@usefragments/core 1.10.2 → 2.0.0

package/dist/index.js

@@ -1,15 +1,80 @@
+import {
+  FRAGMENTS_MANIFEST_FILENAME,
+  FRAGMENTS_MANIFEST_SCHEMA_VERSION,
+  FRAGMENTS_MANIFEST_TOKEN_RULE,
+  fragmentsManifestFcid,
+  fragmentsManifestGrammarSchema,
+  fragmentsManifestPatternSchema,
+  fragmentsManifestPrimitiveSchema,
+  fragmentsManifestSchema,
+  parseFragmentsManifest
+} from "./chunk-7ULGH74M.js";
+import {
+  REGISTRY_ARTIFACT_SCHEMA_VERSION,
+  REGISTRY_INDEX_SCHEMA_VERSION,
+  REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
+  REGISTRY_MANIFEST_SCHEMA_VERSION,
+  REGISTRY_POINTER_SCHEMA_VERSION,
+  REGISTRY_SHARD_SCHEMA_VERSION,
+  assembleRegistryArtifact,
+  assertValidRegistryArtifact,
+  buildRegistryArtifact,
+  buildRegistryFile,
+  buildRegistryPointer,
+  computeRegistryHash,
+  defaultRegistryShardPath,
+  finalizeRegistryManifest,
+  hashRegistryFileContent,
+  registryArtifactDigest,
+  registryArtifactSchema,
+  registryComponentExportSchema,
+  registryComponentSchema,
+  registryDependencySchema,
+  registryDependencyTypeSchema,
+  registryEntrypointSchema,
+  registryFileContentSchema,
+  registryFileRoleSchema,
+  registryFileSchema,
+  registryFileSize,
+  registryIndexSchema,
+  registryInstallProfileSchema,
+  registryInstallReceiptComponentSchema,
+  registryInstallReceiptFileSchema,
+  registryInstallReceiptSchema,
+  registryManifestCanonicalPreimage,
+  registryManifestDraftSchema,
+  registryManifestFileMetadata,
+  registryManifestFilePaths,
+  registryManifestSchema,
+  registryPointerSchema,
+  registryShardSchema,
+  registryShardsForPaths,
+  registrySourceSchema,
+  shardRegistryArtifact
+} from "./chunk-ML5S6QNU.js";
+import {
+  GOVERNANCE_TELEMETRY_FIELDS,
+  GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE,
+  GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS
+} from "./chunk-3IOWHECM.js";
 import {
   CompiledFragmentsFileValidationError,
   parseCompiledFragmentsFile
-} from "./chunk-RANPUC6C.js";
-import {
-  generateContext
-} from "./chunk-X34IA4LR.js";
+} from "./chunk-RYFULE43.js";
 import {
   ComponentGraphEngine
 } from "./chunk-SH4KPIYH.js";
+import {
+  resolveArea
+} from "./chunk-MZ2FS7U4.js";
+import {
+  generateContext
+} from "./chunk-X34IA4LR.js";
 import {
   AGENT_FORMAT_SCHEMA_VERSION,
+  CANONICAL_FACT_MAX_CONFLICTS_V1,
+  CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1,
+  CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1,
   CODES,
   EXPLAIN_URL_BASE,
   FactIndex,
@@ -19,12 +84,18 @@ import {
   agentFormatSchema,
   agentIntegritySchema,
   agentOutputSchema,
+  analysisPlanIdFromDigest,
+  analysisPlanIdSchema,
+  analysisPlanIdStringSchema,
   asComponentId,
   bridgeSourceViolation,
   bridgeSourceViolations,
   byCode,
   byRuleId,
   canonicalBridgeV1Schema,
+  canonicalFactConflictV1Schema,
+  canonicalFactConflictValueV1Schema,
+  canonicalFactIntegrityV1Schema,
   canonicalJson,
   compileComponentFacts,
   compileGlobalGovernanceFacts,
@@ -32,6 +103,11 @@ import {
   componentGovernanceRecordsSchema,
   componentId,
   describePolicyExclude,
+  digestHexSchema,
+  digestHexStringSchema,
+  evaluationReceiptIdFromDigest,
+  evaluationReceiptIdSchema,
+  evaluationReceiptIdStringSchema,
   excludeGlobToRegExp,
   explainUrlForCode,
   factEvidenceSchema,
@@ -100,6 +176,8 @@ import {
   markPresetSourcedRules,
   matchPolicyExclude,
   matchesGlob,
+  mintEvaluationReceiptId,
+  normalizeCanonicalFactIntegrityV1,
   normalizeExcludePath,
   normalizeFinding,
   normalizeGovernanceConfig,
@@ -109,24 +187,36 @@ import {
   ownedComponentIdsEqual,
   ownedImportMatchesRoot,
   ownedImportsEqual,
+  parseAnalysisPlanId,
+  parseComponentGovernancePolicyJson,
+  parseDigestHex,
+  parseEvaluationReceiptId,
   policyExcludeMatchesPath,
   policyExcludeSchema,
   projectSupersededImportPathPreferences,
   resolveComponentGovernance,
+  resolveGovernanceRecordsForIdentity,
   ruleFamilyMembers,
   scaleGovernanceRecordSchema,
   suppressionDirectiveSchema,
   validatorResultSchema,
   violationSchema
-} from "./chunk-XN3LSDPY.js";
+} from "./chunk-BMPYIUZE.js";
 import {
-  resolveArea
-} from "./chunk-3LLRNCPX.js";
+  isPortableRepoPath,
+  normalizeConfigPath,
+  portableRepoPathError,
+  resolveConfiguredAppPath,
+  tokenIncludesFromConfig,
+  topologyBase
+} from "./chunk-EIYNNS77.js";
 import {
-  GOVERNANCE_TELEMETRY_FIELDS,
-  GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE,
-  GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS
-} from "./chunk-MZ4SW3TP.js";
+  artifactContentHash,
+  canonicalPreimage,
+  compareCanonicalStrings,
+  contractHash,
+  sha256Hex
+} from "./chunk-PWIJMOI4.js";
 import {
   OWNED_PACKAGE_IDENTITY_EPOCH,
   OWNED_PACKAGE_IDENTITY_SOURCE_SHA256,
@@ -138,53 +228,13 @@ import {
   projectV1OwnedImportIdentity,
   resolveOwnedPackageImport
 } from "./chunk-JNBFJ34I.js";
-import {
-  REGISTRY_ARTIFACT_SCHEMA_VERSION,
-  REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
-  REGISTRY_MANIFEST_SCHEMA_VERSION,
-  assertValidRegistryArtifact,
-  buildRegistryArtifact,
-  buildRegistryFile,
-  canonicalPreimage,
-  computeRegistryHash,
-  contractHash,
-  finalizeRegistryManifest,
-  hashRegistryFileContent,
-  registryArtifactDigest,
-  registryArtifactSchema,
-  registryComponentExportSchema,
-  registryComponentSchema,
-  registryDependencySchema,
-  registryDependencyTypeSchema,
-  registryEntrypointSchema,
-  registryFileContentSchema,
-  registryFileRoleSchema,
-  registryFileSchema,
-  registryFileSize,
-  registryInstallProfileSchema,
-  registryInstallReceiptComponentSchema,
-  registryInstallReceiptFileSchema,
-  registryInstallReceiptSchema,
-  registryManifestCanonicalPreimage,
-  registryManifestDraftSchema,
-  registryManifestSchema,
-  registrySourceSchema,
-  sha256Hex
-} from "./chunk-YF65VYRY.js";
-import {
-  isPortableRepoPath,
-  normalizeConfigPath,
-  portableRepoPathError,
-  resolveConfiguredAppPath,
-  tokenIncludesFromConfig,
-  topologyBase
-} from "./chunk-EIYNNS77.js";
 import {
   SEVERITIES,
   SEVERITY_RANK,
   SEVERITY_WEIGHTS,
   compareSeverity,
   maxSeverity,
+  severityFromLevel,
   severityLevel,
   severitySchema,
   sortBySeverity
@@ -200,8 +250,6 @@ var BRAND = {
   fileExtension: ".contract.json",
   /** Legacy file extension for segments (still supported for migration) */
   legacyFileExtension: ".segment.tsx",
-  /** JSON file extension for compiled output */
-  jsonExtension: ".fragment.json",
   /** Default output file name (e.g., "fragments.json") */
   outFile: "fragments.json",
   /** Config file name (e.g., "fragments.config.ts") */
@@ -238,11 +286,10 @@ var BRAND = {
   mcpToolPrefix: "fragments_",
   /** File extension for block definition files */
   blockFileExtension: ".block.ts",
-  /** @deprecated Use blockFileExtension instead */
-  recipeFileExtension: ".recipe.ts",
   /** Vite plugin namespace */
   vitePluginNamespace: "fragments-core-shim"
 };
+var FRAGMENT_V3_SCHEMA_URL = "https://usefragments.com/schemas/fragment.v3.json";
 var DEFAULTS = {
   /** Default viewport dimensions */
   viewport: {
@@ -741,6 +788,9 @@ function assertPortableRegistryPath(path, label) {
 function joinRegistryPath(...parts) {
   return normalizeRegistryRepoPath(parts.filter(Boolean).join("/"));
 }
+function sortStrings(values) {
+  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
 function sourceToRegistryTargetPath(targetRoot, sourcePath) {
   const source = normalizeRegistryRepoPath(sourcePath);
   const withoutSrc = source.startsWith("src/") ? source.slice("src/".length) : source;
@@ -749,37 +799,69 @@ function sourceToRegistryTargetPath(targetRoot, sourcePath) {
     "Registry install target"
   );
 }
-function selectedRegistryComponentNames(artifact, requested, all) {
-  if (all || requested.includes("*")) {
-    return Object.keys(artifact.manifest.components).sort(
-      (left, right) => left.localeCompare(right)
+function resolveRegistryComponentId(manifest, requested) {
+  if (manifest.components[requested]) return requested;
+  const lowered = requested.toLowerCase();
+  const matches = Object.keys(manifest.components).filter((name) => name.toLowerCase() === lowered);
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) {
+    throw new Error(
+      `Ambiguous registry component ${requested}: matches ${matches.sort().join(", ")}`
     );
   }
-  if (requested.length === 0) {
-    throw new Error("Choose at least one registry component to install.");
+  throw new Error(`Unknown registry component ${requested}`);
+}
+function expandRegistryComponentClosure(manifest, names) {
+  const closure = /* @__PURE__ */ new Set();
+  const queue = [...names];
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (closure.has(name)) continue;
+    const component = manifest.components[name];
+    if (!component) throw new Error(`Unknown registry component ${name}`);
+    closure.add(name);
+    queue.push(...component.internalDependencies);
   }
-  for (const name of requested) {
-    if (!artifact.manifest.components[name]) {
-      throw new Error(`Unknown registry component ${name}`);
-    }
+  return sortStrings(closure);
+}
+function resolveRegistryInstallSelection(input) {
+  const { manifest } = input;
+  if (input.all || input.requestedComponents.includes("*")) {
+    const components2 = sortStrings(Object.keys(manifest.components));
+    return { requested: components2, implied: [], components: components2 };
+  }
+  if (input.requestedComponents.length === 0) {
+    throw new Error("Choose at least one registry component to install.");
   }
-  return [...new Set(requested)].sort();
+  const requested = sortStrings(
+    input.requestedComponents.map((name) => resolveRegistryComponentId(manifest, name))
+  );
+  const components = expandRegistryComponentClosure(manifest, requested);
+  const requestedSet = new Set(requested);
+  return {
+    requested,
+    implied: components.filter((name) => !requestedSet.has(name)),
+    components
+  };
 }
-function installsCompleteRegistry(artifact, componentNames) {
-  const allComponents = Object.keys(artifact.manifest.components);
+function installsCompleteRegistry(manifest, componentNames) {
+  const allComponents = Object.keys(manifest.components);
   return componentNames.length === allComponents.length && allComponents.every((name) => componentNames.includes(name));
 }
+var AUTHORING_ROLES = /* @__PURE__ */ new Set(["test", "story", "example"]);
 function shouldInstallFile(file, includeTests) {
   if (includeTests) return true;
-  return file.role !== "test" && file.role !== "story";
+  return !AUTHORING_ROLES.has(file.role);
 }
 function dependencyKey(dependency) {
   return `${dependency.type}:${dependency.name}:${dependency.versionRange}:${dependency.optional ? 1 : 0}`;
 }
 function collectRegistryInstallDependencies(artifact, componentNames) {
   const dependencies = /* @__PURE__ */ new Map();
-  for (const dependency of artifact.manifest.dependencies) {
-    dependencies.set(dependencyKey(dependency), dependency);
+  if (installsCompleteRegistry(artifact.manifest, componentNames)) {
+    for (const dependency of artifact.manifest.dependencies) {
+      dependencies.set(dependencyKey(dependency), dependency);
+    }
   }
   for (const name of componentNames) {
     const component = artifact.manifest.components[name];
@@ -789,24 +871,44 @@ function collectRegistryInstallDependencies(artifact, componentNames) {
   }
   return [...dependencies.values()].sort((left, right) => left.name.localeCompare(right.name));
 }
-function collectComponentWritePlan(args) {
-  const writes = /* @__PURE__ */ new Map();
-  for (const componentName of args.componentNames) {
-    const component = args.artifact.manifest.components[componentName];
-    for (const file of component.files) {
-      if (!shouldInstallFile(file, args.includeTests)) continue;
-      const content = args.artifact.files[file.path];
-      if (!content) throw new Error(`Artifact is missing file content for ${file.path}`);
-      const target = sourceToRegistryTargetPath(args.targetPath, file.path);
-      writes.set(target, {
-        path: target,
-        sourcePath: file.path,
-        content: content.content,
-        componentId: component.componentId
-      });
+function packageFileEntries(manifest) {
+  const packageFiles = new Map(
+    manifest.packageFiles.map((file) => [file.path, file])
+  );
+  for (const entrypoint of manifest.entrypoints) {
+    if (!packageFiles.has(entrypoint.sourcePath)) packageFiles.set(entrypoint.sourcePath, null);
+  }
+  return packageFiles;
+}
+function resolveRegistryInstallSources(input) {
+  const { manifest } = input;
+  const selection = resolveRegistryInstallSelection(input);
+  const complete = installsCompleteRegistry(manifest, selection.components);
+  const files = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Set();
+  const add = (file, componentId2) => {
+    if (!shouldInstallFile(file, input.includeTests)) return;
+    if (!files.has(file.path)) files.set(file.path, { file, componentId: componentId2 });
+    paths.add(file.path);
+  };
+  if (complete) {
+    for (const [path, file] of packageFileEntries(manifest)) {
+      if (file) add(file);
+      else paths.add(path);
     }
+  } else {
+    for (const file of manifest.baseFiles) add(file);
   }
-  return [...writes.values()].sort((left, right) => left.path.localeCompare(right.path));
+  for (const name of selection.components) {
+    const component = manifest.components[name];
+    for (const file of component.files) add(file, component.componentId);
+  }
+  return {
+    selection,
+    complete,
+    files: [...files.values()].sort((left, right) => left.file.path.localeCompare(right.file.path)),
+    paths: sortStrings(paths)
+  };
 }
 function rewriteInstalledPackagePath(value) {
   if (value.startsWith("./src/")) return `./${value.slice("./src/".length)}`;
@@ -843,41 +945,14 @@ function rewriteInstalledPackageJson(content) {
   return `${JSON.stringify(installed, null, 2)}
 `;
 }
-function collectPackageWritePlan(args) {
-  const writes = /* @__PURE__ */ new Map();
-  const packageFiles = new Map(
-    args.artifact.manifest.packageFiles.map((file) => [file.path, file])
-  );
-  for (const entrypoint of args.artifact.manifest.entrypoints) {
-    const file = packageFiles.get(entrypoint.sourcePath);
-    if (file) continue;
-    const content = args.artifact.files[entrypoint.sourcePath];
-    if (!content) throw new Error(`Artifact is missing file content for ${entrypoint.sourcePath}`);
-    packageFiles.set(entrypoint.sourcePath, {
-      path: entrypoint.sourcePath,
-      role: "barrel",
-      sha256: content.sha256,
-      size: content.size,
-      contentType: content.contentType,
-      contentRef: `sha256:${content.sha256}`
-    });
-  }
-  for (const file of packageFiles.values()) {
-    if (!shouldInstallFile(file, args.includeTests)) continue;
-    const content = args.artifact.files[file.path];
-    if (!content) throw new Error(`Artifact is missing file content for ${file.path}`);
-    const target = sourceToRegistryTargetPath(args.targetPath, file.path);
-    writes.set(target, {
-      path: target,
-      sourcePath: file.path,
-      content: file.path === "package.json" ? rewriteInstalledPackageJson(content.content) : content.content
-    });
-  }
-  return [...writes.values()].sort((left, right) => left.path.localeCompare(right.path));
+function contentFor(artifact, path) {
+  const content = artifact.files[path];
+  if (!content) throw new Error(`Artifact is missing file content for ${path}`);
+  return content.content;
 }
 function generatedIndexPlan(args) {
   const lines = args.componentNames.map((name) => {
-    const component = args.artifact.manifest.components[name];
+    const component = args.manifest.components[name];
     const exportName = component.exports[0]?.name ?? component.name;
     return `export { ${exportName} } from "./components/${component.componentId}";`;
   });
@@ -903,32 +978,47 @@ function dedupePlans(plans) {
   return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
 function buildRegistryInstallPlan(input) {
+  const { manifest } = input.artifact;
   const targetPath = assertPortableRegistryPath(input.targetPath, "Registry target");
-  const componentNames = selectedRegistryComponentNames(
-    input.artifact,
-    input.requestedComponents,
-    input.all
-  );
+  const sources = resolveRegistryInstallSources({
+    manifest,
+    requestedComponents: input.requestedComponents,
+    all: input.all,
+    includeTests: input.includeTests
+  });
+  const componentNames = sources.selection.components;
   const dependencies = collectRegistryInstallDependencies(input.artifact, componentNames);
-  const isCompleteInstall = installsCompleteRegistry(input.artifact, componentNames);
-  const hasPackageRoot = input.artifact.manifest.entrypoints.some(
-    (entrypoint) => entrypoint.specifier === "."
-  );
+  const hasPackageRoot = manifest.entrypoints.some((entrypoint) => entrypoint.specifier === ".");
+  const writes = sources.files.map(({ file, componentId: componentId2 }) => {
+    const raw = contentFor(input.artifact, file.path);
+    return {
+      path: sourceToRegistryTargetPath(targetPath, file.path),
+      sourcePath: file.path,
+      content: sources.complete && file.path === "package.json" ? rewriteInstalledPackageJson(raw) : raw,
+      ...componentId2 && { componentId: componentId2 }
+    };
+  });
+  if (sources.complete) {
+    for (const entrypoint of manifest.entrypoints) {
+      if (writes.some((plan) => plan.sourcePath === entrypoint.sourcePath)) continue;
+      writes.push({
+        path: sourceToRegistryTargetPath(targetPath, entrypoint.sourcePath),
+        sourcePath: entrypoint.sourcePath,
+        content: contentFor(input.artifact, entrypoint.sourcePath)
+      });
+    }
+  }
   const plans = dedupePlans([
-    ...isCompleteInstall ? collectPackageWritePlan({
-      artifact: input.artifact,
-      targetPath,
-      includeTests: input.includeTests
-    }) : [],
-    ...collectComponentWritePlan({
-      artifact: input.artifact,
-      componentNames,
-      targetPath,
-      includeTests: input.includeTests
-    }),
-    ...isCompleteInstall && hasPackageRoot ? [] : [generatedIndexPlan({ artifact: input.artifact, componentNames, targetPath })]
+    ...writes,
+    ...sources.complete && hasPackageRoot ? [] : [generatedIndexPlan({ manifest, componentNames, targetPath })]
   ]);
-  return { componentNames, plans, dependencies };
+  return {
+    componentNames,
+    requestedComponents: sources.selection.requested,
+    impliedComponents: sources.selection.implied,
+    plans,
+    dependencies
+  };
 }
 function buildRegistryInstallReceipt(args) {
   const installedComponents = args.componentNames.map((name) => {
@@ -1249,14 +1339,14 @@ function rgbToLab(rgb) {
   b = b > 0.04045 ? Math.pow((b + 0.055) / 1.055, 2.4) : b / 12.92;
   let x = (r * 0.4124564 + g2 * 0.3575761 + b * 0.1804375) / 0.95047;
   let y = r * 0.2126729 + g2 * 0.7151522 + b * 0.072175;
-  let z8 = (r * 0.0193339 + g2 * 0.119192 + b * 0.9503041) / 1.08883;
+  let z11 = (r * 0.0193339 + g2 * 0.119192 + b * 0.9503041) / 1.08883;
   x = x > 8856e-6 ? Math.pow(x, 1 / 3) : 7.787 * x + 16 / 116;
   y = y > 8856e-6 ? Math.pow(y, 1 / 3) : 7.787 * y + 16 / 116;
-  z8 = z8 > 8856e-6 ? Math.pow(z8, 1 / 3) : 7.787 * z8 + 16 / 116;
+  z11 = z11 > 8856e-6 ? Math.pow(z11, 1 / 3) : 7.787 * z11 + 16 / 116;
   return {
     l: 116 * y - 16,
     a: 500 * (x - y),
-    b: 200 * (y - z8)
+    b: 200 * (y - z11)
   };
 }
 
@@ -1521,10 +1611,14 @@ var figmaStringMappingSchema = z4.object({
   __type: z4.literal("figma-string"),
   figmaProperty: z4.string().min(1)
 });
+var requiredUnknownSchema = z4.custom(
+  (value) => value !== void 0,
+  "Expected an explicitly present value"
+);
 var figmaBooleanMappingSchema = z4.object({
   __type: z4.literal("figma-boolean"),
   figmaProperty: z4.string().min(1),
-  valueMapping: z4.object({ true: z4.unknown(), false: z4.unknown() }).optional()
+  valueMapping: z4.object({ true: requiredUnknownSchema, false: requiredUnknownSchema }).optional()
 });
 var figmaEnumMappingSchema = z4.object({
   __type: z4.literal("figma-enum"),
@@ -1629,7 +1723,7 @@ var fragmentContractSchema = z4.object({
   a11yRules: z4.array(z4.string()).optional(),
   bans: z4.array(fragmentBanSchema).optional(),
   scenarioTags: z4.array(z4.string()).optional(),
-  performanceBudget: z4.number().positive().optional(),
+  performanceBudget: z4.number().positive().finite().optional(),
   compoundChildren: z4.record(
     z4.object({
       required: z4.boolean().optional(),
@@ -1643,10 +1737,20 @@ var fragmentContractSchema = z4.object({
   // `CompositionPattern[]` the composition/* rules read from policy.
   composition: z4.array(compositionAuthoringEntrySchema).optional()
 });
+var fragmentSourceValues = [
+  "storybook",
+  "manual",
+  "ai",
+  "scan",
+  "extracted",
+  "merged",
+  "migrated"
+];
 var fragmentGeneratedSchema = z4.object({
-  source: z4.enum(["storybook", "manual", "ai"]),
+  source: z4.enum(fragmentSourceValues),
   sourceFile: z4.string().optional(),
   confidence: z4.number().min(0).max(1).optional(),
+  verified: z4.boolean().optional(),
   timestamp: z4.string().datetime().optional()
 });
 var aiMetadataSchema = z4.object({
@@ -1785,14 +1889,6 @@ var fragmentsConfigSchema = z4.object({
       }).optional()
     })
   ]).optional(),
-  storybook: z4.object({
-    exclude: z4.array(z4.string()).optional(),
-    include: z4.array(z4.string()).optional(),
-    excludeDeprecated: z4.boolean().optional(),
-    excludeTests: z4.boolean().optional(),
-    excludeSvgIcons: z4.boolean().optional(),
-    excludeSubComponents: z4.boolean().optional()
-  }).optional(),
   topology: topologySchema.optional(),
   govern: governanceConfigSchema.optional(),
   inspect: z4.object({
@@ -1830,10 +1926,13 @@ var compositionMetadataSchema = z4.object({
   commonPatterns: z4.array(z4.string()).optional()
 });
 var fragmentProvenanceSchema = z4.object({
-  source: z4.enum(["storybook", "manual", "ai", "scan"]),
+  source: z4.enum(fragmentSourceValues),
   sourceFile: z4.string().optional(),
   confidence: z4.number().min(0).max(1).optional(),
-  timestamp: z4.string().datetime().optional(),
+  verified: z4.boolean().optional(),
+  frameworkSupport: z4.enum(["native", "manual-only"]).optional(),
+  sourceHash: z4.string().optional(),
+  timestamp: z4.string().datetime({ offset: true }).optional(),
   autoFields: z4.array(z4.string()).optional(),
   humanFields: z4.array(z4.string()).optional()
 });
@@ -1860,8 +1959,119 @@ var governedFragmentDefinitionSchema = z4.object({
   _provenance: fragmentProvenanceSchema.optional(),
   govern: z4.function().optional(),
   governance: z4.array(componentGovernanceRecordSchema).optional()
+}).superRefine((def, ctx) => {
+  if (def.govern === void 0 && def.governance === void 0) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "Governed definitions require `govern` or `governance`",
+      path: ["govern"]
+    });
+  }
 });
-var recipeDefinitionSchema = blockDefinitionSchema;
+var fragmentRenderSchema = z4.custom(
+  (value) => value !== void 0 && typeof value !== "string",
+  "Expected JSX/render value, not a code string"
+);
+var fragmentMetaV3Schema = z4.object({
+  name: z4.string().min(1),
+  purpose: z4.string().min(1),
+  category: z4.string().min(1),
+  status: z4.enum(["stable", "beta", "deprecated", "experimental"]).optional(),
+  aliases: z4.array(z4.string().min(1)).optional(),
+  tags: z4.array(z4.string()).optional(),
+  since: z4.string().optional(),
+  dependencies: z4.array(
+    z4.object({
+      name: z4.string().min(1),
+      version: z4.string().min(1),
+      reason: z4.string().optional()
+    }).strict()
+  ).optional(),
+  figma: z4.string().url().optional(),
+  figmaProps: z4.record(figmaPropMappingSchema).optional()
+}).strict();
+var fragmentStateV3Schema = z4.object({
+  render: fragmentRenderSchema,
+  note: z4.string().optional(),
+  canonical: z4.boolean().optional()
+}).strict();
+var fragmentDontExampleV3Schema = z4.object({
+  reason: z4.string().min(1),
+  bad: z4.string().min(1),
+  good: fragmentRenderSchema
+}).strict();
+var fragmentGuidanceV3Schema = z4.object({
+  when: z4.array(z4.string()),
+  whenNot: z4.array(z4.string()),
+  choose: z4.record(z4.string()).optional(),
+  dont: z4.array(fragmentDontExampleV3Schema).optional(),
+  guidelines: z4.array(z4.string()).optional(),
+  accessibility: z4.array(z4.string()).optional()
+}).strict();
+var fragmentMatrixV3Schema = z4.object({
+  axes: z4.record(z4.union([z4.literal("auto"), z4.array(z4.string().min(1)).readonly()])).optional(),
+  forced: z4.array(z4.string().min(1)).optional(),
+  worstCase: z4.record(z4.unknown()).optional()
+}).strict();
+var fragmentPreviewV3Schema = z4.object({
+  providers: z4.array(z4.unknown()).optional(),
+  dynamicRegions: z4.array(z4.string()).optional()
+}).strict();
+var fragmentDesignV3Schema = z4.object({
+  figmaNode: z4.string().min(1).optional()
+}).strict();
+var propAnnotationSchema = z4.object({
+  description: z4.string().optional(),
+  controlType: z4.enum([
+    "text",
+    "number",
+    "range",
+    "boolean",
+    "select",
+    "multi-select",
+    "radio",
+    "inline-radio",
+    "check",
+    "inline-check",
+    "object",
+    "file",
+    "color",
+    "date"
+  ]).optional(),
+  controlOptions: z4.record(z4.unknown()).optional(),
+  visibility: z4.enum(["public", "internal", "hidden"]).optional(),
+  constraints: z4.array(z4.string()).optional()
+}).strict();
+var fragmentAnnotationsV3Schema = z4.object({
+  notes: z4.array(z4.string()).optional(),
+  review: z4.array(z4.string()).optional()
+}).passthrough();
+var fragmentDefinitionV3BodyShape = {
+  meta: fragmentMetaV3Schema,
+  states: z4.record(fragmentStateV3Schema).refine((states) => Object.keys(states).length > 0, {
+    message: "At least one state is required"
+  }),
+  guidance: fragmentGuidanceV3Schema,
+  matrix: fragmentMatrixV3Schema.optional(),
+  preview: fragmentPreviewV3Schema.optional(),
+  design: fragmentDesignV3Schema.optional(),
+  annotations: fragmentAnnotationsV3Schema.optional(),
+  props: z4.record(propAnnotationSchema).optional(),
+  relations: z4.array(componentRelationSchema.strict()).optional(),
+  composition: compositionMetadataSchema.strict().optional(),
+  contract: fragmentContractSchema.optional(),
+  _provenance: fragmentProvenanceSchema.optional(),
+  govern: z4.function().optional(),
+  governance: z4.array(componentGovernanceRecordSchema).optional()
+};
+var fragmentDefinitionV3BodySchema = z4.object(fragmentDefinitionV3BodyShape).strict();
+var fragmentDefinitionV3Schema = z4.object({
+  ...fragmentDefinitionV3BodyShape,
+  component: z4.unknown().refine((component) => component !== void 0, {
+    message: "Component is required"
+  }),
+  governance: z4.array(componentGovernanceRecordSchema)
+}).strict();
 
 // src/config.ts
 var RAW_CONFIG_DECLARATION = /* @__PURE__ */ Symbol.for("@usefragments/core/raw-config-declaration");
@@ -1890,11 +2100,51 @@ ${formatZodErrors(result.error.errors)}`);
 
 // src/defineFragment.ts
 function isGovernedDefinition(def) {
-  return "govern" in def || "governance" in def;
+  if (!def || typeof def !== "object") return false;
+  const record = def;
+  return typeof record.govern === "function" || Array.isArray(record.governance);
 }
 function isV2Definition(def) {
+  if (!def || typeof def !== "object") return false;
   return !isGovernedDefinition(def) && ("guidance" in def || "examples" in def);
 }
+function rejectInvalidGovernanceDiscriminants(definition) {
+  if (!definition || typeof definition !== "object") return;
+  const record = definition;
+  const hasOwn = (key) => Object.prototype.hasOwnProperty.call(record, key);
+  const errors = [];
+  if (hasOwn("govern") && typeof record.govern !== "function") {
+    errors.push({ path: ["govern"], message: "Expected a governance authoring function" });
+  }
+  if (hasOwn("governance") && !Array.isArray(record.governance)) {
+    errors.push({ path: ["governance"], message: "Expected an array of governance records" });
+  }
+  if (errors.length > 0) {
+    const name = record.meta && typeof record.meta === "object" && "name" in record.meta ? String(record.meta.name) : "unknown";
+    throwInvalidFragment(name, "governed", errors);
+  }
+}
+var InvalidFragmentDefinitionError = class _InvalidFragmentDefinitionError extends Error {
+  code = "FUI9010";
+  source = "@usefragments/core/defineFragment";
+  api;
+  issues;
+  constructor(name, api, errors) {
+    const issues = errors.map((error) => `${error.path.join(".") || "(root)"}: ${error.message}`).sort();
+    super(
+      [
+        `${_InvalidFragmentDefinitionError.name}: Invalid fragment definition for "${name}":`,
+        ...issues.map((issue) => `  - ${issue}`)
+      ].join("\n")
+    );
+    this.name = _InvalidFragmentDefinitionError.name;
+    this.api = api;
+    this.issues = issues;
+  }
+};
+function throwInvalidFragment(name, api, errors) {
+  throw new InvalidFragmentDefinitionError(name, api, errors);
+}
 function normalizeToV1(def) {
   let ai;
   if (def.composition) {
@@ -1908,9 +2158,10 @@ function normalizeToV1(def) {
   let generated;
   if (def._provenance) {
     generated = {
-      source: def._provenance.source === "scan" ? "ai" : def._provenance.source,
+      source: def._provenance.source,
       sourceFile: def._provenance.sourceFile,
       confidence: def._provenance.confidence,
+      verified: def._provenance.verified,
       timestamp: def._provenance.timestamp
     };
   }
@@ -1926,18 +2177,60 @@ function normalizeToV1(def) {
     _generated: generated
   };
 }
-function defineFragment(definition) {
-  if (process.env.NODE_ENV !== "production") {
-    const governed = isGovernedDefinition(definition);
-    const v2 = isV2Definition(definition);
-    const schema = governed ? governedFragmentDefinitionSchema : v2 ? fragmentDefinitionV2Schema : fragmentDefinitionSchema;
-    const result = schema.safeParse(definition);
-    if (!result.success) {
-      const name = definition.meta?.name || "unknown";
-      const errors = result.error.errors.map((e) => `  - ${e.path.join(".")}: ${e.message}`).join("\n");
-      throw new Error(`Invalid fragment definition for "${name}":
-${errors}`);
-    }
+function defineFragmentV3(component, definition) {
+  const result = fragmentDefinitionV3BodySchema.safeParse(definition);
+  if (!result.success) {
+    throwInvalidFragment(
+      definition?.meta?.name || "unknown",
+      "v3",
+      result.error.errors.map((e) => ({ path: e.path, message: e.message }))
+    );
+  }
+  const governance = typeof definition.govern === "function" || Array.isArray(definition.governance) ? resolveComponentGovernance({
+    component,
+    meta: {
+      name: definition.meta.name,
+      description: definition.meta.purpose,
+      category: definition.meta.category,
+      status: definition.meta.status,
+      tags: definition.meta.tags,
+      since: definition.meta.since,
+      dependencies: definition.meta.dependencies,
+      figma: definition.meta.figma,
+      figmaProps: definition.meta.figmaProps
+    },
+    guidance: {
+      when: definition.guidance.when,
+      whenNot: definition.guidance.whenNot,
+      guidelines: definition.guidance.guidelines,
+      accessibility: definition.guidance.accessibility
+    },
+    govern: definition.govern,
+    governance: definition.governance
+  }) : [];
+  return {
+    ...definition,
+    component,
+    governance
+  };
+}
+function defineFragmentOneArg(definition) {
+  if (!definition || typeof definition !== "object") {
+    throwInvalidFragment("unknown", "unknown", [
+      { path: [], message: "Expected a fragment definition object" }
+    ]);
+  }
+  rejectInvalidGovernanceDiscriminants(definition);
+  const governed = isGovernedDefinition(definition);
+  const v2 = isV2Definition(definition);
+  const schema = governed ? governedFragmentDefinitionSchema : v2 ? fragmentDefinitionV2Schema : fragmentDefinitionSchema;
+  const result = schema.safeParse(definition);
+  if (!result.success) {
+    throwInvalidFragment(
+      definition?.meta?.name || "unknown",
+      governed ? "governed" : v2 ? "v2" : "v1",
+      result.error.errors.map((e) => ({ path: e.path, message: e.message }))
+    );
   }
   if (isGovernedDefinition(definition)) {
     const governance = resolveComponentGovernance(definition);
@@ -1948,6 +2241,17 @@ ${errors}`);
   }
   return definition;
 }
+function defineFragment(componentOrDefinition, maybeDefinition) {
+  if (arguments.length >= 2) {
+    return defineFragmentV3(
+      componentOrDefinition,
+      maybeDefinition
+    );
+  }
+  return defineFragmentOneArg(
+    componentOrDefinition
+  );
+}
 function compileFragment(definition, filePath) {
   const v1 = isGovernedDefinition(definition) ? {
     component: definition.component,
@@ -1957,10 +2261,17 @@ function compileFragment(definition, filePath) {
     relations: definition.relations,
     variants: definition.examples ?? [],
     contract: definition.contract,
+    ai: definition.composition ? {
+      compositionPattern: definition.composition.pattern,
+      subComponents: definition.composition.subComponents,
+      requiredChildren: definition.composition.requiredChildren,
+      commonPatterns: definition.composition.commonPatterns
+    } : void 0,
     _generated: definition._provenance ? {
-      source: definition._provenance.source === "scan" ? "ai" : definition._provenance.source,
+      source: definition._provenance.source,
       sourceFile: definition._provenance.sourceFile,
       confidence: definition._provenance.confidence,
+      verified: definition._provenance.verified,
       timestamp: definition._provenance.timestamp
     } : void 0
   } : isV2Definition(definition) ? normalizeToV1(definition) : definition;
@@ -1986,17 +2297,14 @@ function compileFragment(definition, filePath) {
   };
 }
 function defineBlock(definition) {
-  if (process.env.NODE_ENV !== "production") {
-    const result = blockDefinitionSchema.safeParse(definition);
-    if (!result.success) {
-      const errors = result.error.errors.map((e) => `  - ${e.path.join(".")}: ${e.message}`).join("\n");
-      throw new Error(`Invalid block definition for "${definition.name || "unknown"}":
+  const result = blockDefinitionSchema.safeParse(definition);
+  if (!result.success) {
+    const errors = result.error.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).sort().map((issue) => `  - ${issue}`).join("\n");
+    throw new Error(`Invalid block definition for "${definition.name || "unknown"}":
 ${errors}`);
-    }
   }
   return definition;
 }
-var defineRecipe = defineBlock;
 function compileBlock(definition, filePath) {
   return {
     filePath,
@@ -2008,129 +2316,6 @@ function compileBlock(definition, filePath) {
     tags: definition.tags
   };
 }
-var compileRecipe = compileBlock;
-
-// src/storyFilters.ts
-var EXCLUDED_TAGS = /* @__PURE__ */ new Set(["hidden", "internal", "no-fragment"]);
-var SVG_ICON_RE = /^Svg[A-Z]/;
-var TEST_TITLE_RE = /\/tests?$/i;
-var TEST_FILE_RE = /\.test\.stories\./;
-var DEPRECATED_TITLE_RE = /\bDeprecated\b/i;
-function checkStoryExclusion(opts) {
-  const { config } = opts;
-  if (isForceIncluded(opts.componentName, config)) {
-    return { excluded: false };
-  }
-  if (isConfigExcluded(opts.componentName, config)) {
-    return {
-      excluded: true,
-      reason: "config-excluded",
-      detail: `'${opts.componentName}' matches storybook.exclude pattern`
-    };
-  }
-  if (config.excludeDeprecated !== false && opts.storybookTitle && DEPRECATED_TITLE_RE.test(opts.storybookTitle)) {
-    return {
-      excluded: true,
-      reason: "deprecated",
-      detail: `Title "${opts.storybookTitle}" contains "Deprecated"`
-    };
-  }
-  if (config.excludeTests !== false) {
-    if (opts.storybookTitle && TEST_TITLE_RE.test(opts.storybookTitle)) {
-      return {
-        excluded: true,
-        reason: "test-story",
-        detail: `Title "${opts.storybookTitle}" ends with /test(s)`
-      };
-    }
-    if (TEST_FILE_RE.test(opts.filePath)) {
-      return {
-        excluded: true,
-        reason: "test-story",
-        detail: `File path matches *.test.stories.*`
-      };
-    }
-  }
-  if (config.excludeSvgIcons !== false) {
-    const names = [opts.componentName, opts.componentDisplayName, opts.componentFunctionName].filter(Boolean);
-    for (const name of names) {
-      if (SVG_ICON_RE.test(name)) {
-        return {
-          excluded: true,
-          reason: "svg-icon",
-          detail: `Component name "${name}" matches Svg[A-Z] pattern`
-        };
-      }
-    }
-  }
-  if (opts.tags?.length) {
-    const hit = opts.tags.find((t) => EXCLUDED_TAGS.has(t));
-    if (hit) {
-      return {
-        excluded: true,
-        reason: "tag-excluded",
-        detail: `Tag "${hit}" is in the exclusion set`
-      };
-    }
-  }
-  if (opts.variantCount === 0) {
-    return {
-      excluded: true,
-      reason: "empty-variants",
-      detail: "Zero renderable story exports"
-    };
-  }
-  return { excluded: false };
-}
-function detectSubComponentPaths(storyFiles) {
-  const byDir = /* @__PURE__ */ new Map();
-  for (const file of storyFiles) {
-    const parts = file.relativePath.split("/");
-    if (parts.length < 2) continue;
-    const fileName = parts[parts.length - 1];
-    const baseMatch = fileName.match(/^([^.]+)\.stories\./);
-    if (!baseMatch) continue;
-    const dir = parts.slice(0, -1).join("/");
-    const baseName = baseMatch[1];
-    if (!byDir.has(dir)) byDir.set(dir, []);
-    byDir.get(dir).push({ relativePath: file.relativePath, baseName });
-  }
-  const subComponentMap = /* @__PURE__ */ new Map();
-  for (const [dir, files] of byDir) {
-    if (files.length <= 1) continue;
-    const dirName = dir.split("/").pop();
-    const primary = files.find((f) => f.baseName === dirName);
-    if (!primary) continue;
-    for (const file of files) {
-      if (file.relativePath === primary.relativePath) continue;
-      subComponentMap.set(file.relativePath, primary.baseName);
-    }
-  }
-  return subComponentMap;
-}
-function isForceIncluded(name, config) {
-  if (!config.include?.length) return false;
-  return config.include.some((pattern) => matchesPattern(name, pattern));
-}
-function isConfigExcluded(name, config) {
-  if (!config.exclude?.length) return false;
-  return config.exclude.some((pattern) => matchesPattern(name, pattern));
-}
-function matchesPattern(name, pattern) {
-  if (!pattern.includes("*")) {
-    return name === pattern;
-  }
-  const parts = pattern.split("*");
-  if (parts.length === 2) {
-    const [prefix, suffix] = parts;
-    if (prefix && suffix) return name.startsWith(prefix) && name.endsWith(suffix);
-    if (prefix) return name.startsWith(prefix);
-    if (suffix) return name.endsWith(suffix);
-    return true;
-  }
-  const escaped = parts.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-  return new RegExp(`^${escaped}$`).test(name);
-}
 
 // src/figma.ts
 function string(figmaProperty) {
@@ -3694,24 +3879,37 @@ var contractExampleSchema = z6.object({
 });
 var contractRelationSchema = z6.object({
   component: z6.string(),
-  relationship: z6.enum(["alternative", "parent", "child", "sibling", "composition", "complementary", "used-by"]),
+  relationship: z6.enum([
+    "alternative",
+    "parent",
+    "child",
+    "sibling",
+    "composition",
+    "complementary",
+    "used-by"
+  ]),
   note: z6.string()
 });
 var contractContractSchema = z6.object({
   propsSummary: z6.array(z6.string()).optional(),
   scenarioTags: z6.array(z6.string()).optional(),
   a11yRules: z6.array(z6.string()).optional(),
-  bans: z6.array(z6.object({
-    pattern: z6.string(),
-    message: z6.string()
-  })).optional(),
-  compoundChildren: z6.record(z6.string(), z6.object({
-    required: z6.boolean().optional(),
-    accepts: z6.array(z6.string()).optional(),
-    description: z6.string().optional()
-  })).optional(),
+  bans: z6.array(
+    z6.object({
+      pattern: z6.string(),
+      message: z6.string()
+    })
+  ).optional(),
+  compoundChildren: z6.record(
+    z6.string(),
+    z6.object({
+      required: z6.boolean().optional(),
+      accepts: z6.array(z6.string()).optional(),
+      description: z6.string().optional()
+    })
+  ).optional(),
   canonicalUsage: z6.array(z6.string()).optional(),
-  performanceBudget: z6.number().optional()
+  performanceBudget: z6.number().positive().finite().optional()
 });
 var contractAiSchema = z6.object({
   compositionPattern: z6.enum(["compound", "simple", "controlled", "wrapper"]).optional(),
@@ -3735,11 +3933,14 @@ var contractProvenanceSchema = z6.object({
 });
 var contractFigmaSchema = z6.object({
   nodeUrl: z6.string().optional(),
-  propMappings: z6.record(z6.string(), z6.object({
-    type: z6.enum(["string", "boolean", "enum", "instance", "children", "textContent"]),
-    figmaProperty: z6.string(),
-    values: z6.record(z6.string(), z6.string()).optional()
-  })).optional()
+  propMappings: z6.record(
+    z6.string(),
+    z6.object({
+      type: z6.enum(["string", "boolean", "enum", "instance", "children", "textContent"]),
+      figmaProperty: z6.string(),
+      values: z6.record(z6.string(), z6.string()).optional()
+    })
+  ).optional()
 });
 var componentContractSchema = z6.object({
   $schema: z6.string(),
@@ -3749,11 +3950,13 @@ var componentContractSchema = z6.object({
   tags: z6.array(z6.string()).optional(),
   status: z6.enum(["stable", "beta", "deprecated", "experimental"]).optional(),
   framework: z6.enum(["react", "vue", "svelte", "web-components", "angular"]).optional(),
-  dependencies: z6.array(z6.object({
-    name: z6.string(),
-    version: z6.string(),
-    reason: z6.string().optional()
-  })).optional(),
+  dependencies: z6.array(
+    z6.object({
+      name: z6.string(),
+      version: z6.string(),
+      reason: z6.string().optional()
+    })
+  ).optional(),
   sourcePath: z6.string(),
   exportName: z6.string(),
   propsSummary: z6.array(z6.string()),
@@ -3804,6 +4007,8 @@ function parseComponentContract(content, filePath) {
     } : {
       propsSummary: validated.propsSummary
     },
+    preview: validated.preview,
+    tokens: validated.tokens,
     framework: validated.framework,
     ai: validated.ai,
     propsSummary: validated.propsSummary,
@@ -4015,6 +4220,7 @@ function parseFigmaValue(cssValue, category) {
 // src/composition.ts
 var CATEGORY_AFFINITIES = {
   forms: ["feedback"],
+  inputs: ["feedback"],
   actions: ["feedback"]
 };
 function analyzeComposition(fragments, componentNames, _context, options) {
@@ -4120,9 +4326,7 @@ function analyzeComposition(fragments, componentNames, _context, options) {
       });
     }
   }
-  const selectedCategories = new Set(
-    components.map((name) => fragments[name].meta.category)
-  );
+  const selectedCategories = new Set(components.map((name) => fragments[name].meta.category));
   for (const [category, affinities] of Object.entries(CATEGORY_AFFINITIES)) {
     if (!selectedCategories.has(category)) continue;
     for (const neededCategory of affinities) {
@@ -4138,9 +4342,7 @@ function analyzeComposition(fragments, componentNames, _context, options) {
           component: candidate,
           reason: `Compositions using "${category}" components often benefit from a "${neededCategory}" component`,
           relationship: "category_gap",
-          sourceComponent: components.find(
-            (n) => fragments[n].meta.category === category
-          )
+          sourceComponent: components.find((n) => fragments[n].meta.category === category)
         });
         suggestedSet.add(candidate);
       }
@@ -4263,7 +4465,7 @@ function makeFinding(input) {
     canonicalJson({ ruleId: input.ruleId, ...input.fingerprintIdentity })
   );
   const previousFingerprint = input.previousFingerprintIdentity ? hash64Hex(canonicalJson({ ruleId: input.ruleId, ...input.previousFingerprintIdentity })) : void 0;
-  const code = byRuleId.get(input.ruleId);
+  const code = input.code ? byCode.get(input.code) : byRuleId.get(input.ruleId);
   return normalizeFinding({
     ruleId: input.ruleId,
     ruleVersion: input.ruleVersion,
@@ -8374,6 +8576,14 @@ function indexTokensByCssVariable(tokens) {
 // src/rules/tokens-css-vars-must-be-defined.ts
 var RULE_ID22 = "tokens/css-vars-must-be-defined";
 var RULE_VERSION23 = "1";
+var EMPTY_VOCABULARY_CODE = "FUI2018";
+var EMPTY_VOCABULARY_MESSAGE = "token sources resolved to 0 tokens \u2014 rule inert";
+var EMPTY_VOCABULARY_CONFIG_FALLBACK = "your fragments config";
+function emptyVocabularyConfigFile(configPath2) {
+  if (!configPath2) return EMPTY_VOCABULARY_CONFIG_FALLBACK;
+  const base = configPath2.replaceAll("\\", "/").replace(/\/+$/u, "").split("/").pop();
+  return base && base.length > 0 ? base : EMPTY_VOCABULARY_CONFIG_FALLBACK;
+}
 var CSS_VAR_REFERENCE = /var\(\s*(--[A-Za-z0-9_-]+)/gi;
 function contractVocabularyContext(ix) {
   if (!ix.policy.cssVarsMustBeDefined()) return void 0;
@@ -8395,7 +8605,7 @@ function ruleTokensCssVarsMustBeDefined(ix) {
   const policy = ix.policy.cssVarsMustBeDefined();
   if (!policy) return [];
   const context = contractVocabularyContext(ix);
-  if (!context) return [];
+  if (!context) return [emptyVocabularyFinding(ix, policy)];
   const { vocabulary } = context;
   const findings = [];
   for (const decl of ix.byKind("style_declaration")) {
@@ -8436,6 +8646,27 @@ function ruleTokensCssVarsMustBeDefined(ix) {
   }
   return findings;
 }
+function emptyVocabularyFinding(ix, policy) {
+  return makeFinding({
+    ruleId: RULE_ID22,
+    ruleVersion: RULE_VERSION23,
+    severity: "error",
+    code: EMPTY_VOCABULARY_CODE,
+    message: EMPTY_VOCABULARY_MESSAGE,
+    location: {
+      file: policy.configPath ?? EMPTY_VOCABULARY_CONFIG_FALLBACK,
+      line: 0,
+      column: 0
+    },
+    evidence: ix.evidence([policy.id]),
+    fingerprintIdentity: { reason: "empty-vocabulary" },
+    attributes: {
+      source: "config",
+      inert: true,
+      tokenCount: 0
+    }
+  });
+}
 function sharesContractPrefix(name, prefixes) {
   for (const prefix of prefixes) {
     if (name.startsWith(prefix)) return true;
@@ -8526,6 +8757,30 @@ function ruleTokensUpstreamDrift(ix) {
   return findings;
 }
 
+// src/rules/rule-config.ts
+function readRuleConfig(ix) {
+  const disabled = /* @__PURE__ */ new Set();
+  const severities = /* @__PURE__ */ new Map();
+  for (const fact of ix.byKind("governance_rule_config")) {
+    if (!fact.enabled) {
+      disabled.add(fact.ruleId);
+      continue;
+    }
+    if (fact.severity) severities.set(fact.ruleId, fact.severity);
+  }
+  return { disabled, severities };
+}
+function capConfiguredSeverity(finding, configured) {
+  if (finding.attributes?.advisory === true && severityLevel(configured) === "error") {
+    return severityLevel(finding.severity) === "error" ? severityFromLevel("warn") : finding.severity;
+  }
+  return configured;
+}
+function configuredFindingSeverity(finding, config) {
+  const configured = config.severities.get(finding.ruleId);
+  return configured ? capConfiguredSeverity(finding, severityFromLevel(configured)) : finding.severity;
+}
+
 // src/rules/emit-gate.ts
 var BLOCKING_RULE_ALLOWLIST = /* @__PURE__ */ new Set([
   "styles/no-raw-color",
@@ -8778,8 +9033,12 @@ var RULES = [
   }
 ];
 function runRules(ix) {
+  const { disabled } = readRuleConfig(ix);
   const findings = [];
-  for (const rule of RULES) findings.push(...rule.run(ix));
+  for (const rule of RULES) {
+    if (disabled.has(rule.id)) continue;
+    findings.push(...rule.run(ix));
+  }
   return sortFindings(findings);
 }
 function sortFindings(findings) {
@@ -8869,7 +9128,7 @@ var PASSTHROUGH_KEYS = [
   },
   {
     path: ["registry"],
-    keys: ["requireStory", "publicOnly", "categoryDepth", "includeProps", "embedFragments"]
+    keys: ["requireStory", "publicOnly", "categoryDepth", "includeProps"]
   },
   {
     path: ["govern", "tailwind"],
@@ -9123,11 +9382,11 @@ function collectPassthroughRecordValues(authored, path, allowed, diagnostics) {
   }
 }
 function stableConfigDiagnostics(diagnostics) {
-  const unique = /* @__PURE__ */ new Map();
+  const unique2 = /* @__PURE__ */ new Map();
   for (const diagnostic of diagnostics) {
-    unique.set(`${diagnostic.code}\0${diagnostic.path}`, diagnostic);
+    unique2.set(`${diagnostic.code}\0${diagnostic.path}`, diagnostic);
   }
-  return [...unique.values()].sort(
+  return [...unique2.values()].sort(
     (left, right) => left.path.localeCompare(right.path) || left.code.localeCompare(right.code) || left.message.localeCompare(right.message)
   );
 }
@@ -9353,10 +9612,11 @@ function evaluateGovernanceIntegrity(input) {
   const activeRuleCount = [...configs.entries()].filter(
     ([ruleId, config]) => CONSUMED_RULE_IDS.has(ruleId) && config.enabled
   ).length;
+  const tokensVocabularyInert = !tokensArmed && tokensFamily.reason === "no token vocabulary" ? 1 : 0;
   const roster = {
     configured: configuredRuleCount + configDiagnostics.length,
-    active: activeRuleCount,
-    inert: configDiagnostics.length
+    active: Math.max(0, activeRuleCount - tokensVocabularyInert),
+    inert: configDiagnostics.length + tokensVocabularyInert
   };
   return {
     status,
@@ -9454,7 +9714,30 @@ function sortRecords(values) {
 }
 
 // src/contract/preimage.ts
+var CONTRACT_ENFORCEMENT_FIELDS = [
+  "a11yRules",
+  "bans",
+  "performanceBudget",
+  "compoundChildren",
+  "composition"
+];
+var CONTRACT_DISPLAY_ONLY_FIELDS = [
+  "propsSummary",
+  "canonicalUsage",
+  "scenarioTags",
+  "states",
+  "variants"
+];
 var CONTRACT_DOMAINS = ["components", "tokens", "canonicalMap", "policy"];
+var ContractCatalogValidationError = class extends TypeError {
+  issues;
+  constructor(issues) {
+    const sortedIssues = [...issues].sort();
+    super(["Invalid contract catalog:", ...sortedIssues.map((issue) => `  - ${issue}`)].join("\n"));
+    this.name = "ContractCatalogValidationError";
+    this.issues = sortedIssues;
+  }
+};
 var CONTRACT_PREIMAGE_SCHEMA = "fcid-preimage:v1";
 var CONTRACT_PREIMAGE_CAPABILITY_HEADER = "X-Fragments-Contract-Preimage";
 var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/u;
@@ -9482,13 +9765,225 @@ function verifiedContractPreimageFromPin(pin) {
 function sortCanonical(items) {
   return items.map((item) => ({ item, key: canonicalPreimage(item) })).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map(({ item }) => item);
 }
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function requireNonEmptyString(value, path, issues) {
+  if (typeof value !== "string" || value.length === 0) {
+    issues.push(`${path}: expected a non-empty string`);
+  }
+}
+function validateStringArray(value, path, issues) {
+  if (!Array.isArray(value)) {
+    issues.push(`${path}: expected an array`);
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, entry] of value.entries()) {
+    requireNonEmptyString(entry, `${path}[${index}]`, issues);
+    if (typeof entry === "string" && entry.length > 0) {
+      if (seen.has(entry)) issues.push(`${path}: duplicate value "${entry}"`);
+      seen.add(entry);
+    }
+  }
+}
+function validateContractCatalog(catalog) {
+  const issues = [];
+  if (!isPlainRecord(catalog)) {
+    throw new ContractCatalogValidationError(["(root): expected a plain object"]);
+  }
+  const componentIdentities = /* @__PURE__ */ new Set();
+  if (catalog.components !== void 0) {
+    if (!Array.isArray(catalog.components)) {
+      issues.push("components: expected an array");
+    } else {
+      for (const [index, value] of catalog.components.entries()) {
+        const path = `components[${index}]`;
+        if (!isPlainRecord(value)) {
+          issues.push(`${path}: expected a plain object`);
+          continue;
+        }
+        requireNonEmptyString(value.name, `${path}.name`, issues);
+        if (value.parentName !== void 0) {
+          requireNonEmptyString(value.parentName, `${path}.parentName`, issues);
+        }
+        if (typeof value.name === "string" && value.name.length > 0) {
+          const identity = `${typeof value.parentName === "string" ? value.parentName : ""}#${value.name}`;
+          if (componentIdentities.has(identity)) {
+            issues.push(`components: duplicate identity "${identity}"`);
+          }
+          componentIdentities.add(identity);
+        }
+        if (value.props !== void 0) validateStringArray(value.props, `${path}.props`, issues);
+        if (value.compoundChildren !== void 0) {
+          validateStringArray(value.compoundChildren, `${path}.compoundChildren`, issues);
+        }
+        if (value.contract !== void 0 && !isPlainRecord(value.contract)) {
+          issues.push(`${path}.contract: expected a plain object`);
+        }
+        if (value.governance !== void 0 && !Array.isArray(value.governance)) {
+          issues.push(`${path}.governance: expected an array`);
+        }
+      }
+    }
+  }
+  const tokenNames = /* @__PURE__ */ new Set();
+  if (catalog.tokens !== void 0) {
+    if (!Array.isArray(catalog.tokens)) {
+      issues.push("tokens: expected an array");
+    } else {
+      for (const [index, value] of catalog.tokens.entries()) {
+        const path = `tokens[${index}]`;
+        if (!isPlainRecord(value)) {
+          issues.push(`${path}: expected a plain object`);
+          continue;
+        }
+        requireNonEmptyString(value.name, `${path}.name`, issues);
+        if (typeof value.name === "string" && value.name.length > 0) {
+          if (tokenNames.has(value.name)) issues.push(`tokens: duplicate identity "${value.name}"`);
+          tokenNames.add(value.name);
+        }
+        if (typeof value.value !== "string" && typeof value.value !== "number" || typeof value.value === "number" && !Number.isFinite(value.value)) {
+          issues.push(`${path}.value: expected a finite number or string`);
+        }
+        if (value.type !== void 0) requireNonEmptyString(value.type, `${path}.type`, issues);
+      }
+    }
+  }
+  const confirmedMappings = /* @__PURE__ */ new Set();
+  if (catalog.canonicalMappings !== void 0) {
+    if (!Array.isArray(catalog.canonicalMappings)) {
+      issues.push("canonicalMappings: expected an array");
+    } else {
+      for (const [index, value] of catalog.canonicalMappings.entries()) {
+        const path = `canonicalMappings[${index}]`;
+        if (!isPlainRecord(value)) {
+          issues.push(`${path}: expected a plain object`);
+          continue;
+        }
+        requireNonEmptyString(value.component, `${path}.component`, issues);
+        requireNonEmptyString(value.canonical, `${path}.canonical`, issues);
+        if (!["confirmed", "proposed", "unknown"].includes(value.status)) {
+          issues.push(`${path}.status: expected confirmed, proposed, or unknown`);
+        }
+        if (value.status === "confirmed" && typeof value.component === "string") {
+          if (confirmedMappings.has(value.component)) {
+            issues.push(`canonicalMappings: duplicate confirmed identity "${value.component}"`);
+          }
+          confirmedMappings.add(value.component);
+        }
+        if (value.importPath !== void 0) {
+          requireNonEmptyString(value.importPath, `${path}.importPath`, issues);
+        }
+        if (value.propMapping !== void 0 && !Array.isArray(value.propMapping)) {
+          issues.push(`${path}.propMapping: expected an array`);
+        }
+        if (value.resolves !== void 0 && !Array.isArray(value.resolves)) {
+          issues.push(`${path}.resolves: expected an array`);
+        }
+        if (value.bridge !== void 0 && !isPlainRecord(value.bridge)) {
+          issues.push(`${path}.bridge: expected a plain object`);
+        }
+      }
+    }
+  }
+  if (catalog.policy !== void 0 && catalog.policy !== null) {
+    if (!isPlainRecord(catalog.policy)) {
+      issues.push("policy: expected a plain object or null");
+    } else {
+      if (catalog.policy.rules !== void 0 && !isPlainRecord(catalog.policy.rules)) {
+        issues.push("policy.rules: expected a plain object");
+      }
+      if (catalog.policy.codes !== void 0 && !isPlainRecord(catalog.policy.codes)) {
+        issues.push("policy.codes: expected a plain object");
+      }
+      if (catalog.policy.compositionPatterns !== void 0 && !Array.isArray(catalog.policy.compositionPatterns)) {
+        issues.push("policy.compositionPatterns: expected an array");
+      }
+      if (catalog.policy.waivers !== void 0) {
+        if (!Array.isArray(catalog.policy.waivers)) {
+          issues.push("policy.waivers: expected an array");
+        } else {
+          const waiverIds = /* @__PURE__ */ new Set();
+          for (const [index, value] of catalog.policy.waivers.entries()) {
+            const path = `policy.waivers[${index}]`;
+            if (!isPlainRecord(value)) {
+              issues.push(`${path}: expected a plain object`);
+              continue;
+            }
+            requireNonEmptyString(value.id, `${path}.id`, issues);
+            requireNonEmptyString(value.target, `${path}.target`, issues);
+            requireNonEmptyString(value.reason, `${path}.reason`, issues);
+            if (value.expiresOn !== void 0) {
+              requireNonEmptyString(value.expiresOn, `${path}.expiresOn`, issues);
+            }
+            if (typeof value.id === "string" && value.id.length > 0) {
+              if (waiverIds.has(value.id)) {
+                issues.push(`policy.waivers: duplicate identity "${value.id}"`);
+              }
+              waiverIds.add(value.id);
+            }
+          }
+        }
+      }
+    }
+  }
+  if (issues.length > 0) throw new ContractCatalogValidationError(issues);
+}
+function projectEnforcementContract(contract) {
+  if (!contract || typeof contract !== "object" || Array.isArray(contract)) {
+    return void 0;
+  }
+  const source = contract;
+  const projected = {};
+  if (Array.isArray(source.a11yRules)) {
+    projected.a11yRules = sortCanonical([...source.a11yRules]);
+  }
+  if (Array.isArray(source.bans)) {
+    projected.bans = sortCanonical([...source.bans]);
+  }
+  if (typeof source.performanceBudget === "number") {
+    projected.performanceBudget = source.performanceBudget;
+  }
+  if (Array.isArray(source.composition)) {
+    projected.composition = sortCanonical([...source.composition]);
+  }
+  const compoundChildren = projectContractCompoundChildren(source.compoundChildren);
+  if (compoundChildren !== void 0) {
+    projected.compoundChildren = compoundChildren;
+  }
+  return Object.keys(projected).length > 0 ? projected : void 0;
+}
+function projectContractCompoundChildren(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entries = Object.entries(value).map(([name, raw]) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      return [name, {}];
+    }
+    const child = raw;
+    const projected = {};
+    if (typeof child.required === "boolean") projected.required = child.required;
+    if (Array.isArray(child.accepts)) {
+      projected.accepts = [...child.accepts].filter((entry) => typeof entry === "string").sort();
+    }
+    return [name, projected];
+  }).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return Object.fromEntries(entries);
+}
+function projectGovernanceRecords(records) {
+  if (!records || records.length === 0) return void 0;
+  return sortCanonical([...records]);
+}
 function projectComponents(components) {
   return sortCanonical(
     (components ?? []).map((component) => ({
       name: component.name,
       parentName: component.parentName,
       props: component.props ? [...component.props].sort() : void 0,
-      contract: component.contract,
+      contract: projectEnforcementContract(component.contract),
+      governance: projectGovernanceRecords(component.governance),
       compoundChildren: component.compoundChildren ? [...component.compoundChildren].sort() : void 0
     }))
   );
@@ -9570,6 +10065,7 @@ function projectPolicy(policy) {
   };
 }
 function projectContractPreimage(catalog) {
+  validateContractCatalog(catalog);
   return {
     schema: CONTRACT_PREIMAGE_SCHEMA,
     domains: {
@@ -9609,16 +10105,31 @@ function contractComponentsFromFragments(fragments) {
     const parentName = fragment?.meta?.parentComponentName;
     const rawChildren = fragment?.structure?.compoundChildren;
     const compoundChildren = Array.isArray(rawChildren) ? rawChildren.map((child) => child?.name).filter((childName) => typeof childName === "string") : void 0;
+    const governance = resolveGovernanceRecordsForIdentity({
+      governance: Array.isArray(fragment?.governance) ? fragment.governance : void 0,
+      govern: typeof fragment?.govern === "function" ? fragment.govern : void 0
+    });
     components.push({
       name,
       parentName: typeof parentName === "string" ? parentName : void 0,
       props: Object.keys(fragment?.props ?? {}),
       contract: fragment?.contract,
+      governance,
       compoundChildren
     });
   }
   return components;
 }
+function deriveArtifactId(content) {
+  return artifactContentHash({
+    schema: "artifact-content:v1",
+    modules: content.modules,
+    states: content.states,
+    guidance: content.guidance,
+    render: content.render,
+    runtime: content.runtime
+  });
+}
 
 // src/contract/stamp.ts
 var AGENT_CONTEXT_RELATIVE_PATH = ".fragments/agent-context.md";
@@ -9650,7 +10161,7 @@ function parseContractStamp(text) {
   const fcidLine = STAMP_FCID_LINE.exec(text);
   if (!header || !fcidLine) return null;
   const contractVersion = Number(header[1]);
-  if (!Number.isSafeInteger(contractVersion)) return null;
+  if (!Number.isSafeInteger(contractVersion) || contractVersion < 1) return null;
   const fcid = fcidLine[1];
   if (!fcid.startsWith(header[2])) return null;
   const domainsLine = STAMP_DOMAINS_LINE.exec(text);
@@ -9936,24 +10447,1492 @@ function strongOverlap(overlap) {
 function withTarget(state, confidence, canonicalTarget) {
   return canonicalTarget ? { state, confidence, canonicalTarget } : { state, confidence };
 }
+
+// src/repository-binding.ts
+import { z as z8 } from "zod";
+var REPOSITORY_BINDING_ID_MAX_BYTES_V1 = 256;
+var PROVIDER_ID_MAX_BYTES_V1 = 64;
+var utf8Length = (value) => new TextEncoder().encode(value).byteLength;
+var boundedString = (label, maxBytes) => z8.string().min(1, `${label} is required`).refine((value) => utf8Length(value) <= maxBytes, `${label} exceeds ${maxBytes} UTF-8 bytes`);
+var providerSchema = boundedString("provider", PROVIDER_ID_MAX_BYTES_V1).transform((value) => value.trim().toLowerCase()).refine(
+  (value) => /^[a-z][a-z0-9_-]*$/u.test(value),
+  "provider must be a bounded lowercase identifier"
+);
+function normalizeProviderInstanceId(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) throw new TypeError("providerInstanceId is required");
+  if (trimmed.includes("://")) {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+      throw new TypeError("providerInstanceId URL must use http or https");
+    }
+    if (url.username || url.password || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") {
+      throw new TypeError("providerInstanceId must identify an origin, not a path or credential");
+    }
+    return url.host.toLowerCase().replace(/\.$/u, "");
+  }
+  const normalized = trimmed.toLowerCase().replace(/\.$/u, "");
+  if (!/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u.test(normalized)) {
+    throw new TypeError("providerInstanceId must be a normalized origin or tenant key");
+  }
+  return normalized;
+}
+var providerInstanceSchema = boundedString(
+  "providerInstanceId",
+  REPOSITORY_BINDING_ID_MAX_BYTES_V1
+).transform((value, context) => {
+  try {
+    return normalizeProviderInstanceId(value);
+  } catch (error) {
+    context.addIssue({
+      code: z8.ZodIssueCode.custom,
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return z8.NEVER;
+  }
+});
+var repositoryBindingKeyV1Schema = z8.object({
+  provider: providerSchema,
+  providerInstanceId: providerInstanceSchema,
+  repositoryExternalId: boundedString("repositoryExternalId", REPOSITORY_BINDING_ID_MAX_BYTES_V1),
+  bindingId: boundedString("bindingId", REPOSITORY_BINDING_ID_MAX_BYTES_V1)
+}).strict();
+function normalizeRepositoryBindingKeyV1(value) {
+  return repositoryBindingKeyV1Schema.parse(value);
+}
+function repositoryBindingDigestV1(value) {
+  const binding = normalizeRepositoryBindingKeyV1(value);
+  return digestHexSchema.parse(
+    sha256Hex(
+      canonicalPreimage({
+        schema: "repository-binding.v1",
+        provider: binding.provider,
+        providerInstanceId: binding.providerInstanceId,
+        repositoryExternalId: binding.repositoryExternalId,
+        bindingId: binding.bindingId
+      })
+    )
+  );
+}
+
+// src/analysis-plan/types.ts
+import { z as z9 } from "zod";
+var ANALYSIS_PLAN_MAX_REGIONS_V1 = 1e3;
+var ANALYSIS_PLAN_MAX_CAPABILITIES_V1 = 256;
+var ANALYSIS_PLAN_MAX_DIALECTS_PER_REGION_V1 = 64;
+var ANALYSIS_LIMIT_CEILINGS_V1 = {
+  maxSourceFiles: 1e5,
+  maxSourceBytes: 1073741824,
+  maxFileBytes: 10485760,
+  maxFacts: 1e6,
+  maxRegions: ANALYSIS_PLAN_MAX_REGIONS_V1,
+  maxDiagnostics: 1e5,
+  maxDurationMs: 9e5
+};
+var bounded = (max) => z9.string().min(1).max(max);
+var positiveBoundedInteger = (max) => z9.number().int().positive().max(max);
+var uniqueStrings = (values) => new Set(values).size === values.length;
+var coverageStateV1Schema = z9.enum([
+  "analyzed",
+  "unsupported",
+  "excluded_by_contract",
+  "skipped_limit",
+  "failed"
+]);
+var analysisLimitsV1Schema = z9.object({
+  maxSourceFiles: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxSourceFiles),
+  maxSourceBytes: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxSourceBytes),
+  maxFileBytes: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxFileBytes),
+  maxFacts: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxFacts),
+  maxRegions: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxRegions),
+  maxDiagnostics: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxDiagnostics),
+  maxDurationMs: positiveBoundedInteger(ANALYSIS_LIMIT_CEILINGS_V1.maxDurationMs)
+}).strict();
+var analysisRegionV1Schema = z9.object({
+  regionId: bounded(256),
+  pathPattern: bounded(4096),
+  kind: z9.enum(["component_source", "style_source", "token_source", "config"]),
+  language: bounded(64),
+  required: z9.boolean(),
+  requiredDialects: z9.array(bounded(128)).max(ANALYSIS_PLAN_MAX_DIALECTS_PER_REGION_V1).refine(uniqueStrings, "requiredDialects must be unique"),
+  analyzer: z9.object({
+    id: bounded(256),
+    interfaceVersion: bounded(128),
+    implementationVersion: bounded(128)
+  }).strict()
+}).strict();
+var coverageRegionV1Schema = z9.object({
+  regionId: bounded(256),
+  state: coverageStateV1Schema,
+  fileCount: z9.number().int().nonnegative().max(ANALYSIS_LIMIT_CEILINGS_V1.maxSourceFiles),
+  byteCount: z9.number().int().nonnegative().max(ANALYSIS_LIMIT_CEILINGS_V1.maxSourceBytes),
+  diagnosticIds: z9.array(bounded(256)).max(ANALYSIS_LIMIT_CEILINGS_V1.maxDiagnostics).refine(uniqueStrings, "diagnosticIds must be unique")
+}).strict();
+var coverageCountsV1Schema = z9.object({
+  analyzed: z9.number().int().nonnegative(),
+  unsupported: z9.number().int().nonnegative(),
+  excluded_by_contract: z9.number().int().nonnegative(),
+  skipped_limit: z9.number().int().nonnegative(),
+  failed: z9.number().int().nonnegative()
+}).strict();
+var coverageSummaryV1Schema = z9.object({
+  plannedRegions: z9.number().int().nonnegative(),
+  observedRegions: z9.number().int().nonnegative(),
+  requiredRegions: z9.number().int().nonnegative(),
+  requiredByState: coverageCountsV1Schema,
+  optionalByState: coverageCountsV1Schema,
+  eligibleFiles: z9.number().int().nonnegative(),
+  analyzedFiles: z9.number().int().nonnegative(),
+  analyzedBytes: z9.number().int().nonnegative()
+}).strict();
+var analysisPlanBaseShape = {
+  binding: repositoryBindingKeyV1Schema,
+  source: z9.object({
+    commitId: bounded(256),
+    treeId: bounded(256).optional(),
+    defaultBranch: bounded(256),
+    acquiredBy: z9.enum(["github_app", "local_worktree", "ci_attested"])
+  }).strict(),
+  contract: z9.object({
+    fcid: digestHexStringSchema,
+    artifactDigest: digestHexStringSchema
+  }).strict(),
+  config: z9.object({
+    path: bounded(4096).refine(
+      (value) => !value.startsWith("/") && !value.includes("\\") && !value.split("/").includes(".."),
+      "config path must be a portable repository-relative path"
+    ),
+    digest: digestHexStringSchema
+  }).strict(),
+  profile: z9.object({
+    id: z9.literal("react-web-v1"),
+    version: bounded(128),
+    capabilities: z9.array(bounded(128)).max(ANALYSIS_PLAN_MAX_CAPABILITIES_V1).refine(uniqueStrings, "capabilities must be unique")
+  }).strict(),
+  regions: z9.array(analysisRegionV1Schema).max(ANALYSIS_PLAN_MAX_REGIONS_V1).refine(
+    (regions) => new Set(regions.map((region) => region.regionId)).size === regions.length,
+    "regionId values must be unique"
+  ),
+  limits: analysisLimitsV1Schema,
+  evaluatorVersion: bounded(128),
+  createdAt: z9.string().datetime({ offset: true })
+};
+function validatePlanLimits(plan, context) {
+  if (plan.regions.length > plan.limits.maxRegions) {
+    context.addIssue({
+      code: z9.ZodIssueCode.custom,
+      path: ["regions"],
+      message: "Planned regions exceed the plan's maxRegions limit"
+    });
+  }
+  if (plan.limits.maxFileBytes > plan.limits.maxSourceBytes) {
+    context.addIssue({
+      code: z9.ZodIssueCode.custom,
+      path: ["limits", "maxFileBytes"],
+      message: "maxFileBytes cannot exceed maxSourceBytes"
+    });
+  }
+}
+var analysisPlanInputV1Schema = z9.object(analysisPlanBaseShape).strict().superRefine(validatePlanLimits);
+var analysisPlanV1Schema = z9.object({
+  schemaVersion: z9.literal(1),
+  analysisPlanId: analysisPlanIdStringSchema,
+  ...analysisPlanBaseShape,
+  obligationsDigest: digestHexStringSchema,
+  digest: digestHexStringSchema
+}).strict().superRefine(validatePlanLimits);
+
+// src/analysis-plan/digest.ts
+var sortedUnique = (values) => [...new Set(values)].sort();
+function semanticInput(input) {
+  return {
+    binding: input.binding,
+    source: input.source,
+    contract: input.contract,
+    config: input.config,
+    profile: input.profile,
+    regions: input.regions,
+    limits: input.limits,
+    evaluatorVersion: input.evaluatorVersion,
+    createdAt: input.createdAt
+  };
+}
+function normalizeRegion(region) {
+  return {
+    ...region,
+    requiredDialects: sortedUnique(region.requiredDialects),
+    analyzer: { ...region.analyzer }
+  };
+}
+function normalizeAnalysisPlanInputV1(input) {
+  const semantic = semanticInput(input);
+  const normalized = {
+    ...semantic,
+    binding: normalizeRepositoryBindingKeyV1(semantic.binding),
+    source: { ...semantic.source },
+    contract: { ...semantic.contract },
+    config: { ...semantic.config },
+    profile: {
+      ...semantic.profile,
+      capabilities: sortedUnique(semantic.profile.capabilities)
+    },
+    regions: semantic.regions.map(normalizeRegion).sort((left, right) => compareCanonicalStrings(left.regionId, right.regionId)),
+    limits: { ...semantic.limits }
+  };
+  return analysisPlanInputV1Schema.parse(normalized);
+}
+function obligationsProjection(normalized) {
+  return {
+    schema: "analysis-obligations.v1",
+    bindingDigest: repositoryBindingDigestV1(normalized.binding),
+    contract: normalized.contract,
+    config: normalized.config,
+    profile: normalized.profile,
+    regions: normalized.regions,
+    limits: normalized.limits,
+    evaluatorVersion: normalized.evaluatorVersion
+  };
+}
+function exactPlanProjection(normalized) {
+  return {
+    schema: "analysis-plan.v1",
+    bindingDigest: repositoryBindingDigestV1(normalized.binding),
+    source: {
+      commitId: normalized.source.commitId,
+      treeId: normalized.source.treeId,
+      acquiredBy: normalized.source.acquiredBy
+    },
+    contract: normalized.contract,
+    config: normalized.config,
+    profile: normalized.profile,
+    regions: normalized.regions,
+    limits: normalized.limits,
+    evaluatorVersion: normalized.evaluatorVersion
+  };
+}
+function analysisObligationsDigestV1(input) {
+  const normalized = normalizeAnalysisPlanInputV1(input);
+  return digestHexSchema.parse(sha256Hex(canonicalPreimage(obligationsProjection(normalized))));
+}
+function analysisPlanDigestV1(input) {
+  const normalized = normalizeAnalysisPlanInputV1(input);
+  return digestHexSchema.parse(sha256Hex(canonicalPreimage(exactPlanProjection(normalized))));
+}
+function buildAnalysisPlanV1(input) {
+  const normalized = normalizeAnalysisPlanInputV1(input);
+  const digest = digestHexSchema.parse(
+    sha256Hex(canonicalPreimage(exactPlanProjection(normalized)))
+  );
+  return analysisPlanV1Schema.parse({
+    schemaVersion: 1,
+    analysisPlanId: analysisPlanIdFromDigest(digest),
+    ...normalized,
+    obligationsDigest: digestHexSchema.parse(
+      sha256Hex(canonicalPreimage(obligationsProjection(normalized)))
+    ),
+    digest
+  });
+}
+function parseAnalysisPlanV1(value) {
+  const parsed = analysisPlanV1Schema.parse(value);
+  const rebuilt = buildAnalysisPlanV1({
+    binding: parsed.binding,
+    source: parsed.source,
+    contract: parsed.contract,
+    config: parsed.config,
+    profile: parsed.profile,
+    regions: parsed.regions,
+    limits: parsed.limits,
+    evaluatorVersion: parsed.evaluatorVersion,
+    createdAt: parsed.createdAt
+  });
+  if (parsed.analysisPlanId !== rebuilt.analysisPlanId || parsed.digest !== rebuilt.digest || parsed.obligationsDigest !== rebuilt.obligationsDigest) {
+    throw new TypeError("AnalysisPlanV1 derived identity does not match its semantic projection");
+  }
+  return rebuilt;
+}
+
+// src/analysis-plan/coverage.ts
+var COVERAGE_STATES = [
+  "analyzed",
+  "unsupported",
+  "excluded_by_contract",
+  "skipped_limit",
+  "failed"
+];
+function emptyCounts() {
+  return {
+    analyzed: 0,
+    unsupported: 0,
+    excluded_by_contract: 0,
+    skipped_limit: 0,
+    failed: 0
+  };
+}
+var CoverageValidationErrorV1 = class extends TypeError {
+  constructor(message, duplicateRegionIds = [], unknownRegionIds = [], missingRequiredRegionIds = [], missingOptionalRegionIds = []) {
+    super(message);
+    this.duplicateRegionIds = duplicateRegionIds;
+    this.unknownRegionIds = unknownRegionIds;
+    this.missingRequiredRegionIds = missingRequiredRegionIds;
+    this.missingOptionalRegionIds = missingOptionalRegionIds;
+    this.name = "CoverageValidationErrorV1";
+  }
+  duplicateRegionIds;
+  unknownRegionIds;
+  missingRequiredRegionIds;
+  missingOptionalRegionIds;
+};
+function normalizeCoverage(coverage) {
+  return coverage.map(
+    (observation) => coverageRegionV1Schema.parse({
+      ...observation,
+      diagnosticIds: [...observation.diagnosticIds].sort()
+    })
+  ).sort((left, right) => compareCanonicalStrings(left.regionId, right.regionId));
+}
+function deriveCoverageSummaryFromNormalizedV1(plan, coverage) {
+  const planned = new Map(plan.regions.map((region) => [region.regionId, region]));
+  const seen = /* @__PURE__ */ new Set();
+  const duplicateRegionIds = /* @__PURE__ */ new Set();
+  const unknownRegionIds = /* @__PURE__ */ new Set();
+  for (const observation of coverage) {
+    if (seen.has(observation.regionId)) duplicateRegionIds.add(observation.regionId);
+    seen.add(observation.regionId);
+    if (!planned.has(observation.regionId)) unknownRegionIds.add(observation.regionId);
+  }
+  const missingRequiredRegionIds = plan.regions.filter((region) => region.required && !seen.has(region.regionId)).map((region) => region.regionId);
+  const missingOptionalRegionIds = plan.regions.filter((region) => !region.required && !seen.has(region.regionId)).map((region) => region.regionId);
+  if (duplicateRegionIds.size > 0 || unknownRegionIds.size > 0 || missingRequiredRegionIds.length > 0 || missingOptionalRegionIds.length > 0) {
+    throw new CoverageValidationErrorV1(
+      "Coverage observations must join exactly once to every planned region",
+      [...duplicateRegionIds].sort(),
+      [...unknownRegionIds].sort(),
+      missingRequiredRegionIds.sort(),
+      missingOptionalRegionIds.sort()
+    );
+  }
+  const requiredByState = emptyCounts();
+  const optionalByState = emptyCounts();
+  let eligibleFiles = 0;
+  let analyzedFiles = 0;
+  let analyzedBytes = 0;
+  let observedBytes = 0;
+  let diagnosticCount = 0;
+  for (const observation of coverage) {
+    const region = planned.get(observation.regionId);
+    (region.required ? requiredByState : optionalByState)[observation.state] += 1;
+    if (observation.state !== "excluded_by_contract") eligibleFiles += observation.fileCount;
+    if (observation.state === "analyzed") {
+      analyzedFiles += observation.fileCount;
+      analyzedBytes += observation.byteCount;
+    }
+    observedBytes += observation.byteCount;
+    diagnosticCount += observation.diagnosticIds.length;
+  }
+  if (!Number.isSafeInteger(eligibleFiles) || !Number.isSafeInteger(analyzedFiles) || !Number.isSafeInteger(analyzedBytes) || !Number.isSafeInteger(observedBytes) || !Number.isSafeInteger(diagnosticCount)) {
+    throw new RangeError("Coverage totals exceeded the safe integer range");
+  }
+  if (eligibleFiles > plan.limits.maxSourceFiles) {
+    throw new CoverageValidationErrorV1("Coverage file total exceeds the analysis-plan limit");
+  }
+  if (observedBytes > plan.limits.maxSourceBytes) {
+    throw new CoverageValidationErrorV1("Coverage byte total exceeds the analysis-plan limit");
+  }
+  if (diagnosticCount > plan.limits.maxDiagnostics) {
+    throw new CoverageValidationErrorV1(
+      "Coverage diagnostic total exceeds the analysis-plan limit"
+    );
+  }
+  for (const state of COVERAGE_STATES) {
+    if (!Number.isSafeInteger(requiredByState[state]) || !Number.isSafeInteger(optionalByState[state])) {
+      throw new RangeError("Coverage count exceeded the safe integer range");
+    }
+  }
+  return coverageSummaryV1Schema.parse({
+    plannedRegions: plan.regions.length,
+    observedRegions: coverage.length,
+    requiredRegions: plan.regions.filter((region) => region.required).length,
+    requiredByState,
+    optionalByState,
+    eligibleFiles,
+    analyzedFiles,
+    analyzedBytes
+  });
+}
+function deriveCoverageSummaryV1(rawPlan, rawCoverage) {
+  return deriveCoverageSummaryFromNormalizedV1(
+    parseAnalysisPlanV1(rawPlan),
+    normalizeCoverage(rawCoverage)
+  );
+}
+function coverageArtifactDigestV1(rawPlan, rawCoverage) {
+  const plan = parseAnalysisPlanV1(rawPlan);
+  const coverage = normalizeCoverage(rawCoverage);
+  const summary = deriveCoverageSummaryFromNormalizedV1(plan, coverage);
+  return digestHexSchema.parse(
+    sha256Hex(
+      canonicalPreimage({
+        schema: "analysis-coverage.v1",
+        analysisPlanDigest: plan.digest,
+        coverage,
+        summary
+      })
+    )
+  );
+}
+
+// src/evaluation/types.ts
+var EVALUATOR_VERSION = "evaluation-kernel:v1";
+var EVALUATOR_VERSION_V2 = "evaluation-kernel:v2";
+
+// src/evaluation/receipt.ts
+import { z as z10 } from "zod";
+var EVALUATION_MAX_WAIVERS_V2 = 1e3;
+var EVALUATION_MAX_WAIVER_MATCHES_V2 = 1e4;
+var EVALUATION_MAX_FINDINGS_V2 = 1e4;
+var EVALUATION_MAX_REASON_CODES_V2 = 64;
+var EVALUATION_MAX_MAP_ENTRIES_V2 = 1e5;
+var EVALUATION_MAX_POLICY_RULES_V2 = 1e4;
+var EVALUATION_RECEIPT_STRING_MAX_BYTES_V1 = 4096;
+var utf8Length2 = (value) => new TextEncoder().encode(value).byteLength;
+var boundedString2 = (maxBytes = EVALUATION_RECEIPT_STRING_MAX_BYTES_V1) => z10.string().min(1).refine((value) => utf8Length2(value) <= maxBytes, `Value exceeds ${maxBytes} UTF-8 bytes`);
+var unique = (values) => new Set(values).size === values.length;
+var contractPreimageV1Schema = z10.object({
+  schema: z10.literal(CONTRACT_PREIMAGE_SCHEMA),
+  domains: z10.object({
+    components: digestHexStringSchema,
+    tokens: digestHexStringSchema,
+    canonicalMap: digestHexStringSchema,
+    policy: digestHexStringSchema
+  }).strict()
+}).strict();
+var effectiveRulePolicySchema = z10.object({ trust: z10.enum(["canonical", "evidence", "none"]).optional() }).strict();
+var effectivePolicySchema = z10.object({
+  failOnWarnings: z10.boolean(),
+  failOnInert: z10.boolean().optional(),
+  rules: z10.record(boundedString2(), effectiveRulePolicySchema).refine(
+    (rules) => Object.keys(rules).length <= EVALUATION_MAX_POLICY_RULES_V2,
+    "Policy rule map exceeds the V2 limit"
+  ).optional()
+}).strict();
+var evaluationTrustSchema = z10.object({
+  source: z10.enum(["verified", "unverified", "unknown"]),
+  sources: z10.record(boundedString2(), z10.enum(["verified", "unverified", "unknown"])).refine(
+    (sources) => Object.keys(sources).length <= EVALUATION_MAX_MAP_ENTRIES_V2,
+    "Source trust map exceeds the V2 limit"
+  ).optional(),
+  mappings: z10.record(boundedString2(), z10.enum(["confirmed", "unconfirmed", "unknown"])).refine(
+    (mappings) => Object.keys(mappings).length <= EVALUATION_MAX_MAP_ENTRIES_V2,
+    "Mapping trust map exceeds the V2 limit"
+  )
+}).strict();
+var waiverScopeSchema = z10.discriminatedUnion("kind", [
+  z10.object({ kind: z10.literal("finding"), fingerprint: boundedString2() }).strict(),
+  z10.object({ kind: z10.literal("rule"), ruleId: boundedString2() }).strict(),
+  z10.object({ kind: z10.literal("path"), pathPattern: boundedString2() }).strict(),
+  z10.object({ kind: z10.literal("rule_path"), ruleId: boundedString2(), pathPattern: boundedString2() }).strict()
+]);
+var effectiveEvaluationWaiverV2Schema = z10.object({
+  waiverId: boundedString2(),
+  scope: waiverScopeSchema,
+  matchedFindingFingerprints: z10.array(boundedString2()).min(1).max(EVALUATION_MAX_WAIVER_MATCHES_V2).refine(unique, "matched finding fingerprints must be unique"),
+  reason: boundedString2(),
+  expiresAt: z10.number().finite().optional()
+}).strict();
+var evaluationIntegrityInputV2Schema = z10.object({
+  governance: z10.enum(["healthy", "inert"]),
+  inertConfigDiagnosticCount: z10.number().int().nonnegative(),
+  profile: z10.discriminatedUnion("state", [
+    z10.object({
+      state: z10.literal("known"),
+      profileId: boundedString2(),
+      profileVersion: boundedString2()
+    }).strict(),
+    z10.object({
+      state: z10.literal("unknown"),
+      profileId: boundedString2(),
+      profileVersion: boundedString2().optional()
+    }).strict()
+  ]),
+  facts: canonicalFactIntegrityV1Schema
+}).strict();
+var baselineSchema = z10.object({
+  identity: z10.object({
+    bindingDigest: digestHexStringSchema,
+    repositoryExternalId: boundedString2(),
+    fcid: digestHexStringSchema,
+    sourceCommitId: boundedString2(),
+    generationId: boundedString2()
+  }).strict(),
+  findingStates: z10.record(boundedString2(), z10.enum(["introduced", "existing", "unknown"])).refine(
+    (states) => Object.keys(states).length <= EVALUATION_MAX_MAP_ENTRIES_V2,
+    "Baseline finding-state map exceeds the V2 limit"
+  )
+}).strict();
+var evaluationInputV2RawSchema = z10.object({
+  schemaVersion: z10.literal(2),
+  binding: repositoryBindingKeyV1Schema,
+  analysisPlan: analysisPlanV1Schema,
+  contract: z10.object({
+    fcid: digestHexStringSchema,
+    preimage: contractPreimageV1Schema,
+    active: z10.boolean()
+  }).strict(),
+  factSchemaVersion: boundedString2(256),
+  facts: z10.instanceof(FactIndex),
+  factsDigest: digestHexStringSchema,
+  coverage: z10.array(coverageRegionV1Schema).max(1e3),
+  policy: effectivePolicySchema,
+  baseline: baselineSchema.optional(),
+  adoption: z10.union([z10.literal("unavailable"), z10.object({ regressed: z10.boolean() }).strict()]).optional(),
+  trust: evaluationTrustSchema.optional(),
+  waivers: z10.array(effectiveEvaluationWaiverV2Schema).max(EVALUATION_MAX_WAIVERS_V2).refine(
+    (waivers) => new Set(waivers.map((waiver) => waiver.waiverId)).size === waivers.length,
+    "waiver IDs must be unique"
+  ),
+  integrity: evaluationIntegrityInputV2Schema,
+  evaluatedAt: z10.number().finite(),
+  evaluatorVersion: boundedString2(256)
+}).strict().superRefine((input, context) => {
+  let plan;
+  try {
+    plan = parseAnalysisPlanV1(input.analysisPlan);
+  } catch (error) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["analysisPlan"],
+      message: error instanceof Error ? error.message : "Invalid analysis plan identity"
+    });
+    return;
+  }
+  if (repositoryBindingDigestV1(plan.binding) !== repositoryBindingDigestV1(input.binding)) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["binding"],
+      message: "Evaluation binding does not match the analysis plan binding"
+    });
+  }
+  if (plan.contract.fcid !== input.contract.fcid) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["contract", "fcid"],
+      message: "Evaluation FCID does not match the analysis plan"
+    });
+  }
+  if (contractHash(input.contract.preimage) !== input.contract.fcid) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["contract", "preimage"],
+      message: "Contract preimage does not reproduce the pinned FCID"
+    });
+  }
+  if (plan.evaluatorVersion !== input.evaluatorVersion) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["evaluatorVersion"],
+      message: "Evaluator version does not match the analysis plan"
+    });
+  }
+  if (input.integrity.profile.state === "known" && (input.integrity.profile.profileId !== plan.profile.id || input.integrity.profile.profileVersion !== plan.profile.version)) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["integrity", "profile"],
+      message: "Known profile identity does not match the analysis plan"
+    });
+  }
+  if (input.baseline) {
+    const expectedBindingDigest = repositoryBindingDigestV1(input.binding);
+    if (input.baseline.identity.bindingDigest !== expectedBindingDigest || input.baseline.identity.repositoryExternalId !== input.binding.repositoryExternalId || input.baseline.identity.fcid !== input.contract.fcid) {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path: ["baseline", "identity"],
+        message: "Baseline identity does not match the evaluation binding and FCID"
+      });
+    }
+  }
+  if (input.facts.size() > plan.limits.maxFacts) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["facts"],
+      message: "Fact count exceeds the analysis-plan limit"
+    });
+  }
+  try {
+    deriveCoverageSummaryV1(plan, input.coverage);
+  } catch (error) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["coverage"],
+      message: error instanceof Error ? error.message : "Coverage does not match the plan"
+    });
+  }
+});
+var evaluationInputV2Schema = evaluationInputV2RawSchema.transform(
+  (input) => ({
+    ...input,
+    binding: normalizeRepositoryBindingKeyV1(input.binding),
+    analysisPlan: parseAnalysisPlanV1(input.analysisPlan)
+  })
+);
+var evaluationReasonV2Schema = z10.enum([
+  "zeroFileScan",
+  "governanceInert",
+  "contractUnpinned",
+  "contractStale",
+  "contractIdentityMismatch",
+  "inertConfigPresent",
+  "unknownPresetPresent",
+  "blockedFindings",
+  "adoptionRegression",
+  "expiredSuppression",
+  "pendingCloudTrust",
+  "adoptionBaselineUnavailable",
+  "analysisPlanIdentityMismatch",
+  "requiredCoverageMissing",
+  "requiredCoverageIncomplete",
+  "factConflict",
+  "unknownAnalysisProfile"
+]);
+var evaluationResultV2Schema = z10.object({
+  schemaVersion: z10.literal(2),
+  verdict: z10.enum(["pass", "block", "indeterminate"]),
+  reasons: z10.array(evaluationReasonV2Schema).max(EVALUATION_MAX_REASON_CODES_V2).refine(unique, "Evaluation reason codes must be unique"),
+  findings: z10.array(
+    z10.object({
+      fingerprint: boundedString2(),
+      ruleId: boundedString2(),
+      severity: z10.enum(["error", "warn", "info"]),
+      state: z10.enum(["blocked", "advisory", "pending_cloud_trust"]),
+      stateReasons: z10.array(boundedString2()).max(256)
+    }).strict()
+  ).max(EVALUATION_MAX_FINDINGS_V2),
+  counts: z10.object({
+    blocked: z10.number().int().nonnegative().max(EVALUATION_MAX_FINDINGS_V2),
+    advisory: z10.number().int().nonnegative().max(EVALUATION_MAX_FINDINGS_V2),
+    pendingCloudTrust: z10.number().int().nonnegative().max(EVALUATION_MAX_FINDINGS_V2)
+  }).strict(),
+  derived: z10.object({ warnPresent: z10.boolean(), gatingFindingsPresent: z10.boolean() }).strict(),
+  coverageSummary: coverageSummaryV1Schema,
+  integrity: z10.object({
+    fcidVerified: z10.boolean(),
+    analysisPlanVerified: z10.boolean(),
+    factIntegrity: z10.enum(["healthy", "conflict"]),
+    requiredCoverage: z10.enum(["complete", "incomplete", "no_required_regions"]),
+    governance: z10.enum(["healthy", "inert"]),
+    profile: z10.enum(["known", "unknown"])
+  }).strict(),
+  inputDigest: digestHexStringSchema,
+  resultDigest: digestHexStringSchema
+}).strict().superRefine((result, context) => {
+  const expectedCounts = { blocked: 0, advisory: 0, pendingCloudTrust: 0 };
+  let emittedWarnPresent = false;
+  for (const [index, finding] of result.findings.entries()) {
+    if (finding.state === "blocked") expectedCounts.blocked += 1;
+    else if (finding.state === "pending_cloud_trust") expectedCounts.pendingCloudTrust += 1;
+    else expectedCounts.advisory += 1;
+    if (finding.severity === "warn") emittedWarnPresent = true;
+    if (new Set(finding.stateReasons).size !== finding.stateReasons.length) {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path: ["findings", index, "stateReasons"],
+        message: "Finding state reasons must be unique"
+      });
+    }
+  }
+  if (new Set(result.findings.map((finding) => finding.fingerprint)).size !== result.findings.length) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["findings"],
+      message: "Evaluation finding fingerprints must be unique"
+    });
+  }
+  for (const key of ["blocked", "advisory", "pendingCloudTrust"]) {
+    if (result.counts[key] !== expectedCounts[key]) {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path: ["counts", key],
+        message: `Evaluation ${key} count must match findings`
+      });
+    }
+  }
+  if (emittedWarnPresent && !result.derived.warnPresent) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["derived", "warnPresent"],
+      message: "An emitted warning finding requires warnPresent"
+    });
+  }
+  if (result.derived.gatingFindingsPresent !== expectedCounts.blocked > 0) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["derived", "gatingFindingsPresent"],
+      message: "gatingFindingsPresent must match blocked findings"
+    });
+  }
+  const coverageStates = [
+    "analyzed",
+    "unsupported",
+    "excluded_by_contract",
+    "skipped_limit",
+    "failed"
+  ];
+  const requiredCount = coverageStates.reduce(
+    (total, state) => total + result.coverageSummary.requiredByState[state],
+    0
+  );
+  const optionalCount = coverageStates.reduce(
+    (total, state) => total + result.coverageSummary.optionalByState[state],
+    0
+  );
+  if (requiredCount !== result.coverageSummary.requiredRegions || requiredCount + optionalCount !== result.coverageSummary.observedRegions || result.coverageSummary.observedRegions !== result.coverageSummary.plannedRegions) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["coverageSummary"],
+      message: "Coverage summary counts must reconcile with planned and observed regions"
+    });
+  }
+  if (result.coverageSummary.analyzedFiles > result.coverageSummary.eligibleFiles) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["coverageSummary", "analyzedFiles"],
+      message: "Analyzed files cannot exceed eligible files"
+    });
+  }
+  const expectedRequiredCoverage = result.coverageSummary.requiredRegions === 0 ? "no_required_regions" : result.coverageSummary.requiredByState.analyzed === result.coverageSummary.requiredRegions ? "complete" : "incomplete";
+  if (result.integrity.requiredCoverage !== expectedRequiredCoverage) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["integrity", "requiredCoverage"],
+      message: "Required coverage integrity must match the derived coverage summary"
+    });
+  }
+  const reasons = new Set(result.reasons);
+  const requireReason = (reason, required, path) => {
+    if (reasons.has(reason) !== required) {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path,
+        message: `${reason} must match the evaluation result`
+      });
+    }
+  };
+  requireReason("blockedFindings", expectedCounts.blocked > 0, ["reasons"]);
+  requireReason("pendingCloudTrust", expectedCounts.pendingCloudTrust > 0, ["reasons"]);
+  requireReason("contractIdentityMismatch", !result.integrity.fcidVerified, ["reasons"]);
+  requireReason("analysisPlanIdentityMismatch", !result.integrity.analysisPlanVerified, [
+    "reasons"
+  ]);
+  requireReason("factConflict", result.integrity.factIntegrity === "conflict", ["reasons"]);
+  requireReason("governanceInert", result.integrity.governance === "inert", ["reasons"]);
+  requireReason("unknownAnalysisProfile", result.integrity.profile === "unknown", ["reasons"]);
+  requireReason(
+    "requiredCoverageIncomplete",
+    result.integrity.requiredCoverage === "incomplete",
+    ["reasons"]
+  );
+  requireReason(
+    "requiredCoverageMissing",
+    result.integrity.requiredCoverage === "no_required_regions",
+    ["reasons"]
+  );
+  const integrityHealthy = result.integrity.fcidVerified && result.integrity.analysisPlanVerified && result.integrity.factIntegrity === "healthy" && result.integrity.requiredCoverage === "complete" && result.integrity.governance === "healthy" && result.integrity.profile === "known";
+  const blockingReasons = /* @__PURE__ */ new Set([
+    "blockedFindings",
+    "adoptionRegression",
+    "expiredSuppression"
+  ]);
+  const integrityReasons = /* @__PURE__ */ new Set([
+    "zeroFileScan",
+    "governanceInert",
+    "contractUnpinned",
+    "contractStale",
+    "contractIdentityMismatch",
+    "inertConfigPresent",
+    "unknownPresetPresent",
+    "analysisPlanIdentityMismatch",
+    "requiredCoverageMissing",
+    "requiredCoverageIncomplete",
+    "factConflict",
+    "unknownAnalysisProfile"
+  ]);
+  const expectedVerdict = !integrityHealthy || result.reasons.some((reason) => integrityReasons.has(reason)) ? "indeterminate" : result.reasons.some((reason) => blockingReasons.has(reason)) ? "block" : result.reasons.length > 0 ? "indeterminate" : "pass";
+  if (result.verdict !== expectedVerdict) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["verdict"],
+      message: `Evaluation verdict must be ${expectedVerdict} for its reasons and integrity`
+    });
+  }
+});
+var providerProofSemanticV1Schema = z10.object({
+  schemaVersion: z10.literal(1),
+  adapterId: boundedString2(),
+  adapterVersion: boundedString2(),
+  providerInstanceId: boundedString2(),
+  bindingDigest: digestHexStringSchema,
+  repositoryExternalId: boundedString2(),
+  sourceCommitId: boundedString2(),
+  eventExternalId: boundedString2(),
+  changeExternalId: boundedString2().optional(),
+  publisherExternalId: boundedString2()
+}).strict();
+function providerProofDigestV1(value) {
+  const proof = providerProofSemanticV1Schema.parse(value);
+  return sha256Hex(canonicalPreimage({ schema: "provider-proof.v1", ...proof }));
+}
+var providerProofV1Schema = z10.object({
+  schemaVersion: z10.literal(1),
+  adapterId: boundedString2(),
+  adapterVersion: boundedString2(),
+  providerInstanceId: boundedString2(),
+  bindingDigest: digestHexStringSchema,
+  repositoryExternalId: boundedString2(),
+  sourceCommitId: boundedString2(),
+  eventExternalId: boundedString2(),
+  changeExternalId: boundedString2().optional(),
+  publisherExternalId: boundedString2(),
+  proofDigest: digestHexStringSchema
+}).strict().superRefine((proof, context) => {
+  const { proofDigest, ...semantic } = proof;
+  if (providerProofDigestV1(semantic) !== proofDigest) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["proofDigest"],
+      message: "Provider proof digest mismatch"
+    });
+  }
+});
+var receiptSemanticShape = {
+  schemaVersion: z10.literal(1),
+  trust: z10.enum(["source_verified", "ci_attested", "local", "unknown"]),
+  authority: z10.enum(["advisory", "enforcement_eligible"]),
+  binding: repositoryBindingKeyV1Schema,
+  sourceCommitId: boundedString2(),
+  fcid: digestHexStringSchema,
+  analysisPlanDigest: digestHexStringSchema,
+  factsDigest: digestHexStringSchema,
+  inputDigest: digestHexStringSchema,
+  resultDigest: digestHexStringSchema,
+  evaluatorVersion: boundedString2(),
+  providerProof: providerProofV1Schema.optional()
+};
+function validateReceiptSemantics(receipt, context) {
+  if (receipt.authority === "enforcement_eligible") {
+    if (receipt.trust !== "source_verified") {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path: ["authority"],
+        message: "Only source-verified evidence can enforce"
+      });
+    }
+    if (!receipt.providerProof) {
+      context.addIssue({
+        code: z10.ZodIssueCode.custom,
+        path: ["providerProof"],
+        message: "Source-verified enforcement requires provider proof"
+      });
+    }
+  }
+  if (receipt.trust === "source_verified" && !receipt.providerProof) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof"],
+      message: "Source-verified trust requires provider proof"
+    });
+  }
+  if (receipt.trust !== "source_verified" && receipt.providerProof) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof"],
+      message: "Provider proof is reserved for source-verified trust"
+    });
+  }
+  if (!receipt.providerProof) return;
+  const proof = receipt.providerProof;
+  const binding = normalizeRepositoryBindingKeyV1(receipt.binding);
+  if (proof.bindingDigest !== repositoryBindingDigestV1(binding)) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof", "bindingDigest"],
+      message: "Provider proof binding mismatch"
+    });
+  }
+  if (proof.providerInstanceId !== binding.providerInstanceId) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof", "providerInstanceId"],
+      message: "Provider proof instance mismatch"
+    });
+  }
+  if (proof.repositoryExternalId !== binding.repositoryExternalId) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof", "repositoryExternalId"],
+      message: "Provider proof repository mismatch"
+    });
+  }
+  if (proof.sourceCommitId !== receipt.sourceCommitId) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["providerProof", "sourceCommitId"],
+      message: "Provider proof source mismatch"
+    });
+  }
+}
+var evaluationReceiptSemanticV1Schema = z10.object(receiptSemanticShape).strict().superRefine(validateReceiptSemantics);
+function evaluationReceiptDigestV1(value) {
+  const receipt = evaluationReceiptSemanticV1Schema.parse(value);
+  return sha256Hex(
+    canonicalPreimage({
+      schema: "evaluation-receipt.v1",
+      trust: receipt.trust,
+      authority: receipt.authority,
+      bindingDigest: repositoryBindingDigestV1(receipt.binding),
+      sourceCommitId: receipt.sourceCommitId,
+      fcid: receipt.fcid,
+      analysisPlanDigest: receipt.analysisPlanDigest,
+      factsDigest: receipt.factsDigest,
+      inputDigest: receipt.inputDigest,
+      resultDigest: receipt.resultDigest,
+      evaluatorVersion: receipt.evaluatorVersion,
+      providerProofDigest: receipt.providerProof?.proofDigest
+    })
+  );
+}
+var evaluationReceiptV1Schema = z10.object({
+  receiptId: evaluationReceiptIdStringSchema,
+  ...receiptSemanticShape,
+  mintedAt: z10.string().datetime({ offset: true }),
+  digest: digestHexStringSchema
+}).strict().superRefine((receipt, context) => {
+  validateReceiptSemantics(receipt, context);
+  let digest;
+  try {
+    const { receiptId: _receiptId, mintedAt: _mintedAt, digest: _digest, ...semantic } = receipt;
+    digest = evaluationReceiptDigestV1(semantic);
+  } catch (error) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      message: error instanceof Error ? error.message : "Invalid receipt semantics"
+    });
+    return;
+  }
+  if (digest !== receipt.digest) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["digest"],
+      message: "Receipt digest mismatch"
+    });
+  }
+  if (evaluationReceiptIdFromDigest(digest) !== receipt.receiptId) {
+    context.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["receiptId"],
+      message: "Receipt ID mismatch"
+    });
+  }
+});
+function parseEvaluationReceiptV1(value) {
+  return evaluationReceiptV1Schema.parse(value);
+}
+var evaluationReceiptMintInputV1Schema = z10.object({
+  schemaVersion: z10.literal(1),
+  trust: z10.enum(["ci_attested", "local", "unknown"]),
+  binding: repositoryBindingKeyV1Schema,
+  sourceCommitId: boundedString2(),
+  fcid: digestHexStringSchema,
+  analysisPlanDigest: digestHexStringSchema,
+  factsDigest: digestHexStringSchema,
+  inputDigest: digestHexStringSchema,
+  resultDigest: digestHexStringSchema,
+  evaluatorVersion: boundedString2()
+}).strict();
+
+// src/evaluation/evaluate.ts
+var INTEGRITY_REASONS = /* @__PURE__ */ new Set([
+  "zeroFileScan",
+  "governanceInert",
+  "contractUnpinned",
+  "contractStale",
+  "contractIdentityMismatch",
+  "inertConfigPresent",
+  "unknownPresetPresent"
+]);
+var BLOCK_REASONS = /* @__PURE__ */ new Set([
+  "blockedFindings",
+  "adoptionRegression",
+  "expiredSuppression"
+]);
+var REASON_ORDER = [
+  "zeroFileScan",
+  "governanceInert",
+  "contractUnpinned",
+  "contractStale",
+  "contractIdentityMismatch",
+  "inertConfigPresent",
+  "unknownPresetPresent",
+  "blockedFindings",
+  "adoptionRegression",
+  "expiredSuppression",
+  "pendingCloudTrust",
+  "adoptionBaselineUnavailable"
+];
+function evaluate2(input) {
+  return isEvaluationInputV2(input) ? evaluateV2(input) : evaluateV1(input);
+}
+function isEvaluationInputV2(input) {
+  return "schemaVersion" in input && input.schemaVersion === 2;
+}
+function evaluateV1(input) {
+  const reasons = /* @__PURE__ */ new Set();
+  let fcidVerified = "unavailable";
+  if (input.contract.state === "unpinned") {
+    reasons.add("contractUnpinned");
+  } else {
+    if (input.contract.stale) reasons.add("contractStale");
+    if (input.contract.preimage) {
+      fcidVerified = contractHash(input.contract.preimage) === input.contract.fcid;
+      if (!fcidVerified) reasons.add("contractIdentityMismatch");
+    }
+  }
+  if (input.scope.kind === "full" && input.scope.coverage.filesScanned === 0) {
+    reasons.add("zeroFileScan");
+  }
+  if (input.integrity.governance === "inert") {
+    reasons.add("governanceInert");
+  }
+  if (input.policy.failOnInert === true && (input.integrity.inertConfigDiagnostics ?? 0) > 0) {
+    reasons.add("inertConfigPresent");
+  }
+  if ((input.integrity.unknownPresets?.length ?? 0) > 0) {
+    reasons.add("unknownPresetPresent");
+  }
+  if (input.adoption === "unavailable") {
+    reasons.add("adoptionBaselineUnavailable");
+  } else if (input.adoption?.regressed === true) {
+    reasons.add("adoptionRegression");
+  }
+  const activeWaivers = /* @__PURE__ */ new Set();
+  for (const waiver of input.waivers ?? []) {
+    if (waiver.expiresAt !== void 0 && Number.isFinite(waiver.expiresAt) && waiver.expiresAt <= input.evaluatedAt) {
+      reasons.add("expiredSuppression");
+    } else {
+      activeWaivers.add(waiver.fingerprint);
+    }
+  }
+  const evidence = evidenceFindings(input);
+  const findings = [...groupByFingerprint(evidence).values()].map((rows) => {
+    const classified = rows.map((row) => classifyFinding(row, input, activeWaivers));
+    return classified.reduce(
+      (hardest, candidate) => STATE_RANK[candidate.state] < STATE_RANK[hardest.state] ? candidate : hardest
+    );
+  });
+  const counts = { blocked: 0, advisory: 0, pendingCloudTrust: 0 };
+  for (const finding of findings) {
+    if (finding.state === "blocked") counts.blocked += 1;
+    else if (finding.state === "pending_cloud_trust") counts.pendingCloudTrust += 1;
+    else counts.advisory += 1;
+  }
+  if (counts.blocked > 0) reasons.add("blockedFindings");
+  if (counts.pendingCloudTrust > 0) reasons.add("pendingCloudTrust");
+  const ordered = REASON_ORDER.filter((reason) => reasons.has(reason));
+  let verdict;
+  if (ordered.some((reason) => INTEGRITY_REASONS.has(reason))) {
+    verdict = "indeterminate";
+  } else if (ordered.some((reason) => BLOCK_REASONS.has(reason))) {
+    verdict = "block";
+  } else if (ordered.length > 0) {
+    verdict = "indeterminate";
+  } else {
+    verdict = "pass";
+  }
+  const derived = {
+    warnPresent: evidence.some((finding) => finding.severity === "warn"),
+    gatingFindingsPresent: counts.blocked > 0
+  };
+  const inputDigest = sha256Hex(canonicalPreimage(normalizeInputForDigest(input)));
+  const partial = {
+    evaluatorVersion: EVALUATOR_VERSION,
+    verdict,
+    reasons: ordered,
+    findings,
+    counts,
+    derived,
+    integrity: { fcidVerified }
+  };
+  return {
+    ...partial,
+    inputDigest,
+    resultDigest: sha256Hex(canonicalPreimage({ ...partial, inputDigest }))
+  };
+}
+var V2_REASON_ORDER = [
+  "analysisPlanIdentityMismatch",
+  "requiredCoverageMissing",
+  "requiredCoverageIncomplete",
+  "factConflict",
+  "unknownAnalysisProfile",
+  ...REASON_ORDER
+];
+var V2_INTEGRITY_REASONS = /* @__PURE__ */ new Set([
+  ...INTEGRITY_REASONS,
+  "analysisPlanIdentityMismatch",
+  "requiredCoverageMissing",
+  "requiredCoverageIncomplete",
+  "factConflict",
+  "unknownAnalysisProfile"
+]);
+var SUPPORTED_FACT_SCHEMA_VERSIONS_V2 = /* @__PURE__ */ new Set(["facts:v1"]);
+var SUPPORTED_REACT_WEB_PROFILE_VERSIONS_V1 = /* @__PURE__ */ new Set(["1"]);
+function evaluateV2(rawInput) {
+  if (rawInput.evaluatorVersion !== EVALUATOR_VERSION_V2) {
+    throw new Error(`Unsupported evaluator version: ${rawInput.evaluatorVersion}`);
+  }
+  if (!SUPPORTED_FACT_SCHEMA_VERSIONS_V2.has(rawInput.factSchemaVersion)) {
+    throw new Error(`Unsupported fact schema version: ${rawInput.factSchemaVersion}`);
+  }
+  const input = evaluationInputV2Schema.parse(rawInput);
+  const coverageSummary = deriveCoverageSummaryV1(input.analysisPlan, input.coverage);
+  const profileKnown = input.integrity.profile.state === "known" && input.analysisPlan.profile.id === "react-web-v1" && SUPPORTED_REACT_WEB_PROFILE_VERSIONS_V1.has(input.analysisPlan.profile.version);
+  const compatibilityInput = {
+    contract: {
+      state: "pinned",
+      fcid: input.contract.fcid,
+      preimage: input.contract.preimage,
+      ...!input.contract.active ? { stale: true } : {}
+    },
+    scope: { kind: "full", coverage: { filesScanned: coverageSummary.analyzedFiles } },
+    evidence: { kind: "facts", facts: input.facts },
+    policy: input.policy,
+    ...input.baseline ? {
+      baseline: {
+        identityVerified: true,
+        findingStates: input.baseline.findingStates
+      }
+    } : {},
+    ...input.adoption !== void 0 ? { adoption: input.adoption } : {},
+    ...input.trust !== void 0 ? { trust: input.trust } : {},
+    waivers: input.waivers.flatMap(
+      (waiver) => waiver.matchedFindingFingerprints.map((fingerprint) => ({
+        fingerprint,
+        ...waiver.expiresAt !== void 0 ? { expiresAt: waiver.expiresAt } : {}
+      }))
+    ),
+    integrity: {
+      governance: input.integrity.governance,
+      ...input.integrity.inertConfigDiagnosticCount > 0 ? { inertConfigDiagnostics: input.integrity.inertConfigDiagnosticCount } : {}
+    },
+    evaluatedAt: input.evaluatedAt
+  };
+  const compatibilityResult = evaluateV1(compatibilityInput);
+  const requiredCoverage = coverageSummary.requiredRegions === 0 ? "no_required_regions" : coverageSummary.requiredByState.analyzed === coverageSummary.requiredRegions ? "complete" : "incomplete";
+  const integrity = {
+    fcidVerified: compatibilityResult.integrity.fcidVerified === true,
+    analysisPlanVerified: true,
+    factIntegrity: input.integrity.facts.state,
+    requiredCoverage,
+    governance: input.integrity.governance,
+    profile: profileKnown ? "known" : "unknown"
+  };
+  const reasons = new Set(compatibilityResult.reasons);
+  if (requiredCoverage === "no_required_regions") reasons.add("requiredCoverageMissing");
+  if (requiredCoverage === "incomplete") reasons.add("requiredCoverageIncomplete");
+  if (integrity.factIntegrity === "conflict") reasons.add("factConflict");
+  if (integrity.profile === "unknown") reasons.add("unknownAnalysisProfile");
+  const orderedReasons = V2_REASON_ORDER.filter((reason) => reasons.has(reason));
+  let verdict = compatibilityResult.verdict;
+  if (orderedReasons.some((reason) => V2_INTEGRITY_REASONS.has(reason))) {
+    verdict = "indeterminate";
+  }
+  const inputDigest = evaluationInputDigestV2(input);
+  const partial = {
+    schemaVersion: 2,
+    verdict,
+    reasons: orderedReasons,
+    findings: compatibilityResult.findings.map((finding) => ({
+      ...finding,
+      stateReasons: [...finding.stateReasons]
+    })),
+    counts: { ...compatibilityResult.counts },
+    derived: { ...compatibilityResult.derived },
+    coverageSummary,
+    integrity
+  };
+  const resultDigest = evaluationResultDigestV2({ ...partial, inputDigest });
+  return evaluationResultV2Schema.parse({ ...partial, inputDigest, resultDigest });
+}
+function evaluationInputDigestV2(input) {
+  return sha256Hex(
+    canonicalPreimage(
+      normalizeInputV2ForDigest(input, deriveCoverageSummaryV1(input.analysisPlan, input.coverage))
+    )
+  );
+}
+function evaluationResultDigestV2(result) {
+  return sha256Hex(canonicalPreimage({ schema: "evaluation-result:v2", ...result }));
+}
+function normalizeInputV2ForDigest(input, coverageSummary) {
+  const {
+    analysisPlanId: _analysisPlanId,
+    createdAt: _createdAt,
+    digest: _planDigest,
+    obligationsDigest: _obligationsDigest,
+    ...analysisPlanSemantic
+  } = input.analysisPlan;
+  return {
+    schema: "evaluation-input:v2",
+    binding: input.binding,
+    analysisPlan: {
+      ...analysisPlanSemantic,
+      analysisPlanDigest: input.analysisPlan.digest,
+      obligationsDigest: input.analysisPlan.obligationsDigest
+    },
+    contract: input.contract,
+    factSchemaVersion: input.factSchemaVersion,
+    factsDigest: input.factsDigest,
+    coverage: [...input.coverage].map((region) => ({
+      ...region,
+      diagnosticIds: [...region.diagnosticIds].sort(compareCanonicalStrings)
+    })).sort((left, right) => compareCanonicalStrings(left.regionId, right.regionId)),
+    coverageSummary,
+    policy: input.policy,
+    baseline: input.baseline,
+    adoption: input.adoption,
+    trust: input.trust,
+    waivers: input.waivers.map((waiver) => ({
+      ...waiver,
+      matchedFindingFingerprints: [...waiver.matchedFindingFingerprints].sort(
+        compareCanonicalStrings
+      )
+    })).sort((left, right) => compareCanonicalStrings(left.waiverId, right.waiverId)),
+    integrity: input.integrity,
+    evaluatedAt: input.evaluatedAt,
+    evaluatorVersion: input.evaluatorVersion
+  };
+}
+function evidenceFindings(input) {
+  if (input.evidence.kind === "findings") return [...input.evidence.findings];
+  const ruleConfig = readRuleConfig(input.evidence.facts);
+  return runRules(input.evidence.facts).map((finding) => ({
+    fingerprint: finding.fingerprint,
+    ruleId: finding.ruleId,
+    severity: severityLevel(configuredFindingSeverity(finding, ruleConfig)),
+    advisory: finding.attributes?.advisory === true,
+    evidenceGrade: finding.evidenceGrade
+  }));
+}
+var STATE_RANK = { blocked: 0, pending_cloud_trust: 1, advisory: 2 };
+var SEVERITY_RANK2 = { error: 0, warn: 1, info: 2 };
+function canonicalRow(finding) {
+  return {
+    fingerprint: finding.fingerprint,
+    ruleId: finding.ruleId,
+    severity: finding.severity,
+    advisory: finding.advisory === true,
+    evidenceGrade: coerceEvidenceGrade(finding.evidenceGrade),
+    waived: finding.waived === true,
+    ...finding.sourceTrust !== void 0 ? { sourceTrust: finding.sourceTrust } : {},
+    ...finding.mappingTrust !== void 0 ? { mappingTrust: finding.mappingTrust } : {},
+    ...finding.baselineState !== void 0 ? { baselineState: finding.baselineState } : {}
+  };
+}
+function compareStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function compareRows(a, b) {
+  return compareStrings(a.fingerprint, b.fingerprint) || SEVERITY_RANK2[a.severity] - SEVERITY_RANK2[b.severity] || compareStrings(a.ruleId, b.ruleId) || Number(a.advisory ?? false) - Number(b.advisory ?? false) || compareStrings(a.evidenceGrade ?? "", b.evidenceGrade ?? "") || Number(a.waived ?? false) - Number(b.waived ?? false) || compareStrings(a.sourceTrust ?? "", b.sourceTrust ?? "") || compareStrings(a.mappingTrust ?? "", b.mappingTrust ?? "") || compareStrings(a.baselineState ?? "", b.baselineState ?? "");
+}
+function canonicalRows(findings) {
+  const sorted = findings.map(canonicalRow).sort(compareRows);
+  return sorted.filter((row, index) => index === 0 || compareRows(row, sorted[index - 1]) !== 0);
+}
+function groupByFingerprint(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const row of canonicalRows(findings)) {
+    const group = groups.get(row.fingerprint);
+    if (group) group.push(row);
+    else groups.set(row.fingerprint, [row]);
+  }
+  return groups;
+}
+function classifyFinding(finding, input, activeWaivers) {
+  const base = {
+    fingerprint: finding.fingerprint,
+    ruleId: finding.ruleId,
+    severity: finding.severity
+  };
+  if (activeWaivers.has(finding.fingerprint) || finding.waived === true) {
+    return { ...base, state: "advisory", stateReasons: ["waived"] };
+  }
+  const eligibility = eligibilityFor(finding, input.policy);
+  if (eligibility !== null) {
+    return { ...base, state: "advisory", stateReasons: [eligibility] };
+  }
+  const introduced = introducedFactFor(finding, input);
+  if (introduced.state === "negative") {
+    return { ...base, state: "advisory", stateReasons: ["baseline:existing"] };
+  }
+  const requirement = input.policy.rules?.[finding.ruleId]?.trust ?? defaultTrustRequirement(finding.ruleId);
+  const mappingBinds = requirement === "canonical" || defaultTrustRequirement(finding.ruleId) === "canonical";
+  if (requirement === "none") {
+    const definitives = [sourceFact(finding, input)];
+    if (mappingBinds) definitives.push(mappingFact(finding, input));
+    const definitiveNegative = definitives.find(([, state]) => state === "negative");
+    if (definitiveNegative) {
+      return { ...base, state: "advisory", stateReasons: [`trust:${definitiveNegative[0]}`] };
+    }
+    return { ...base, state: "blocked", stateReasons: [`eligible:${finding.severity}`] };
+  }
+  const facts = [
+    [`introduced:${introduced.detail}`, introduced.state],
+    sourceFact(finding, input)
+  ];
+  if (requirement === "canonical") {
+    facts.push(mappingFact(finding, input));
+  } else if (mappingBinds) {
+    const mapping = mappingFact(finding, input);
+    if (mapping[1] === "negative") facts.push(mapping);
+  }
+  const negative = facts.find(([, state]) => state === "negative");
+  if (negative) {
+    return { ...base, state: "advisory", stateReasons: [`trust:${negative[0]}`] };
+  }
+  const unknowns = facts.filter(([, state]) => state === "unknown");
+  if (unknowns.length > 0) {
+    return {
+      ...base,
+      state: "pending_cloud_trust",
+      stateReasons: unknowns.map(([label]) => `trust:${label}`)
+    };
+  }
+  return { ...base, state: "blocked", stateReasons: [`eligible:${finding.severity}`, "trust:all"] };
+}
+function eligibilityFor(finding, policy) {
+  if (finding.advisory === true) return "ineligible:advisory-tier";
+  if (!canBlock(coerceEvidenceGrade(finding.evidenceGrade))) return "ineligible:evidence-grade";
+  if (finding.severity === "error") return null;
+  if (finding.severity === "warn") {
+    return policy.failOnWarnings ? null : "ineligible:warn-not-gated";
+  }
+  return "ineligible:info";
+}
+function coerceEvidenceGrade(grade) {
+  if (grade === void 0) return "source_backed";
+  return EVIDENCE_ORDER.includes(grade) ? grade : "none";
+}
+function defaultTrustRequirement(ruleId) {
+  return tierFor(ruleId) === "contract" ? "canonical" : "evidence";
+}
+function introducedFactFor(finding, input) {
+  const baseline = input.baseline;
+  if (!baseline) return { state: "unknown", detail: "no-baseline" };
+  if (!baseline.identityVerified) return { state: "unknown", detail: "identity-unverified" };
+  const recorded = finding.baselineState ?? baseline.findingStates?.[finding.fingerprint] ?? "introduced";
+  if (recorded === "existing") return { state: "negative", detail: "existing" };
+  if (recorded === "introduced") return { state: "affirmative", detail: "introduced" };
+  return { state: "unknown", detail: "unknown" };
+}
+function sourceFact(finding, input) {
+  const source = finding.sourceTrust ?? input.trust?.sources?.[finding.fingerprint] ?? input.trust?.source ?? "unknown";
+  if (source === "verified") return ["source:verified", "affirmative"];
+  if (source === "unverified") return ["source:non-reproduction", "negative"];
+  return ["source:unknown", "unknown"];
+}
+function mappingFact(finding, input) {
+  const mapping = finding.mappingTrust ?? input.trust?.mappings[finding.fingerprint] ?? "unknown";
+  if (mapping === "confirmed") return ["mapping:confirmed", "affirmative"];
+  if (mapping === "unconfirmed") return ["mapping:unconfirmed", "negative"];
+  return ["mapping:unknown", "unknown"];
+}
+function normalizeInputForDigest(input) {
+  return {
+    schema: "evaluation-input:v1",
+    contract: input.contract,
+    scope: input.scope,
+    evidence: canonicalRows(evidenceFindings(input)),
+    policy: input.policy,
+    baseline: input.baseline,
+    adoption: input.adoption,
+    trust: input.trust,
+    waivers: canonicalWaivers(input.waivers ?? []),
+    integrity: {
+      ...input.integrity,
+      ...input.integrity.unknownPresets ? { unknownPresets: [...new Set(input.integrity.unknownPresets)].sort() } : {}
+    },
+    evaluatedAt: input.evaluatedAt
+  };
+}
+function canonicalWaivers(waivers) {
+  const expiryOf = (waiver) => waiver.expiresAt === void 0 || Number.isNaN(waiver.expiresAt) ? Number.POSITIVE_INFINITY : waiver.expiresAt;
+  const canonical = waivers.map((waiver) => {
+    const expiresAt = expiryOf(waiver);
+    return expiresAt === Number.POSITIVE_INFINITY ? { fingerprint: waiver.fingerprint } : { fingerprint: waiver.fingerprint, expiresAt };
+  });
+  const sorted = canonical.sort((a, b) => {
+    if (a.fingerprint !== b.fingerprint) return a.fingerprint < b.fingerprint ? -1 : 1;
+    const ea = expiryOf(a);
+    const eb = expiryOf(b);
+    return ea === eb ? 0 : ea < eb ? -1 : 1;
+  });
+  return sorted.filter(
+    (waiver, index) => index === 0 || waiver.fingerprint !== sorted[index - 1].fingerprint || expiryOf(waiver) !== expiryOf(sorted[index - 1])
+  );
+}
+
+// src/approved-contract-tokens.ts
+var APPROVED_CONTRACT_TOKEN_MAX_NAMES = 1e4;
+var APPROVED_CONTRACT_TOKEN_MAX_NAME_LENGTH = 512;
+function isApprovedContractTokenNames(value) {
+  return Array.isArray(value) && value.length <= APPROVED_CONTRACT_TOKEN_MAX_NAMES && value.every(
+    (name) => typeof name === "string" && name.startsWith("--") && name.length > 2 && name.length <= APPROVED_CONTRACT_TOKEN_MAX_NAME_LENGTH
+  );
+}
 export {
   AGENT_CONTEXT_RELATIVE_PATH,
   AGENT_FORMAT_SCHEMA_VERSION,
+  ANALYSIS_LIMIT_CEILINGS_V1,
+  ANALYSIS_PLAN_MAX_CAPABILITIES_V1,
+  ANALYSIS_PLAN_MAX_DIALECTS_PER_REGION_V1,
+  ANALYSIS_PLAN_MAX_REGIONS_V1,
+  APPROVED_CONTRACT_TOKEN_MAX_NAMES,
+  APPROVED_CONTRACT_TOKEN_MAX_NAME_LENGTH,
   BLOCKING_RULE_ALLOWLIST,
   BRAND,
+  CANONICAL_FACT_MAX_CONFLICTS_V1,
+  CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1,
+  CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1,
   CATALOG_FIXTURE_A_FCID,
   CODES,
+  CONTRACT_DISPLAY_ONLY_FIELDS,
   CONTRACT_DOMAINS,
+  CONTRACT_ENFORCEMENT_FIELDS,
   CONTRACT_PREIMAGE_CAPABILITY_HEADER,
   CONTRACT_PREIMAGE_SCHEMA,
   CompiledFragmentsFileValidationError,
+  ContractCatalogValidationError,
+  CoverageValidationErrorV1,
   DEFAULTS,
   DEFAULT_ENHANCED_STYLE_PROPERTIES,
   DEFAULT_STYLE_PROPERTIES,
   EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA,
+  EMPTY_VOCABULARY_MESSAGE,
+  EVALUATION_MAX_FINDINGS_V2,
+  EVALUATION_MAX_MAP_ENTRIES_V2,
+  EVALUATION_MAX_POLICY_RULES_V2,
+  EVALUATION_MAX_REASON_CODES_V2,
+  EVALUATION_MAX_WAIVERS_V2,
+  EVALUATION_MAX_WAIVER_MATCHES_V2,
+  EVALUATION_RECEIPT_STRING_MAX_BYTES_V1,
+  EVALUATOR_VERSION,
+  EVALUATOR_VERSION_V2,
   EVIDENCE_ORDER,
   EXPLAIN_URL_BASE,
   FRAGMENTS_INTERNAL_RULE_IDS,
+  FRAGMENTS_MANIFEST_FILENAME,
+  FRAGMENTS_MANIFEST_SCHEMA_VERSION,
+  FRAGMENTS_MANIFEST_TOKEN_RULE,
+  FRAGMENT_V3_SCHEMA_URL,
   FactIndex,
   GOVERNANCE_TELEMETRY_FIELDS,
   GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE,
@@ -9963,13 +11942,18 @@ export {
   PRESET_NAMES,
   PROVE_DEFAULT_MAX_PASSES,
   PROVE_MAX_PASSES,
+  PROVIDER_ID_MAX_BYTES_V1,
   RAW_HTML_ADVISORY_TAGS,
   RAW_HTML_CANONICAL_TAGS,
   RAW_HTML_INPUT_TYPE_CANONICALS,
   RAW_HTML_ROLE_CANONICALS,
   REGISTRY_ARTIFACT_SCHEMA_VERSION,
+  REGISTRY_INDEX_SCHEMA_VERSION,
   REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
   REGISTRY_MANIFEST_SCHEMA_VERSION,
+  REGISTRY_POINTER_SCHEMA_VERSION,
+  REGISTRY_SHARD_SCHEMA_VERSION,
+  REPOSITORY_BINDING_ID_MAX_BYTES_V1,
   RULES,
   RULE_FAMILY_IDS,
   RULE_FAMILY_MEMBERS,
@@ -9982,8 +11966,19 @@ export {
   agentIntegritySchema,
   agentOutputSchema,
   aiMetadataSchema,
+  analysisLimitsV1Schema,
+  analysisObligationsDigestV1,
+  analysisPlanDigestV1,
+  analysisPlanIdFromDigest,
+  analysisPlanIdSchema,
+  analysisPlanIdStringSchema,
+  analysisPlanInputV1Schema,
+  analysisPlanV1Schema,
+  analysisRegionV1Schema,
   analyzeComposition,
+  artifactContentHash,
   asComponentId,
+  assembleRegistryArtifact,
   assertPortableRegistryPath,
   assertValidRegistryArtifact,
   authorOwnedImport,
@@ -9992,11 +11987,13 @@ export {
   bridgeSourceViolations,
   budgetBar,
   buildAgentFormat,
+  buildAnalysisPlanV1,
   buildComponentKey,
   buildRegistryArtifact,
   buildRegistryFile,
   buildRegistryInstallPlan,
   buildRegistryInstallReceipt,
+  buildRegistryPointer,
   buildSpacingTokenLookup,
   bundleArtifactMetadataSchema,
   bundleComponentShardSchema,
@@ -10014,14 +12011,17 @@ export {
   canonicalBridgeIdentitySources,
   canonicalBridgeV1Schema,
   canonicalDirectionConflictsTarget,
+  canonicalFactConflictV1Schema,
+  canonicalFactConflictValueV1Schema,
+  canonicalFactIntegrityV1Schema,
   canonicalJson,
   canonicalPreimage,
   canonicalizeOwnedComponentId,
   canonicalizeOwnedImport,
+  capConfiguredSeverity,
   catalogFixtureA,
   catalogFixtureAContractPayload,
   catalogFixtureATokensDtcg,
-  checkStoryExclusion,
   clampMaxPasses,
   classifyComplexity,
   classifyIdentity,
@@ -10041,7 +12041,6 @@ export {
   compileEffectiveGovernanceInputs,
   compileFragment,
   compileGlobalGovernanceFacts,
-  compileRecipe,
   componentContractSchema,
   componentGovernanceRecordSchema,
   componentGovernanceRecordsSchema,
@@ -10053,28 +12052,50 @@ export {
   computeRegistryHash,
   configDeclarationForDiagnostics,
   configRecordShape,
+  configuredFindingSeverity,
   containsTailwindV4Theme,
   contractComponentsFromFragments,
   contractHash,
   contractPolicyFromGovernanceConfig,
   contractTierRuleIds,
   contractTokenReferenceCensus,
+  coverageArtifactDigestV1,
+  coverageRegionV1Schema,
+  coverageStateV1Schema,
+  coverageSummaryV1Schema,
   customerDefaultRuleStates,
+  defaultRegistryShardPath,
   defineBlock,
   defineConfig,
   defineFragment,
-  defineRecipe,
+  deriveArtifactId,
+  deriveCoverageSummaryV1,
   describePolicyExclude,
   detectOrphanGovernanceScales,
-  detectSubComponentPaths,
   detectUnconsumedConfigKeys,
   detectUnmatchedPolicyExcludes,
   diffContractDomains,
+  digestHexSchema,
+  digestHexStringSchema,
   discoverComponents,
   dtcgTokenFileSchema,
+  effectiveEvaluationWaiverV2Schema,
   emptyConformResult,
+  emptyVocabularyConfigFile,
+  evaluate2 as evaluate,
   evaluateGovernanceIntegrity,
+  evaluationInputDigestV2,
+  evaluationInputV2Schema,
+  evaluationReceiptDigestV1,
+  evaluationReceiptIdFromDigest,
+  evaluationReceiptIdSchema,
+  evaluationReceiptIdStringSchema,
+  evaluationReceiptMintInputV1Schema,
+  evaluationReceiptV1Schema,
+  evaluationResultDigestV2,
+  evaluationResultV2Schema,
   excludeGlobToRegExp,
+  expandRegistryComponentClosure,
   explainUrlForCode,
   factEvidenceSchema,
   factId,
@@ -10096,16 +12117,32 @@ export {
   formatStampPin,
   formatStampVersionHash,
   formatTokenSummary,
+  fragmentAnnotationsV3Schema,
   fragmentBanSchema,
   fragmentContractSchema,
   fragmentDefinitionSchema,
   fragmentDefinitionV2Schema,
+  fragmentDefinitionV3BodySchema,
+  fragmentDefinitionV3Schema,
+  fragmentDesignV3Schema,
+  fragmentDontExampleV3Schema,
   fragmentGeneratedSchema,
+  fragmentGuidanceV3Schema,
+  fragmentMatrixV3Schema,
   fragmentMetaSchema,
+  fragmentMetaV3Schema,
+  fragmentPreviewV3Schema,
   fragmentProvenanceSchema,
+  fragmentSourceValues,
+  fragmentStateV3Schema,
   fragmentUsageSchema,
   fragmentVariantSchema,
   fragmentsConfigSchema,
+  fragmentsManifestFcid,
+  fragmentsManifestGrammarSchema,
+  fragmentsManifestPatternSchema,
+  fragmentsManifestPrimitiveSchema,
+  fragmentsManifestSchema,
   fragmentsPresetRuleStates,
   g,
   gatesCi,
@@ -10132,9 +12169,9 @@ export {
   indexComponentIdentityUsage,
   inferTokenCategory,
   inferTokenGroup,
+  isApprovedContractTokenNames,
   isColorLike,
   isCompositionPattern,
-  isConfigExcluded,
   isContractFile,
   isContractTierRule,
   isDTCGFile,
@@ -10142,7 +12179,6 @@ export {
   isEffectiveCanonicalSource,
   isEnforceableHtmlEquivalent,
   isFigmaPropMapping,
-  isForceIncluded,
   isPortableRepoPath,
   isPresetSourcedRule,
   isRawHtmlAdvisoryTier,
@@ -10215,8 +12251,11 @@ export {
   mcpSourceTypeSchema,
   mcpTokenDataSchema,
   mcpTokenSchema,
+  mintEvaluationReceiptId,
   nearestByDeltaE,
   nearestSignedScaleValue,
+  normalizeAnalysisPlanInputV1,
+  normalizeCanonicalFactIntegrityV1,
   normalizeColor,
   normalizeConfigPath,
   normalizeExcludePath,
@@ -10224,6 +12263,7 @@ export {
   normalizeGovernanceConfig,
   normalizePolicyExcludes,
   normalizeRegistryRepoPath,
+  normalizeRepositoryBindingKeyV1,
   normalizeSeverity,
   normalizeStyleValue,
   normalizeToV1,
@@ -10232,15 +12272,22 @@ export {
   normalizeViolation,
   overriddenRecordSeverityDiagnostic,
   ownedImportEquivalents,
+  parseAnalysisPlanId,
+  parseAnalysisPlanV1,
   parseColor,
   parseColorToRgb,
   parseCompiledFragmentsFile,
   parseComponentContract,
+  parseComponentGovernancePolicyJson,
   parseContractStamp,
   parseCssTokens,
   parseDtcgTokens as parseDTCGFile,
   parseDesignTokenContent,
+  parseDigestHex,
   parseDtcgTokens,
+  parseEvaluationReceiptId,
+  parseEvaluationReceiptV1,
+  parseFragmentsManifest,
   parseRgb,
   parseScssTokens,
   parseScssVariables,
@@ -10252,13 +12299,17 @@ export {
   portableRepoPathError,
   projectCanonicalDirectionConflicts,
   projectContractPreimage,
+  projectEnforcementContract,
   projectSupersededImportPathPreferences,
   projectV1OwnedComponentId,
   projectV1OwnedImportIdentity,
+  propAnnotationSchema,
   propDefinitionSchema,
   proveCompliant,
   proveIssueCount,
-  recipeDefinitionSchema,
+  providerProofDigestV1,
+  providerProofV1Schema,
+  readRuleConfig,
   registryArtifactDigest,
   registryArtifactSchema,
   registryComponentExportSchema,
@@ -10270,23 +12321,36 @@ export {
   registryFileRoleSchema,
   registryFileSchema,
   registryFileSize,
+  registryIndexSchema,
   registryInstallProfileSchema,
   registryInstallReceiptComponentSchema,
   registryInstallReceiptFileSchema,
   registryInstallReceiptSchema,
   registryManifestCanonicalPreimage,
   registryManifestDraftSchema,
+  registryManifestFileMetadata,
+  registryManifestFilePaths,
   registryManifestSchema,
+  registryPointerSchema,
+  registryShardSchema,
+  registryShardsForPaths,
   registrySourceSchema,
+  repositoryBindingDigestV1,
+  repositoryBindingKeyV1Schema,
   resolveArea,
   resolveCanonicalForAriaRole,
   resolveCanonicalForRawHtml,
+  resolveComponentGovernance,
   resolveConfiguredAppPath,
   resolveDesignTokenValue,
   resolveFigmaMapping,
+  resolveGovernanceRecordsForIdentity,
   resolveOwnedPackageImport,
   resolvePerformanceConfig,
   resolveProveVerdict,
+  resolveRegistryComponentId,
+  resolveRegistryInstallSelection,
+  resolveRegistryInstallSources,
   resolveSpacingValue,
   resolveTokenValue,
   rgbToHex,
@@ -10314,11 +12378,11 @@ export {
   ruleTokensRequireDualFallback,
   runRules,
   scaleGovernanceRecordSchema,
-  selectedRegistryComponentNames,
   serializeContractStamp,
   severityLevel,
   severitySchema,
   sha256Hex,
+  shardRegistryArtifact,
   sortBySeverity,
   sourceToRegistryTargetPath,
   suppressionDirectiveSchema,