offense.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].occurrenceId\",\n    type: \"stable occurrence identifier\",\n    purpose: \"Identifies one occurrence within a finding group.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].location.{file,line,column,endLine,endColumn}\",\n    type: \"repository-relative location\",\n    purpose: \"Places each occurrence at its exact file/line/column range.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].area.{areaId,areaName,criticality,owners[],matchedGlob}\",\n    type: \"area identifiers, owners and criticality\",\n    purpose: \"Carries the configured product-area classification for the file.\",\n    carriage: \"structured-source\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].factId\",\n    type: \"fact identifier\",\n    purpose: \"Links the occurrence to the extracted fact supporting it.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.kind\",\n    type: \"fact discriminator\",\n    purpose: \"Names the extracted rule-fact shape.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.location.{file,line,column,endLine,endColumn}\",\n    type: \"repository-relative location\",\n    purpose: \"Locates the source-backed fact used as evidence.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.{ruleSpecificField}\",\n    type: \"extensible rule-specific fact fields\",\n    purpose:\n      \"Carries rule-specific parsed facts; fields may include selectors, properties and source values.\",\n    carriage: \"structured-source\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].suggestedReplacement.{kind,from,to,certainty,reason}\",\n    type: \"deterministic replacement\",\n    purpose: \"Carries the deterministic replacement the CLI can apply.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].suggestedReplacement.edit.{file,start,end,replacement}\",\n    type: \"deterministic edit range\",\n    purpose: \"Locates and describes the exact edit the CLI can apply.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"suppressions[].{id,kind,file,line,column,code,expiresOn,attachedLine,attachedTo,directive}\",\n    type: \"directive identity, location and attachment metadata\",\n    purpose: \"Reports matched in-source governance directives.\",\n    carriage: \"none\",\n    topLevelField: \"suppressions\",\n  },\n  {\n    path: \"suppressions[].reason\",\n    type: \"authored directive reason\",\n    purpose: \"Carries the repository-authored reason for the suppression.\",\n    carriage: \"source-literal\",\n    topLevelField: \"suppressions\",\n  },\n  {\n    path: \"bypassEvents[].{code,file,line}\",\n    type: \"rule code and source location\",\n    purpose: \"Records directives that actually bypassed a finding in this run.\",\n    carriage: \"none\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"bypassEvents[].reason\",\n    type: \"authored directive reason\",\n    purpose: \"Carries the repository-authored reason for the bypass.\",\n    carriage: \"source-literal\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"bypassEvents[].area.{areaId,areaName,criticality,matchedGlob}\",\n    type: \"configured product-area metadata\",\n    purpose: \"Classifies the bypass by its configured product area.\",\n    carriage: \"structured-source\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"hookEvents[].{eventId,kind,ruleId,code,file,mode,agent,timestamp,reasonClass}\",\n    type: \"bounded hook decision receipts\",\n    purpose: \"Reports deny, downgrade, suppression and fail-open decisions.\",\n    carriage: \"none\",\n    topLevelField: \"hookEvents\",\n  },\n  {\n    path: \"packageVocabularies[].{source,packageName,status,manifestPath,digest,commit}\",\n    type: \"compiled canonical-package vocabulary records\",\n    purpose: \"Publishes package vocabulary proposed by authoritative local discovery.\",\n    carriage: \"structured-source\",\n    topLevelField: \"packageVocabularies\",\n  },\n  {\n    path: \"packageVocabularies[].roots[].{name,members[]}\",\n    type: \"compiled component roots and members\",\n    purpose: \"Publishes the canonical component vocabulary discovered from the package.\",\n    carriage: \"structured-source\",\n    topLevelField: \"packageVocabularies\",\n  },\n  {\n    path: \"adoption.{metricVersion,adoptedUsages,ownableUsages}\",\n    type: \"versioned component-identity usage counts\",\n    purpose: \"Records the exact numerator and denominator used for adoption history.\",\n    carriage: \"derived\",\n    topLevelField: \"adoption\",\n  },\n  {\n    path: \"adoption.shadows[].{componentKey,displayName,canonicalTarget,usageCount}\",\n    type: \"bounded component-identity summaries\",\n    purpose:\n      \"Explains which shadow components are moving the adoption curve without uploading source.\",\n    carriage: \"derived\",\n    topLevelField: \"adoption\",\n  },\n  {\n    path: \"health.{metricVersion,checkedSites,violatingSites}\",\n    type: \"versioned contract-site counts\",\n    purpose:\n      \"Records how many sites contract-scope rules inspected and how many distinct sites carried a finding.\",\n    carriage: \"derived\",\n    topLevelField: \"health\",\n  },\n  {\n    path: \"health.populations.{componentUsages,tokenReferences}\",\n    type: \"per-population site counts\",\n    purpose: \"Names the measured populations behind the checked-site denominator.\",\n    carriage: \"derived\",\n    topLevelField: \"health\",\n  },\n  {\n    path: \"topology.areaImpact[].{areaId,areaName,beforeOpen,afterOpen,introduced,persistent,resolved}\",\n    type: \"area identifiers and before/after counts\",\n    purpose: \"Reports bounded product-area impact totals.\",\n    carriage: \"derived\",\n    topLevelField: \"topology\",\n  },\n  {\n    path: \"contractHash\",\n    type: \"64-character FCID\",\n    purpose: \"Pins the exact compiled contract enforced by the run.\",\n    carriage: \"derived\",\n    topLevelField: \"contractHash\",\n  },\n  {\n    path: \"source\",\n    type: '\"ci\"',\n    purpose: \"Identifies the report producer.\",\n    carriage: \"none\",\n    topLevelField: \"source\",\n  },\n  {\n    path: \"gateRung\",\n    type: '\"ci\" | \"cli\"',\n    purpose: \"Identifies the enforcement rung that produced the verdict.\",\n    carriage: \"none\",\n    topLevelField: \"gateRung\",\n  },\n  {\n    path: \"diffOnly\",\n    type: \"boolean\",\n    purpose: \"States whether the scan was restricted to changed files.\",\n    carriage: \"none\",\n    topLevelField: \"diffOnly\",\n  },\n  {\n    path: \"failOnWarnings\",\n    type: \"boolean\",\n    purpose: \"States whether warnings were gating for this run.\",\n    carriage: \"none\",\n    topLevelField: \"failOnWarnings\",\n  },\n] as const satisfies readonly GovernanceTelemetryField[];\n\nexport const GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE =\n  \"The report carries source text in named fields: offending literals, messages that may quote them, structured rule facts, authored suppression and bypass reasons, and compiled package vocabulary. It never uploads whole files, whole source lines or function bodies.\";\n"],"mappings":";AAsBO,IAAM,wCAAwC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,IAAM,8BAA8B;AAAA,EACzC;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,yCACX;","names":[]}
+{"version":3,"sources":["../src/governance-telemetry.ts"],"sourcesContent":["/**\n * Public disclosure contract for `fragments-governance-report:v1`.\n *\n * Brace groups enumerate closed sibling fields without hiding additions behind\n * `*`. The three named placeholder fields are the only intentionally open\n * records: configured ignore reasons, configured categories, and rule-specific\n * evidence facts.\n */\nexport type GovernanceTelemetryCarriage =\n  | \"none\"\n  | \"derived\"\n  | \"source-literal\"\n  | \"structured-source\";\n\nexport interface GovernanceTelemetryField {\n  path: string;\n  type: string;\n  purpose: string;\n  carriage: GovernanceTelemetryCarriage;\n  topLevelField: GovernanceTelemetryTopLevelField;\n}\n\nexport const GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS = [\n  \"contractHash\",\n  \"schemaVersion\",\n  \"generatedAt\",\n  \"root\",\n  \"hook\",\n  \"git\",\n  \"summary\",\n  \"groups\",\n  \"suppressions\",\n  \"bypassEvents\",\n  \"hookEvents\",\n  \"packageVocabularies\",\n  \"adoption\",\n  \"health\",\n  \"topology\",\n  \"source\",\n  \"gateRung\",\n  \"diffOnly\",\n  \"failOnWarnings\",\n] as const;\n\nexport type GovernanceTelemetryTopLevelField =\n  (typeof GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS)[number];\n\nexport const GOVERNANCE_TELEMETRY_FIELDS = [\n  {\n    path: \"schemaVersion\",\n    type: '\"fragments-governance-report:v1\"',\n    purpose: \"Pins the accepted wire shape and compatibility policy.\",\n    carriage: \"none\",\n    topLevelField: \"schemaVersion\",\n  },\n  {\n    path: \"generatedAt\",\n    type: \"ISO-8601 string\",\n    purpose: \"Records when the CLI produced the report.\",\n    carriage: \"none\",\n    topLevelField: \"generatedAt\",\n  },\n  {\n    path: \"root.{workspaceRoot,packageRoot,packageName}\",\n    type: \"string fields\",\n    purpose: \"Identifies the scanned workspace and package roots.\",\n    carriage: \"none\",\n    topLevelField: \"root\",\n  },\n  {\n    path: \"hook.{installedAt,mode,agents[]}\",\n    type: \"installation metadata\",\n    purpose: \"Describes the local hook installation that produced evidence.\",\n    carriage: \"none\",\n    topLevelField: \"hook\",\n  },\n  {\n    path: \"git.{baseRef,headSha,branch,repoFullName,pullRequestNumber}\",\n    type: \"Git and provider identifiers\",\n    purpose: \"Attaches results to the correct repository, commit and pull request.\",\n    carriage: \"none\",\n    topLevelField: \"git\",\n  },\n  {\n    path: \"summary.{filesScanned,rulesActive,presetsLoaded[],groupCount,occurrenceCount,ignoredCount,classnamesScanned,classnamesDynamic,classnamesResolved,totalFindings,errorCount,warnCount,infoCount,passed}\",\n    type: \"counts, verdict and active preset names\",\n    purpose: \"Reports scan volume and result totals without finding rows.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.ignoredByReason.{reason}\",\n    type: \"configured reason name → count\",\n    purpose: \"Counts ignored findings by the reason configured by the repository.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsBySeverity.{error,warn,info}\",\n    type: \"severity counts\",\n    purpose: \"Counts findings in each fixed severity bucket.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsByCategory.{category}\",\n    type: \"configured category name → count\",\n    purpose: \"Counts findings by the rule categories present in the scan.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.{status,declared,fatalForCi,blockingCapable,summary}\",\n    type: \"governance-integrity verdict\",\n    purpose: \"Explains whether the resolved policy is capable of enforcement.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.families[].{id,armed,reason,remediation}\",\n    type: \"integrity-family status\",\n    purpose: \"Explains the enforcement readiness of each governance family.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.families[].rules[]\",\n    type: \"rule identifiers\",\n    purpose: \"Names the active rules contributing to an integrity family.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.armed[]\",\n    type: \"integrity-family identifiers\",\n    purpose: \"Names the governance families capable of enforcement.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.remediations[]\",\n    type: \"remediation messages\",\n    purpose: \"Explains how to make an inert or degraded policy effective.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.configDiagnostics[].{code,kind,severity,path,message}\",\n    type: \"configuration diagnostics\",\n    purpose: \"Reports inert or conflicting authored governance configuration.\",\n    carriage: \"structured-source\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.integrity.roster.{configured,active,inert}\",\n    type: \"rule roster counts\",\n    purpose: \"Counts configured, active and inert governance rules.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"summary.countsByBaselineState.{baselined,new}\",\n    type: \"baseline-state counts\",\n    purpose: \"Separates accepted baseline debt from newly introduced findings.\",\n    carriage: \"derived\",\n    topLevelField: \"summary\",\n  },\n  {\n    path: \"groups[].{groupId,ruleId,category,severity,packageRoot,filePath}\",\n    type: \"finding group metadata\",\n    purpose: \"Identifies each grouped rule failure and repository-relative path.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].message\",\n    type: \"string\",\n    purpose: \"Explains the failure and may quote the offending source literal.\",\n    carriage: \"source-literal\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.kind\",\n    type: \"normalized-offense category\",\n    purpose: \"Names the kind of source offense represented by the group.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.raw\",\n    type: \"normalized source offense\",\n    purpose: \"Carries the exact offending source substring.\",\n    carriage: \"source-literal\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].normalizedOffense.canonical\",\n    type: \"normalized source offense\",\n    purpose: \"Carries the derived canonical representation of the offense.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].occurrenceId\",\n    type: \"stable occurrence identifier\",\n    purpose: \"Identifies one occurrence within a finding group.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].location.{file,line,column,endLine,endColumn}\",\n    type: \"repository-relative location\",\n    purpose: \"Places each occurrence at its exact file/line/column range.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].area.{areaId,areaName,criticality,owners[],matchedGlob}\",\n    type: \"area identifiers, owners and criticality\",\n    purpose: \"Carries the configured product-area classification for the file.\",\n    carriage: \"structured-source\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].factId\",\n    type: \"fact identifier\",\n    purpose: \"Links the occurrence to the extracted fact supporting it.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.kind\",\n    type: \"fact discriminator\",\n    purpose: \"Names the extracted rule-fact shape.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.location.{file,line,column,endLine,endColumn}\",\n    type: \"repository-relative location\",\n    purpose: \"Locates the source-backed fact used as evidence.\",\n    carriage: \"none\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].occurrences[].evidence[].fact.{ruleSpecificField}\",\n    type: \"extensible rule-specific fact fields\",\n    purpose:\n      \"Carries rule-specific parsed facts; fields may include selectors, properties and source values.\",\n    carriage: \"structured-source\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].suggestedReplacement.{kind,from,to,certainty,reason}\",\n    type: \"deterministic replacement\",\n    purpose: \"Carries the deterministic replacement the CLI can apply.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"groups[].suggestedReplacement.edit.{file,start,end,replacement}\",\n    type: \"deterministic edit range\",\n    purpose: \"Locates and describes the exact edit the CLI can apply.\",\n    carriage: \"derived\",\n    topLevelField: \"groups\",\n  },\n  {\n    path: \"suppressions[].{id,kind,file,line,column,code,expiresOn,attachedLine,attachedTo,directive}\",\n    type: \"directive identity, location and attachment metadata\",\n    purpose: \"Reports matched in-source governance directives.\",\n    carriage: \"none\",\n    topLevelField: \"suppressions\",\n  },\n  {\n    path: \"suppressions[].reason\",\n    type: \"authored directive reason\",\n    purpose: \"Carries the repository-authored reason for the suppression.\",\n    carriage: \"source-literal\",\n    topLevelField: \"suppressions\",\n  },\n  {\n    path: \"bypassEvents[].{code,file,line}\",\n    type: \"rule code and source location\",\n    purpose: \"Records directives that actually bypassed a finding in this run.\",\n    carriage: \"none\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"bypassEvents[].reason\",\n    type: \"authored directive reason\",\n    purpose: \"Carries the repository-authored reason for the bypass.\",\n    carriage: \"source-literal\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"bypassEvents[].area.{areaId,areaName,criticality,matchedGlob}\",\n    type: \"configured product-area metadata\",\n    purpose: \"Classifies the bypass by its configured product area.\",\n    carriage: \"structured-source\",\n    topLevelField: \"bypassEvents\",\n  },\n  {\n    path: \"hookEvents[].{eventId,kind,ruleId,code,file,mode,agent,timestamp,reasonClass}\",\n    type: \"bounded hook decision receipts\",\n    purpose: \"Reports deny, downgrade, suppression and fail-open decisions.\",\n    carriage: \"none\",\n    topLevelField: \"hookEvents\",\n  },\n  {\n    path: \"packageVocabularies[].{source,packageName,status,manifestPath,digest,commit}\",\n    type: \"compiled canonical-package vocabulary records\",\n    purpose: \"Publishes package vocabulary proposed by authoritative local discovery.\",\n    carriage: \"structured-source\",\n    topLevelField: \"packageVocabularies\",\n  },\n  {\n    path: \"packageVocabularies[].roots[].{name,members[]}\",\n    type: \"compiled component roots and members\",\n    purpose: \"Publishes the canonical component vocabulary discovered from the package.\",\n    carriage: \"structured-source\",\n    topLevelField: \"packageVocabularies\",\n  },\n  {\n    path: \"adoption.{metricVersion,adoptedUsages,ownableUsages}\",\n    type: \"versioned component-identity usage counts\",\n    purpose: \"Records the exact numerator and denominator used for adoption history.\",\n    carriage: \"derived\",\n    topLevelField: \"adoption\",\n  },\n  {\n    path: \"adoption.adopted[].{componentKey,displayName,canonicalTarget,usageCount}\",\n    type: \"bounded adopted component-identity summaries\",\n    purpose:\n      \"Explains which canonical components account for current adopted call sites without uploading source.\",\n    carriage: \"derived\",\n    topLevelField: \"adoption\",\n  },\n  {\n    path: \"adoption.shadows[].{componentKey,displayName,canonicalTarget,usageCount}\",\n    type: \"bounded component-identity summaries\",\n    purpose:\n      \"Explains which shadow components are moving the adoption curve without uploading source.\",\n    carriage: \"derived\",\n    topLevelField: \"adoption\",\n  },\n  {\n    path: \"health.{metricVersion,checkedSites,violatingSites}\",\n    type: \"versioned contract-site counts\",\n    purpose:\n      \"Records how many sites contract-scope rules inspected and how many distinct sites carried a finding.\",\n    carriage: \"derived\",\n    topLevelField: \"health\",\n  },\n  {\n    path: \"health.populations.{componentUsages,tokenReferences}\",\n    type: \"per-population site counts\",\n    purpose: \"Names the measured populations behind the checked-site denominator.\",\n    carriage: \"derived\",\n    topLevelField: \"health\",\n  },\n  {\n    path: \"topology.areaImpact[].{areaId,areaName,beforeOpen,afterOpen,introduced,persistent,resolved}\",\n    type: \"area identifiers and before/after counts\",\n    purpose: \"Reports bounded product-area impact totals.\",\n    carriage: \"derived\",\n    topLevelField: \"topology\",\n  },\n  {\n    path: \"contractHash\",\n    type: \"64-character FCID\",\n    purpose: \"Pins the exact compiled contract enforced by the run.\",\n    carriage: \"derived\",\n    topLevelField: \"contractHash\",\n  },\n  {\n    path: \"source\",\n    type: '\"ci\"',\n    purpose: \"Identifies the report producer.\",\n    carriage: \"none\",\n    topLevelField: \"source\",\n  },\n  {\n    path: \"gateRung\",\n    type: '\"ci\" | \"cli\"',\n    purpose: \"Identifies the enforcement rung that produced the verdict.\",\n    carriage: \"none\",\n    topLevelField: \"gateRung\",\n  },\n  {\n    path: \"diffOnly\",\n    type: \"boolean\",\n    purpose: \"States whether the scan was restricted to changed files.\",\n    carriage: \"none\",\n    topLevelField: \"diffOnly\",\n  },\n  {\n    path: \"failOnWarnings\",\n    type: \"boolean\",\n    purpose: \"States whether warnings were gating for this run.\",\n    carriage: \"none\",\n    topLevelField: \"failOnWarnings\",\n  },\n] as const satisfies readonly GovernanceTelemetryField[];\n\nexport const GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE =\n  \"The report carries source text in named fields: offending literals, messages that may quote them, structured rule facts, authored suppression and bypass reasons, and compiled package vocabulary. It never uploads whole files, whole source lines or function bodies.\";\n"],"mappings":";AAsBO,IAAM,wCAAwC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,IAAM,8BAA8B;AAAA,EACzC;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,yCACX;","names":[]}

package/dist/chunk-7ULGH74M.js

@@ -0,0 +1,66 @@
+import {
+  contractHash
+} from "./chunk-PWIJMOI4.js";
+
+// src/contract/manifest.ts
+import { z } from "zod";
+var FRAGMENTS_MANIFEST_FILENAME = "fragments.manifest.json";
+var FRAGMENTS_MANIFEST_SCHEMA_VERSION = 1;
+var FRAGMENTS_MANIFEST_TOKEN_RULE = "no-raw-values";
+var fragmentsManifestPrimitiveSchema = z.object({
+  name: z.string().min(1),
+  members: z.array(z.string()),
+  intents: z.array(z.string()),
+  props: z.array(z.string()),
+  do: z.array(z.string()),
+  dont: z.array(z.string()),
+  exemplar: z.string().min(1).optional()
+});
+var fragmentsManifestPatternSchema = z.object({
+  name: z.string().min(1),
+  intent: z.string(),
+  primitives: z.array(z.string()),
+  shape: z.string(),
+  exemplar: z.string().min(1).optional()
+});
+var fragmentsManifestGrammarSchema = z.object({
+  rule: z.string().min(1),
+  check: z.string().min(1).optional()
+});
+var fragmentsManifestSchema = z.object({
+  schemaVersion: z.literal(FRAGMENTS_MANIFEST_SCHEMA_VERSION),
+  designSystem: z.object({
+    packageName: z.string().min(1),
+    importPath: z.string().min(1)
+  }),
+  tokens: z.object({
+    prefix: z.string().min(1),
+    rule: z.literal(FRAGMENTS_MANIFEST_TOKEN_RULE)
+  }),
+  primitives: z.array(fragmentsManifestPrimitiveSchema),
+  patterns: z.array(fragmentsManifestPatternSchema),
+  grammar: z.array(fragmentsManifestGrammarSchema),
+  rules: z.object({
+    preset: z.string().min(1),
+    off: z.array(z.string())
+  })
+});
+function parseFragmentsManifest(input) {
+  return fragmentsManifestSchema.parse(input);
+}
+function fragmentsManifestFcid(manifest) {
+  return contractHash(manifest);
+}
+
+export {
+  FRAGMENTS_MANIFEST_FILENAME,
+  FRAGMENTS_MANIFEST_SCHEMA_VERSION,
+  FRAGMENTS_MANIFEST_TOKEN_RULE,
+  fragmentsManifestPrimitiveSchema,
+  fragmentsManifestPatternSchema,
+  fragmentsManifestGrammarSchema,
+  fragmentsManifestSchema,
+  parseFragmentsManifest,
+  fragmentsManifestFcid
+};
+//# sourceMappingURL=chunk-7ULGH74M.js.map

package/dist/chunk-7ULGH74M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contract/manifest.ts"],"sourcesContent":["/**\n * Design-system manifest v1 — the committed, human-curated vocabulary that\n * every local agent surface reads. FCID is `contractHash(manifest)`.\n */\n\nimport { z } from \"zod\";\n\nimport { contractHash } from \"./hash.js\";\n\nexport const FRAGMENTS_MANIFEST_FILENAME = \"fragments.manifest.json\";\nexport const FRAGMENTS_MANIFEST_SCHEMA_VERSION = 1;\nexport const FRAGMENTS_MANIFEST_TOKEN_RULE = \"no-raw-values\";\n\nexport const fragmentsManifestPrimitiveSchema = z.object({\n  name: z.string().min(1),\n  members: z.array(z.string()),\n  intents: z.array(z.string()),\n  props: z.array(z.string()),\n  do: z.array(z.string()),\n  dont: z.array(z.string()),\n  exemplar: z.string().min(1).optional(),\n});\n\nexport const fragmentsManifestPatternSchema = z.object({\n  name: z.string().min(1),\n  intent: z.string(),\n  primitives: z.array(z.string()),\n  shape: z.string(),\n  exemplar: z.string().min(1).optional(),\n});\n\nexport const fragmentsManifestGrammarSchema = z.object({\n  rule: z.string().min(1),\n  check: z.string().min(1).optional(),\n});\n\nexport const fragmentsManifestSchema = z.object({\n  schemaVersion: z.literal(FRAGMENTS_MANIFEST_SCHEMA_VERSION),\n  designSystem: z.object({\n    packageName: z.string().min(1),\n    importPath: z.string().min(1),\n  }),\n  tokens: z.object({\n    prefix: z.string().min(1),\n    rule: z.literal(FRAGMENTS_MANIFEST_TOKEN_RULE),\n  }),\n  primitives: z.array(fragmentsManifestPrimitiveSchema),\n  patterns: z.array(fragmentsManifestPatternSchema),\n  grammar: z.array(fragmentsManifestGrammarSchema),\n  rules: z.object({\n    preset: z.string().min(1),\n    off: z.array(z.string()),\n  }),\n});\n\nexport type FragmentsManifestPrimitive = z.infer<typeof fragmentsManifestPrimitiveSchema>;\nexport type FragmentsManifestPattern = z.infer<typeof fragmentsManifestPatternSchema>;\nexport type FragmentsManifestGrammar = z.infer<typeof fragmentsManifestGrammarSchema>;\nexport type FragmentsManifest = z.infer<typeof fragmentsManifestSchema>;\n\nexport function parseFragmentsManifest(input: unknown): FragmentsManifest {\n  return fragmentsManifestSchema.parse(input);\n}\n\n/** FCID for a parsed manifest: content-address, key-order independent. */\nexport function fragmentsManifestFcid(manifest: FragmentsManifest): string {\n  return contractHash(manifest);\n}\n"],"mappings":";;;;;AAKA,SAAS,SAAS;AAIX,IAAM,8BAA8B;AACpC,IAAM,oCAAoC;AAC1C,IAAM,gCAAgC;AAEtC,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACzB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACtB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACvC,CAAC;AAEM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACvC,CAAC;AAEM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACpC,CAAC;AAEM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,eAAe,EAAE,QAAQ,iCAAiC;AAAA,EAC1D,cAAc,EAAE,OAAO;AAAA,IACrB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACxB,MAAM,EAAE,QAAQ,6BAA6B;AAAA,EAC/C,CAAC;AAAA,EACD,YAAY,EAAE,MAAM,gCAAgC;AAAA,EACpD,UAAU,EAAE,MAAM,8BAA8B;AAAA,EAChD,SAAS,EAAE,MAAM,8BAA8B;AAAA,EAC/C,OAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACxB,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACzB,CAAC;AACH,CAAC;AAOM,SAAS,uBAAuB,OAAmC;AACxE,SAAO,wBAAwB,MAAM,KAAK;AAC5C;AAGO,SAAS,sBAAsB,UAAqC;AACzE,SAAO,aAAa,QAAQ;AAC9B;","names":[]}

package/dist/{chunk-YF65VYRY.js → chunk-ML5S6QNU.js}

@@ -1,173 +1,14 @@
 import {
   portableRepoPathError
 } from "./chunk-EIYNNS77.js";
+import {
+  canonicalPreimage,
+  contractHash,
+  sha256Hex
+} from "./chunk-PWIJMOI4.js";
 
 // src/registry.ts
 import { z } from "zod";
-
-// src/contract/hash.ts
-function normalizeNumber(value) {
-  if (Number.isNaN(value)) return '"@num:nan"';
-  if (value === Infinity) return '"@num:+inf"';
-  if (value === -Infinity) return '"@num:-inf"';
-  if (Object.is(value, -0)) return "0";
-  return JSON.stringify(value);
-}
-function canonicalPreimage(value) {
-  if (value === void 0 || value === null) return "null";
-  const type = typeof value;
-  if (type === "number") return normalizeNumber(value);
-  if (type === "string" || type === "boolean") return JSON.stringify(value);
-  if (type === "bigint") return JSON.stringify(value.toString());
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalPreimage).join(",")}]`;
-  }
-  if (type !== "object") {
-    return "null";
-  }
-  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalPreimage(v)}`).join(",")}}`;
-}
-var K = new Uint32Array([
-  1116352408,
-  1899447441,
-  3049323471,
-  3921009573,
-  961987163,
-  1508970993,
-  2453635748,
-  2870763221,
-  3624381080,
-  310598401,
-  607225278,
-  1426881987,
-  1925078388,
-  2162078206,
-  2614888103,
-  3248222580,
-  3835390401,
-  4022224774,
-  264347078,
-  604807628,
-  770255983,
-  1249150122,
-  1555081692,
-  1996064986,
-  2554220882,
-  2821834349,
-  2952996808,
-  3210313671,
-  3336571891,
-  3584528711,
-  113926993,
-  338241895,
-  666307205,
-  773529912,
-  1294757372,
-  1396182291,
-  1695183700,
-  1986661051,
-  2177026350,
-  2456956037,
-  2730485921,
-  2820302411,
-  3259730800,
-  3345764771,
-  3516065817,
-  3600352804,
-  4094571909,
-  275423344,
-  430227734,
-  506948616,
-  659060556,
-  883997877,
-  958139571,
-  1322822218,
-  1537002063,
-  1747873779,
-  1955562222,
-  2024104815,
-  2227730452,
-  2361852424,
-  2428436474,
-  2756734187,
-  3204031479,
-  3329325298
-]);
-function rotr(value, bits) {
-  return (value >>> bits | value << 32 - bits) >>> 0;
-}
-function sha256Hex(message) {
-  const bytes = new TextEncoder().encode(message);
-  const length = bytes.length;
-  const bitLength = length * 8;
-  const withMarker = length + 1;
-  const zeroPad = (56 - withMarker % 64 + 64) % 64;
-  const total = withMarker + zeroPad + 8;
-  const buffer = new Uint8Array(total);
-  buffer.set(bytes, 0);
-  buffer[length] = 128;
-  const view = new DataView(buffer.buffer);
-  view.setUint32(total - 8, Math.floor(bitLength / 4294967296));
-  view.setUint32(total - 4, bitLength >>> 0);
-  let h0 = 1779033703;
-  let h1 = 3144134277;
-  let h2 = 1013904242;
-  let h3 = 2773480762;
-  let h4 = 1359893119;
-  let h5 = 2600822924;
-  let h6 = 528734635;
-  let h7 = 1541459225;
-  const w = new Uint32Array(64);
-  for (let chunk = 0; chunk < total; chunk += 64) {
-    for (let t = 0; t < 16; t++) w[t] = view.getUint32(chunk + t * 4);
-    for (let t = 16; t < 64; t++) {
-      const w15 = w[t - 15];
-      const w2 = w[t - 2];
-      const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
-      const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
-      w[t] = w[t - 16] + s0 + w[t - 7] + s1 >>> 0;
-    }
-    let a = h0;
-    let b = h1;
-    let c = h2;
-    let d = h3;
-    let e = h4;
-    let f = h5;
-    let g = h6;
-    let h = h7;
-    for (let t = 0; t < 64; t++) {
-      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
-      const ch = e & f ^ ~e & g;
-      const temp1 = h + s1 + ch + K[t] + w[t] >>> 0;
-      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
-      const maj = a & b ^ a & c ^ b & c;
-      const temp2 = s0 + maj >>> 0;
-      h = g;
-      g = f;
-      f = e;
-      e = d + temp1 >>> 0;
-      d = c;
-      c = b;
-      b = a;
-      a = temp1 + temp2 >>> 0;
-    }
-    h0 = h0 + a >>> 0;
-    h1 = h1 + b >>> 0;
-    h2 = h2 + c >>> 0;
-    h3 = h3 + d >>> 0;
-    h4 = h4 + e >>> 0;
-    h5 = h5 + f >>> 0;
-    h6 = h6 + g >>> 0;
-    h7 = h7 + h >>> 0;
-  }
-  return [h0, h1, h2, h3, h4, h5, h6, h7].map((value) => value.toString(16).padStart(8, "0")).join("");
-}
-function contractHash(body) {
-  return sha256Hex(canonicalPreimage(body));
-}
-
-// src/registry.ts
 var REGISTRY_MANIFEST_SCHEMA_VERSION = "fragments.registry.v1";
 var REGISTRY_ARTIFACT_SCHEMA_VERSION = "fragments.registry-artifact.v1";
 var REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION = "fragments.registry-lock.v1";
@@ -289,6 +130,8 @@ var registryManifestBaseSchema = z.object({
   generatedAt: z.string().datetime(),
   source: registrySourceSchema,
   packageFiles: z.array(registryFileSchema).default([]),
+  /** Files every install writes, whatever the selection: the stylesheet entry and its closure. */
+  baseFiles: z.array(registryFileSchema).default([]),
   entrypoints: z.array(registryEntrypointSchema).default([]),
   components: z.record(z.string(), registryComponentSchema),
   dependencies: z.array(registryDependencySchema).default([]),
@@ -315,6 +158,7 @@ var registryArtifactSchema = z.object({
   }
   const manifestFiles = [
     ...artifact.manifest.packageFiles,
+    ...artifact.manifest.baseFiles,
     ...artifact.manifest.entrypoints.map((entrypoint) => ({
       path: entrypoint.sourcePath,
       role: "barrel",
@@ -456,11 +300,176 @@ function registryArtifactDigest(artifact) {
 function registryManifestCanonicalPreimage(manifest) {
   return canonicalPreimage(registryHashPayload(manifest));
 }
+var REGISTRY_INDEX_SCHEMA_VERSION = "fragments.registry-index.v2";
+var REGISTRY_SHARD_SCHEMA_VERSION = "fragments.registry-shard.v2";
+var registryShardPathSchema = registryFilePathSchema.superRefine((value, ctx) => {
+  if (!value.endsWith(".json")) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Shard path must end with .json" });
+  }
+});
+var registryShardSchema = z.object({
+  schemaVersion: z.literal(REGISTRY_SHARD_SCHEMA_VERSION),
+  files: z.record(z.string().min(1), registryFileContentSchema)
+}).superRefine((shard, ctx) => {
+  for (const [contentRef, file] of Object.entries(shard.files)) {
+    if (contentRef !== `sha256:${file.sha256}`) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["files", contentRef],
+        message: `Shard key ${contentRef} does not match content hash of ${file.path}`
+      });
+    }
+  }
+});
+var registryIndexSchema = z.object({
+  schemaVersion: z.literal(REGISTRY_INDEX_SCHEMA_VERSION),
+  manifest: registryManifestSchema,
+  /** Shard path (relative to the index) → registry file paths whose bodies it carries. */
+  shards: z.record(registryShardPathSchema, z.array(registryFilePathSchema).min(1))
+}).superRefine((index, ctx) => {
+  const owner = /* @__PURE__ */ new Map();
+  for (const [shardPath, paths] of Object.entries(index.shards)) {
+    for (const path of paths) {
+      const existing = owner.get(path);
+      if (existing) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["shards", shardPath],
+          message: `Registry file ${path} is listed in both ${existing} and ${shardPath}`
+        });
+      }
+      owner.set(path, shardPath);
+    }
+  }
+  for (const path of registryManifestFilePaths(index.manifest)) {
+    if (!owner.has(path)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["shards"],
+        message: `Registry file ${path} is not carried by any shard`
+      });
+    }
+  }
+});
+var REGISTRY_POINTER_SCHEMA_VERSION = "fragments.registry-pointer.v1";
+var registryPointerSchema = z.object({
+  schemaVersion: z.literal(REGISTRY_POINTER_SCHEMA_VERSION),
+  registryId: z.string().min(1),
+  version: z.string().min(1),
+  registryHash: sha256Schema,
+  index: registryShardPathSchema,
+  generatedAt: z.string().datetime()
+});
+function buildRegistryPointer(index, indexPath) {
+  return registryPointerSchema.parse({
+    schemaVersion: REGISTRY_POINTER_SCHEMA_VERSION,
+    registryId: index.manifest.registryId,
+    version: index.manifest.version,
+    registryHash: index.manifest.registryHash,
+    index: indexPath,
+    generatedAt: index.manifest.generatedAt
+  });
+}
+function registryManifestFilePaths(manifest) {
+  return [...registryManifestFileMetadata(manifest).keys()].sort(
+    (left, right) => left.localeCompare(right)
+  );
+}
+function registryManifestFileMetadata(manifest) {
+  const files = /* @__PURE__ */ new Map();
+  const add = (file) => {
+    if (!files.get(file.path)) files.set(file.path, file);
+  };
+  manifest.packageFiles.forEach(add);
+  manifest.baseFiles.forEach(add);
+  for (const component of Object.values(manifest.components)) component.files.forEach(add);
+  for (const entrypoint of manifest.entrypoints) {
+    if (!files.has(entrypoint.sourcePath)) files.set(entrypoint.sourcePath, null);
+  }
+  return files;
+}
+function defaultRegistryShardPath(path) {
+  const componentMatch = /^src\/components\/([^/]+)\//.exec(path);
+  if (componentMatch) return `components/${componentMatch[1]}.json`;
+  if (!path.startsWith("src/")) return "shared/package.json";
+  const segments = path.slice("src/".length).split("/");
+  return segments.length > 1 ? `shared/${segments[0]}.json` : "shared/src.json";
+}
+function shardKeyFor(metadata, sha256) {
+  return metadata?.contentRef ?? `sha256:${sha256}`;
+}
+function shardRegistryArtifact(artifact, shardPathFor = defaultRegistryShardPath) {
+  const metadata = registryManifestFileMetadata(artifact.manifest);
+  const shards = /* @__PURE__ */ new Map();
+  const shardPaths = {};
+  for (const [path, content] of Object.entries(artifact.files).sort(
+    ([left], [right]) => left.localeCompare(right)
+  )) {
+    const shardPath = shardPathFor(path);
+    const shard = shards.get(shardPath) ?? {
+      schemaVersion: REGISTRY_SHARD_SCHEMA_VERSION,
+      files: {}
+    };
+    shard.files[shardKeyFor(metadata.get(path), content.sha256)] = content;
+    shards.set(shardPath, shard);
+    (shardPaths[shardPath] ??= []).push(path);
+  }
+  const index = registryIndexSchema.parse({
+    schemaVersion: REGISTRY_INDEX_SCHEMA_VERSION,
+    manifest: artifact.manifest,
+    shards: shardPaths
+  });
+  for (const [path, shard] of shards) shards.set(path, registryShardSchema.parse(shard));
+  return { index, shards };
+}
+function shardOwnerMap(index) {
+  const owner = /* @__PURE__ */ new Map();
+  for (const [shardPath, paths] of Object.entries(index.shards)) {
+    for (const path of paths) owner.set(path, shardPath);
+  }
+  return owner;
+}
+function registryShardsForPaths(index, paths) {
+  const owner = shardOwnerMap(index);
+  const shards = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const shardPath = owner.get(path);
+    if (!shardPath) throw new Error(`Registry index has no shard for ${path}`);
+    shards.add(shardPath);
+  }
+  return [...shards].sort((left, right) => left.localeCompare(right));
+}
+function assembleRegistryArtifact(args) {
+  const metadata = registryManifestFileMetadata(args.index.manifest);
+  const owner = shardOwnerMap(args.index);
+  const files = {};
+  for (const path of [...new Set(args.paths)].sort((left, right) => left.localeCompare(right))) {
+    const shardPath = owner.get(path);
+    if (!shardPath) throw new Error(`Registry index has no shard for ${path}`);
+    const shard = args.shards.get(shardPath);
+    if (!shard) throw new Error(`Registry shard ${shardPath} was not loaded (needed for ${path})`);
+    const expected = metadata.get(path) ?? null;
+    const content = expected ? shard.files[expected.contentRef] : Object.values(shard.files).find((file) => file.path === path);
+    if (!content || content.path !== path) {
+      throw new Error(`Registry shard ${shardPath} is missing content for ${path}`);
+    }
+    const actualSha256 = hashRegistryFileContent(content.content);
+    const actualSize = registryFileSize(content.content);
+    const expectedSha256 = expected?.sha256 ?? content.sha256;
+    const expectedSize = expected?.size ?? content.size;
+    if (actualSha256 !== expectedSha256 || actualSize !== expectedSize) {
+      throw new Error(`Registry shard ${shardPath} content for ${path} does not match the index`);
+    }
+    files[path] = content;
+  }
+  return {
+    schemaVersion: REGISTRY_ARTIFACT_SCHEMA_VERSION,
+    manifest: args.index.manifest,
+    files
+  };
+}
 
 export {
-  canonicalPreimage,
-  sha256Hex,
-  contractHash,
   REGISTRY_MANIFEST_SCHEMA_VERSION,
   REGISTRY_ARTIFACT_SCHEMA_VERSION,
   REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
@@ -488,6 +497,19 @@ export {
   buildRegistryArtifact,
   assertValidRegistryArtifact,
   registryArtifactDigest,
-  registryManifestCanonicalPreimage
+  registryManifestCanonicalPreimage,
+  REGISTRY_INDEX_SCHEMA_VERSION,
+  REGISTRY_SHARD_SCHEMA_VERSION,
+  registryShardSchema,
+  registryIndexSchema,
+  REGISTRY_POINTER_SCHEMA_VERSION,
+  registryPointerSchema,
+  buildRegistryPointer,
+  registryManifestFilePaths,
+  registryManifestFileMetadata,
+  defaultRegistryShardPath,
+  shardRegistryArtifact,
+  registryShardsForPaths,
+  assembleRegistryArtifact
 };
-//# sourceMappingURL=chunk-YF65VYRY.js.map
+//# sourceMappingURL=chunk-ML5S6QNU.js.map