@usefragments/core 1.10.2 → 2.0.0

package/dist/{chunk-XN3LSDPY.js → chunk-BMPYIUZE.js}

@@ -1,3 +1,9 @@
+import {
+  portableRepoPathError
+} from "./chunk-EIYNNS77.js";
+import {
+  compareCanonicalStrings
+} from "./chunk-PWIJMOI4.js";
 import {
   authorOwnedImport,
   canonicalizeOwnedComponentId,
@@ -6,9 +12,6 @@ import {
   projectV1OwnedComponentId,
   projectV1OwnedImportIdentity
 } from "./chunk-JNBFJ34I.js";
-import {
-  portableRepoPathError
-} from "./chunk-EIYNNS77.js";
 import {
   legacySeverityLevelSchema,
   severityFromLevel,
@@ -285,6 +288,16 @@ var CODES = [
     lifecycle: "experimental",
     evidenceRequired: true
   }),
+  code({
+    code: "FUI2018",
+    ruleId: "config/empty-token-vocabulary",
+    category: "system",
+    defaultSeverity: "serious",
+    title: "Token sources resolved to 0 tokens",
+    lifecycle: "experimental",
+    fixAvailable: false,
+    evidenceRequired: true
+  }),
   ruleCode({
     code: "FUI3001",
     ruleId: "a11y/required-accessible-name",
@@ -538,6 +551,36 @@ var CODES = [
     lifecycle: "experimental",
     fixAvailable: false,
     evidenceRequired: false
+  }),
+  code({
+    code: "FUI9010",
+    ruleId: "fragment/invalid-definition",
+    category: "system",
+    defaultSeverity: "critical",
+    title: "Fragment definition is not valid",
+    lifecycle: "experimental",
+    fixAvailable: false,
+    evidenceRequired: false
+  }),
+  code({
+    code: "FUI9011",
+    ruleId: "fragment/source-drift",
+    category: "system",
+    defaultSeverity: "critical",
+    title: "Fragment definition drifted from its component source",
+    lifecycle: "experimental",
+    fixAvailable: false,
+    evidenceRequired: false
+  }),
+  code({
+    code: "FUI9012",
+    ruleId: "contract/write-not-entitled",
+    category: "system",
+    defaultSeverity: "critical",
+    title: "Contract write requires a paid workspace",
+    lifecycle: "experimental",
+    fixAvailable: false,
+    evidenceRequired: false
   })
 ];
 var byCode = new Map(
@@ -550,15 +593,179 @@ function explainUrlForCode(code2) {
   return `${EXPLAIN_URL_BASE}${code2}`;
 }
 
+// src/facts/integrity.ts
+import { z as z2 } from "zod";
+
+// src/domain-ids.ts
+import { z } from "zod";
+var FULL_DIGEST_PATTERN = /^[0-9a-f]{64}$/u;
+var digestHexStringSchema = z.string().regex(FULL_DIGEST_PATTERN, "Expected 64 lowercase hexadecimal characters");
+var digestHexSchema = digestHexStringSchema;
+var analysisPlanIdStringSchema = z.string().regex(/^apl_[0-9a-f]{64}$/u, "Invalid analysis plan ID");
+var analysisPlanIdSchema = analysisPlanIdStringSchema.transform(
+  (value) => value
+);
+var evaluationReceiptIdSchema = z.string().regex(/^evr_[0-9a-f]{64}$/u, "Invalid evaluation receipt ID").transform((value) => value);
+var evaluationReceiptIdStringSchema = z.string().regex(/^evr_[0-9a-f]{64}$/u, "Invalid evaluation receipt ID");
+function parseDigestHex(value) {
+  return digestHexSchema.parse(value);
+}
+function analysisPlanIdFromDigest(digest) {
+  return analysisPlanIdSchema.parse(`apl_${parseDigestHex(digest)}`);
+}
+function evaluationReceiptIdFromDigest(digest) {
+  return evaluationReceiptIdSchema.parse(`evr_${parseDigestHex(digest)}`);
+}
+function mintEvaluationReceiptId(resultDigest) {
+  return evaluationReceiptIdFromDigest(resultDigest);
+}
+function parseAnalysisPlanId(value) {
+  return analysisPlanIdSchema.parse(value);
+}
+function parseEvaluationReceiptId(value) {
+  return evaluationReceiptIdSchema.parse(value);
+}
+
+// src/facts/integrity.ts
+var CANONICAL_FACT_MAX_CONFLICTS_V1 = 1e3;
+var CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1 = 64;
+var CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1 = 1e3;
+var boundedString = z2.string().min(1).max(4096);
+var unique = (values) => new Set(values).size === values.length;
+var provenance = z2.array(boundedString).min(1).max(CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1).refine(unique, "provenance values must be unique");
+var canonicalFactConflictValueV1Schema = z2.object({
+  valueDigest: digestHexStringSchema,
+  factIds: provenance,
+  totalFactIdCount: z2.number().int().positive().optional(),
+  analyzerIds: provenance,
+  totalAnalyzerIdCount: z2.number().int().positive().optional(),
+  evidenceRefs: provenance,
+  totalEvidenceRefCount: z2.number().int().positive().optional()
+}).strict().superRefine((value, context) => {
+  for (const [path, total, retained] of [
+    ["totalFactIdCount", value.totalFactIdCount, value.factIds.length],
+    ["totalAnalyzerIdCount", value.totalAnalyzerIdCount, value.analyzerIds.length],
+    ["totalEvidenceRefCount", value.totalEvidenceRefCount, value.evidenceRefs.length]
+  ]) {
+    if (total !== void 0 && total < retained) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: [path],
+        message: `${path} cannot be smaller than retained provenance`
+      });
+    }
+  }
+});
+var canonicalFactConflictV1Schema = z2.object({
+  canonicalKey: boundedString,
+  factKind: boundedString,
+  state: z2.literal("conflict"),
+  values: z2.array(canonicalFactConflictValueV1Schema).min(2).max(CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1).refine(
+    (values) => new Set(values.map((value) => value.valueDigest)).size === values.length,
+    "conflict values must have distinct material digests"
+  ),
+  totalValueCount: z2.number().int().min(2).optional()
+}).strict().superRefine((value, context) => {
+  if (value.totalValueCount !== void 0 && value.totalValueCount < value.values.length) {
+    context.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["totalValueCount"],
+      message: "totalValueCount cannot be smaller than retained values"
+    });
+  }
+});
+var canonicalFactIntegrityV1Schema = z2.union([
+  z2.object({
+    state: z2.literal("healthy"),
+    coalescedDuplicateCount: z2.number().int().nonnegative()
+  }).strict(),
+  z2.object({
+    state: z2.literal("conflict"),
+    coalescedDuplicateCount: z2.number().int().nonnegative(),
+    conflicts: z2.array(canonicalFactConflictV1Schema).min(1).max(CANONICAL_FACT_MAX_CONFLICTS_V1).refine(
+      (conflicts) => new Set(conflicts.map((conflict) => conflict.canonicalKey)).size === conflicts.length,
+      "canonical conflict keys must be unique"
+    ),
+    totalConflictCount: z2.number().int().positive().optional()
+  }).strict().superRefine((value, context) => {
+    if (value.totalConflictCount !== void 0 && value.totalConflictCount < value.conflicts.length) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["totalConflictCount"],
+        message: "totalConflictCount cannot be smaller than retained conflicts"
+      });
+    }
+  })
+]);
+var sorted = (values) => [...values].sort();
+function normalizeCanonicalFactIntegrityV1(value) {
+  const parsed = canonicalFactIntegrityV1Schema.parse(value);
+  if (parsed.state === "healthy") return parsed;
+  return {
+    ...parsed,
+    totalConflictCount: parsed.totalConflictCount ?? parsed.conflicts.length,
+    conflicts: parsed.conflicts.map((conflict) => ({
+      ...conflict,
+      totalValueCount: conflict.totalValueCount ?? conflict.values.length,
+      values: conflict.values.map((entry) => ({
+        ...entry,
+        factIds: sorted(entry.factIds),
+        totalFactIdCount: entry.totalFactIdCount ?? entry.factIds.length,
+        analyzerIds: sorted(entry.analyzerIds),
+        totalAnalyzerIdCount: entry.totalAnalyzerIdCount ?? entry.analyzerIds.length,
+        evidenceRefs: sorted(entry.evidenceRefs),
+        totalEvidenceRefCount: entry.totalEvidenceRefCount ?? entry.evidenceRefs.length
+      })).sort((left, right) => compareCanonicalStrings(left.valueDigest, right.valueDigest))
+    })).sort((left, right) => compareCanonicalStrings(left.canonicalKey, right.canonicalKey))
+  };
+}
+
 // src/facts/ids.ts
 function canonicalJson(value) {
+  return canonicalJsonValue(value, /* @__PURE__ */ new Set(), "(root)");
+}
+function canonicalJsonValue(value, ancestors, path) {
   if (value === void 0) return "null";
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError(`Unsupported fact identity value at ${path}: non-finite number`);
+    }
+    const serialized = JSON.stringify(value);
+    if (serialized === void 0) {
+      throw new TypeError(`Unsupported fact identity value at ${path}: number`);
+    }
+    return serialized;
+  }
+  if (typeof value !== "object") {
+    throw new TypeError(`Unsupported fact identity value at ${path}: ${typeof value}`);
+  }
   if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
+    if (ancestors.has(value)) throw new TypeError(`Circular fact identity value at ${path}`);
+    ancestors.add(value);
+    try {
+      return `[${value.map((entry, index) => canonicalJsonValue(entry, ancestors, `${path}[${index}]`)).join(",")}]`;
+    } finally {
+      ancestors.delete(value);
+    }
   }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    const objectType = prototype?.constructor?.name ?? "unknown";
+    throw new TypeError(`Unsupported fact identity object at ${path}: ${objectType}`);
+  }
+  if (ancestors.has(value)) throw new TypeError(`Circular fact identity value at ${path}`);
+  ancestors.add(value);
   const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+  try {
+    return `{${entries.map(
+      ([key, entry]) => `${JSON.stringify(key)}:${canonicalJsonValue(entry, ancestors, `${path}.${key}`)}`
+    ).join(",")}}`;
+  } finally {
+    ancestors.delete(value);
+  }
 }
 var FNV_PRIME = 16777619;
 var FNV_SEED_A = 2166136261;
@@ -854,6 +1061,7 @@ function makeStyleCssVarsMustBeDefinedFact(input) {
     id: factId("style_css_vars_must_be_defined", {}),
     kind: "style_css_vars_must_be_defined",
     severity: input.severity,
+    ...input.configPath ? { configPath: input.configPath } : {},
     ...policyExcludeField(input.exclude)
   };
 }
@@ -1267,11 +1475,14 @@ var FactIndex = class {
     }
     const existing = this.facts.get(fact.id);
     if (existing) {
-      if (canonicalJson(logicalFactForComparison(existing)) !== canonicalJson(logicalFactForComparison(fact))) {
+      const differs = canonicalJson(logicalFactForComparison(existing)) !== canonicalJson(logicalFactForComparison(fact));
+      if (differs) {
         this.options.onConflict?.(
           `FactIndex: conflicting facts for id ${fact.id} \u2014 keeping ${describeFactForConflict(existing)}, skipping ${describeFactForConflict(fact)}`,
           { kept: existing, skipped: fact }
         );
+      } else {
+        this.options.onDuplicate?.({ kept: existing, duplicate: fact });
       }
       return;
     }
@@ -1490,16 +1701,16 @@ function describeFactForConflict(fact) {
 }
 
 // src/governance.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/policy-exclude.ts
-import { z } from "zod";
-var policyExcludeSchema = z.array(
-  z.union([
-    z.string().min(1),
-    z.object({
-      glob: z.string().min(1),
-      reason: z.string().min(1).optional()
+import { z as z3 } from "zod";
+var policyExcludeSchema = z3.array(
+  z3.union([
+    z3.string().min(1),
+    z3.object({
+      glob: z3.string().min(1),
+      reason: z3.string().min(1).optional()
     })
   ])
 );
@@ -1543,90 +1754,90 @@ function describePolicyExclude(scope, exclude) {
 }
 
 // src/governance.ts
-var governanceSeveritySchema = z2.enum(["error", "warn", "info"]);
+var governanceSeveritySchema = z4.enum(["error", "warn", "info"]);
 var recordExcludeSchema = policyExcludeSchema.optional();
-var scaleGovernanceRecordSchema = z2.object({
-  kind: z2.literal("scale").default("scale"),
-  name: z2.string().min(1).optional(),
-  unit: z2.enum(["px", "rem"]),
-  values: z2.array(z2.number()),
-  rootFontSizePx: z2.number().positive().optional(),
-  emBasePx: z2.number().positive().optional()
+var scaleGovernanceRecordSchema = z4.object({
+  kind: z4.literal("scale").default("scale"),
+  name: z4.string().min(1).optional(),
+  unit: z4.enum(["px", "rem"]),
+  values: z4.array(z4.number()),
+  rootFontSizePx: z4.number().positive().optional(),
+  emBasePx: z4.number().positive().optional()
 });
-var styleRawColorsForbidRecordSchema = z2.object({
-  kind: z2.literal("style.rawColors.forbid"),
-  except: z2.array(z2.string()),
-  prefer: z2.enum(["token", "css-variable"]),
+var styleRawColorsForbidRecordSchema = z4.object({
+  kind: z4.literal("style.rawColors.forbid"),
+  except: z4.array(z4.string()),
+  prefer: z4.enum(["token", "css-variable"]),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var styleRawDimensionsForbidRecordSchema = z2.object({
-  kind: z2.literal("style.rawDimensions.forbid"),
-  appliesTo: z2.array(z2.string().min(1)),
-  prefer: z2.enum(["token", "css-variable"]),
+var styleRawDimensionsForbidRecordSchema = z4.object({
+  kind: z4.literal("style.rawDimensions.forbid"),
+  appliesTo: z4.array(z4.string().min(1)),
+  prefer: z4.enum(["token", "css-variable"]),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var styleRawSpacingMustMatchScaleRecordSchema = z2.object({
-  kind: z2.literal("style.rawSpacing.mustMatchScale"),
-  scale: z2.string().min(1),
-  appliesTo: z2.array(z2.string().min(1)),
+var styleRawSpacingMustMatchScaleRecordSchema = z4.object({
+  kind: z4.literal("style.rawSpacing.mustMatchScale"),
+  scale: z4.string().min(1),
+  appliesTo: z4.array(z4.string().min(1)),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var styleFontSizeMustMatchScaleRecordSchema = z2.object({
-  kind: z2.literal("style.fontSize.mustMatchScale"),
-  scale: z2.string().min(1),
+var styleFontSizeMustMatchScaleRecordSchema = z4.object({
+  kind: z4.literal("style.fontSize.mustMatchScale"),
+  scale: z4.string().min(1),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var styleCssVarsMustBeDefinedRecordSchema = z2.object({
-  kind: z2.literal("style.cssVars.mustBeDefined"),
+var styleCssVarsMustBeDefinedRecordSchema = z4.object({
+  kind: z4.literal("style.cssVars.mustBeDefined"),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var globalStyleGovernanceRecordSchema = z2.discriminatedUnion("kind", [
+var globalStyleGovernanceRecordSchema = z4.discriminatedUnion("kind", [
   styleRawColorsForbidRecordSchema,
   styleRawDimensionsForbidRecordSchema,
   styleRawSpacingMustMatchScaleRecordSchema,
   styleFontSizeMustMatchScaleRecordSchema,
   styleCssVarsMustBeDefinedRecordSchema
 ]);
-var jsxUnknownPropsForbidRecordSchema = z2.object({
-  kind: z2.literal("jsx.unknownProps.forbid"),
+var jsxUnknownPropsForbidRecordSchema = z4.object({
+  kind: z4.literal("jsx.unknownProps.forbid"),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var jsxInlineStyleForbidRawRecordSchema = z2.object({
-  kind: z2.literal("jsx.inlineStyle.forbidRaw"),
-  properties: z2.array(z2.string().min(1)),
+var jsxInlineStyleForbidRawRecordSchema = z4.object({
+  kind: z4.literal("jsx.inlineStyle.forbidRaw"),
+  properties: z4.array(z4.string().min(1)),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var jsxImportPathPreferRecordSchema = z2.object({
-  kind: z2.literal("jsx.importPath.prefer"),
-  from: z2.string().min(1),
-  to: z2.string().min(1),
-  imported: z2.string().min(1).optional(),
-  because: z2.string().optional(),
+var jsxImportPathPreferRecordSchema = z4.object({
+  kind: z4.literal("jsx.importPath.prefer"),
+  from: z4.string().min(1),
+  to: z4.string().min(1),
+  imported: z4.string().min(1).optional(),
+  because: z4.string().optional(),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var jsxComponentPreferRecordSchema = z2.object({
-  kind: z2.literal("jsx.component.prefer"),
-  from: z2.string().min(1),
-  to: z2.string().min(1),
-  because: z2.string().optional(),
+var jsxComponentPreferRecordSchema = z4.object({
+  kind: z4.literal("jsx.component.prefer"),
+  from: z4.string().min(1),
+  to: z4.string().min(1),
+  because: z4.string().optional(),
   severity: governanceSeveritySchema,
   exclude: recordExcludeSchema
 });
-var globalJsxGovernanceRecordSchema = z2.discriminatedUnion("kind", [
+var globalJsxGovernanceRecordSchema = z4.discriminatedUnion("kind", [
   jsxUnknownPropsForbidRecordSchema,
   jsxInlineStyleForbidRawRecordSchema,
   jsxImportPathPreferRecordSchema,
   jsxComponentPreferRecordSchema
 ]);
-var globalGovernanceRecordSchema = z2.discriminatedUnion("kind", [
+var globalGovernanceRecordSchema = z4.discriminatedUnion("kind", [
   scaleGovernanceRecordSchema,
   styleRawColorsForbidRecordSchema,
   styleRawDimensionsForbidRecordSchema,
@@ -1638,99 +1849,114 @@ var globalGovernanceRecordSchema = z2.discriminatedUnion("kind", [
   jsxImportPathPreferRecordSchema,
   jsxComponentPreferRecordSchema
 ]);
-var componentCapabilityRecordSchema = z2.object({
-  kind: z2.literal("capability"),
-  capability: z2.string().min(1)
+var componentCapabilityRecordSchema = z4.object({
+  kind: z4.literal("capability"),
+  capability: z4.string().min(1)
 });
-var propValueAvoidRecordSchema = z2.object({
-  kind: z2.literal("prop.value.avoid"),
-  prop: z2.string().min(1),
-  value: z2.unknown(),
-  because: z2.string(),
-  suggest: z2.string().optional(),
+var requiredComponentGovernanceValueSchema = z4.custom(
+  (value) => value !== void 0,
+  "Expected an explicitly present governance value"
+);
+var propValueAvoidRecordSchema = z4.object({
+  kind: z4.literal("prop.value.avoid"),
+  prop: z4.string().min(1),
+  value: requiredComponentGovernanceValueSchema,
+  because: z4.string(),
+  suggest: z4.string().optional(),
   severity: governanceSeveritySchema
 });
-var propValueForbidRecordSchema = z2.object({
-  kind: z2.literal("prop.value.forbid"),
-  prop: z2.string().min(1),
-  value: z2.unknown(),
-  when: z2.object({ path: z2.string().min(1).optional() }).optional(),
-  because: z2.string(),
-  fix: z2.object({ replaceWith: z2.unknown() }).optional(),
+var propValueForbidRecordSchema = z4.object({
+  kind: z4.literal("prop.value.forbid"),
+  prop: z4.string().min(1),
+  value: requiredComponentGovernanceValueSchema,
+  when: z4.object({ path: z4.string().min(1).optional() }).optional(),
+  because: z4.string(),
+  fix: z4.object({ replaceWith: requiredComponentGovernanceValueSchema }).optional(),
   severity: governanceSeveritySchema
 });
-var a11yRequireNameRecordSchema = z2.object({
-  kind: z2.literal("a11y.requireName"),
-  because: z2.string(),
+var a11yRequireNameRecordSchema = z4.object({
+  kind: z4.literal("a11y.requireName"),
+  because: z4.string(),
   severity: governanceSeveritySchema
 });
-var componentGovernanceRecordSchema = z2.discriminatedUnion("kind", [
+var componentGovernanceRecordSchema = z4.discriminatedUnion("kind", [
   componentCapabilityRecordSchema,
   propValueAvoidRecordSchema,
   propValueForbidRecordSchema,
   a11yRequireNameRecordSchema
 ]);
-var componentGovernanceRecordsSchema = z2.array(componentGovernanceRecordSchema);
-var componentPolicyMatchSchema = z2.object({
-  componentKey: z2.string().min(1).optional(),
-  componentId: z2.string().min(1).optional(),
-  publicRef: z2.string().min(1).optional(),
-  importPath: z2.string().min(1).optional(),
-  sourcePath: z2.string().min(1).optional(),
-  path: z2.string().min(1).optional(),
-  exportName: z2.string().min(1).optional(),
-  export: z2.string().min(1).optional(),
-  name: z2.string().min(1).optional(),
-  scope: z2.enum(["one", "all"]).optional()
+var componentGovernanceRecordsSchema = z4.array(componentGovernanceRecordSchema);
+function parseComponentGovernancePolicyJson(policyJson) {
+  try {
+    const parsed = JSON.parse(policyJson);
+    const record = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    const candidate = Array.isArray(parsed) ? parsed : record?.governance ?? record?.rules;
+    const result = componentGovernanceRecordsSchema.safeParse(candidate);
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+var componentPolicyMatchSchema = z4.object({
+  componentKey: z4.string().min(1).optional(),
+  componentId: z4.string().min(1).optional(),
+  publicRef: z4.string().min(1).optional(),
+  importPath: z4.string().min(1).optional(),
+  sourcePath: z4.string().min(1).optional(),
+  path: z4.string().min(1).optional(),
+  exportName: z4.string().min(1).optional(),
+  export: z4.string().min(1).optional(),
+  name: z4.string().min(1).optional(),
+  scope: z4.enum(["one", "all"]).optional()
 }).strict();
-var componentPolicyRecordSchema = z2.object({
+var componentPolicyRecordSchema = z4.object({
   rules: componentGovernanceRecordsSchema,
-  status: z2.enum(["active", "draft", "disabled"]).optional()
+  status: z4.enum(["active", "draft", "disabled"]).optional()
 }).strict();
-var componentPolicyOverrideSchema = z2.object({
+var componentPolicyOverrideSchema = z4.object({
   match: componentPolicyMatchSchema,
   rules: componentGovernanceRecordsSchema,
-  status: z2.enum(["active", "draft", "disabled"]).optional()
+  status: z4.enum(["active", "draft", "disabled"]).optional()
 }).strict();
-var canonicalSourcePathSchema = z2.string().min(1).superRefine((value, ctx) => {
+var canonicalSourcePathSchema = z4.string().min(1).superRefine((value, ctx) => {
   const error = portableRepoPathError(value);
   if (error) {
-    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: error });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, message: error });
   }
 });
-var canonicalSourceRegistryHashSchema = z2.string().regex(/^[0-9a-f]{64}$/);
-var canonicalBridgeModuleSpecifierSchema = z2.string().min(1).superRefine((value, ctx) => {
+var canonicalSourceRegistryHashSchema = z4.string().regex(/^[0-9a-f]{64}$/);
+var canonicalBridgeModuleSpecifierSchema = z4.string().min(1).superRefine((value, ctx) => {
   const normalized = value.replace(/\\/gu, "/");
   if (normalized.startsWith("/") || /^[A-Za-z]:\//u.test(normalized)) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       message: "Canonical bridge moduleSpecifier must be a portable import specifier"
     });
   }
   if (normalized.split("/").includes("..")) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       message: "Canonical bridge moduleSpecifier must not traverse outside the project"
     });
   }
 });
-var canonicalBridgeV1Schema = z2.object({
-  underlying: z2.object({
-    packageName: z2.string().min(1),
-    exportName: z2.string().min(1)
+var canonicalBridgeV1Schema = z4.object({
+  underlying: z4.object({
+    packageName: z4.string().min(1),
+    exportName: z4.string().min(1)
   }).strict(),
-  local: z2.object({
-    componentKey: z2.string().min(1),
+  local: z4.object({
+    componentKey: z4.string().min(1),
     moduleSpecifier: canonicalBridgeModuleSpecifierSchema,
-    exportName: z2.string().min(1),
-    implementationFiles: z2.array(canonicalSourcePathSchema).min(1)
+    exportName: z4.string().min(1),
+    implementationFiles: z4.array(canonicalSourcePathSchema).min(1)
   }).strict(),
-  decision: z2.object({
-    state: z2.literal("confirmed"),
-    source: z2.enum(["authored", "migration"])
+  decision: z4.object({
+    state: z4.literal("confirmed"),
+    source: z4.enum(["authored", "migration"])
   }).strict()
 }).strict();
-var canonicalBridgesV1Schema = z2.array(canonicalBridgeV1Schema).superRefine((bridges, ctx) => {
+var canonicalBridgesV1Schema = z4.array(canonicalBridgeV1Schema).superRefine((bridges, ctx) => {
   const underlying = /* @__PURE__ */ new Map();
   const componentKeys = /* @__PURE__ */ new Map();
   for (const [index, bridge] of bridges.entries()) {
@@ -1738,7 +1964,7 @@ var canonicalBridgesV1Schema = z2.array(canonicalBridgeV1Schema).superRefine((br
     const previousUnderlying = underlying.get(underlyingKey);
     if (previousUnderlying !== void 0) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `Duplicate confirmed bridge target for ${bridge.underlying.packageName}#${bridge.underlying.exportName} (also at canonicalBridges.${previousUnderlying})`,
         path: [index, "underlying"]
       });
@@ -1748,7 +1974,7 @@ var canonicalBridgesV1Schema = z2.array(canonicalBridgeV1Schema).superRefine((br
     const previousComponent = componentKeys.get(bridge.local.componentKey);
     if (previousComponent !== void 0) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `Local component key overlaps canonicalBridges.${previousComponent}`,
         path: [index, "local", "componentKey"]
       });
@@ -1757,65 +1983,65 @@ var canonicalBridgesV1Schema = z2.array(canonicalBridgeV1Schema).superRefine((br
     }
   }
 });
-var canonicalSourceSchema = z2.discriminatedUnion("kind", [
-  z2.object({
-    kind: z2.literal("npm"),
-    specifier: z2.string().min(1),
-    implementationPath: z2.string().min(1).optional(),
-    include: z2.array(z2.string().min(1)).optional(),
-    exclude: z2.array(z2.string().min(1)).optional()
+var canonicalSourceSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("npm"),
+    specifier: z4.string().min(1),
+    implementationPath: z4.string().min(1).optional(),
+    include: z4.array(z4.string().min(1)).optional(),
+    exclude: z4.array(z4.string().min(1)).optional()
   }),
-  z2.object({
-    kind: z2.literal("directory"),
-    path: z2.string().min(1),
-    include: z2.array(z2.string().min(1)).optional(),
-    exclude: z2.array(z2.string().min(1)).optional()
+  z4.object({
+    kind: z4.literal("directory"),
+    path: z4.string().min(1),
+    include: z4.array(z4.string().min(1)).optional(),
+    exclude: z4.array(z4.string().min(1)).optional()
   }),
-  z2.object({
-    kind: z2.literal("registry"),
-    registryId: z2.string().min(1),
+  z4.object({
+    kind: z4.literal("registry"),
+    registryId: z4.string().min(1),
     registryHash: canonicalSourceRegistryHashSchema.optional(),
     receiptPath: canonicalSourcePathSchema.default(".fragments/registry-lock.json"),
     installPath: canonicalSourcePathSchema,
-    importPath: z2.string().min(1).optional(),
-    include: z2.array(z2.string().min(1)).optional(),
-    exclude: z2.array(z2.string().min(1)).optional(),
+    importPath: z4.string().min(1).optional(),
+    include: z4.array(z4.string().min(1)).optional(),
+    exclude: z4.array(z4.string().min(1)).optional(),
     severity: governanceSeveritySchema.optional()
   })
 ]);
-var governanceConfigSchema = z2.object({
-  extends: z2.array(z2.string()).optional(),
+var governanceConfigSchema = z4.object({
+  extends: z4.array(z4.string()).optional(),
   severity: governanceSeveritySchema.optional(),
-  rules: z2.record(z2.string(), z2.unknown()).optional(),
-  agents: z2.record(
-    z2.string(),
-    z2.object({
-      rules: z2.record(z2.string(), z2.unknown()).optional()
+  rules: z4.record(z4.string(), z4.unknown()).optional(),
+  agents: z4.record(
+    z4.string(),
+    z4.object({
+      rules: z4.record(z4.string(), z4.unknown()).optional()
     }).passthrough()
   ).optional(),
-  audit: z2.object({}).passthrough().optional(),
-  runners: z2.record(z2.string(), z2.object({}).passthrough()).optional(),
-  canonicalSources: z2.array(canonicalSourceSchema).optional(),
+  audit: z4.object({}).passthrough().optional(),
+  runners: z4.record(z4.string(), z4.object({}).passthrough()).optional(),
+  canonicalSources: z4.array(canonicalSourceSchema).optional(),
   canonicalBridges: canonicalBridgesV1Schema.optional(),
-  presets: z2.array(z2.string()).optional(),
-  scales: z2.record(z2.string(), scaleGovernanceRecordSchema).optional(),
-  styles: z2.array(globalStyleGovernanceRecordSchema).optional(),
-  jsx: z2.array(globalJsxGovernanceRecordSchema).optional(),
-  tailwind: z2.object({
-    palette: z2.object({
-      allow: z2.array(z2.string().min(1)).optional(),
-      deny: z2.array(z2.string().min(1)).optional()
+  presets: z4.array(z4.string()).optional(),
+  scales: z4.record(z4.string(), scaleGovernanceRecordSchema).optional(),
+  styles: z4.array(globalStyleGovernanceRecordSchema).optional(),
+  jsx: z4.array(globalJsxGovernanceRecordSchema).optional(),
+  tailwind: z4.object({
+    palette: z4.object({
+      allow: z4.array(z4.string().min(1)).optional(),
+      deny: z4.array(z4.string().min(1)).optional()
     }).optional()
   }).passthrough().optional(),
-  agent: z2.object({
-    repairOrder: z2.array(z2.string().min(1)).optional()
+  agent: z4.object({
+    repairOrder: z4.array(z4.string().min(1)).optional()
   }).passthrough().optional(),
-  components: z2.record(componentPolicyRecordSchema).optional(),
-  overrides: z2.array(componentPolicyOverrideSchema).optional(),
-  ci: z2.object({
-    failOnWarnings: z2.boolean().optional(),
-    failOnInert: z2.boolean().optional(),
-    failOnAdoptionRegression: z2.boolean().optional()
+  components: z4.record(componentPolicyRecordSchema).optional(),
+  overrides: z4.array(componentPolicyOverrideSchema).optional(),
+  ci: z4.object({
+    failOnWarnings: z4.boolean().optional(),
+    failOnInert: z4.boolean().optional(),
+    failOnAdoptionRegression: z4.boolean().optional()
   }).passthrough().optional()
 }).strict();
 var PRESET_SOURCED_RULE = /* @__PURE__ */ Symbol.for("@usefragments/core:preset-sourced-rule");
@@ -1881,6 +2107,17 @@ function resolveComponentGovernance(definition) {
   const records = definition.govern ? definition.govern(builder) : definition.governance ?? [];
   return componentGovernanceRecordsSchema.parse(records);
 }
+function resolveGovernanceRecordsForIdentity(definition) {
+  if (!definition) return void 0;
+  if (Array.isArray(definition.governance)) {
+    return componentGovernanceRecordsSchema.parse(definition.governance);
+  }
+  if (typeof definition.govern === "function") {
+    const builder = createComponentGovernanceBuilder();
+    return componentGovernanceRecordsSchema.parse(definition.govern(builder));
+  }
+  return void 0;
+}
 function normalizeGovernanceConfig(config) {
   if (!config.govern?.scales) {
     return config;
@@ -2040,6 +2277,10 @@ function recordExclude(record) {
   const exclude = normalizePolicyExcludes(record.exclude);
   return exclude ? { exclude } : {};
 }
+function cssVarsConfigPathField(style) {
+  const value = style.configPath;
+  return typeof value === "string" && value.length > 0 ? { configPath: value } : {};
+}
 function unionExcludesBySharedFactId(facts) {
   const byId = /* @__PURE__ */ new Map();
   for (const fact of facts) {
@@ -2126,7 +2367,8 @@ function compileGlobalGovernanceFacts(govern) {
           out.push(
             makeStyleCssVarsMustBeDefinedFact({
               severity: style.severity,
-              ...recordExclude(style)
+              ...recordExclude(style),
+              ...cssVarsConfigPathField(style)
             })
           );
           break;
@@ -2265,14 +2507,19 @@ function compileRuleConfigFacts(govern) {
   const rules = govern.rules;
   if (!rules && !govern.canonicalSources?.length) return [];
   const configs = /* @__PURE__ */ new Map();
+  for (const [ruleId, value] of Object.entries(rules ?? {})) {
+    configs.set(ruleId, ruleConfigFromValue(value, govern.severity ?? "warn"));
+  }
   for (const [ruleId, value] of Object.entries(rules ?? {})) {
     const family = RULE_FAMILY_MEMBERS[ruleId];
     if (!family) continue;
+    const aggregateIsPreset = isPresetSourcedRule(value);
     const config = ruleConfigFromValue(value, govern.severity ?? "warn");
-    for (const memberRuleId of family) configs.set(memberRuleId, config);
-  }
-  for (const [ruleId, value] of Object.entries(rules ?? {})) {
-    configs.set(ruleId, ruleConfigFromValue(value, govern.severity ?? "warn"));
+    for (const memberRuleId of family) {
+      const member = rules?.[memberRuleId];
+      if (member !== void 0 && (aggregateIsPreset || !isPresetSourcedRule(member))) continue;
+      configs.set(memberRuleId, config);
+    }
   }
   if (govern.canonicalSources?.length) {
     for (const ruleId of ["components/prefer-library", "components/shadow-component"]) {
@@ -2424,244 +2671,244 @@ function compileComponentGovernanceRecord(componentId2, record) {
 }
 
 // src/schemas/index.ts
-import { z as z3 } from "zod";
-var evidenceGradeSchema = z3.enum([
+import { z as z5 } from "zod";
+var evidenceGradeSchema = z5.enum([
   "none",
   "runtime_advisory",
   "provenance_bound",
   "source_backed",
   "receipt_backed"
 ]);
-var factLocationSchema = z3.object({
-  file: z3.string(),
-  line: z3.number().int().nonnegative(),
-  column: z3.number().int().nonnegative(),
-  endLine: z3.number().int().nonnegative().optional(),
-  endColumn: z3.number().int().nonnegative().optional()
+var factLocationSchema = z5.object({
+  file: z5.string(),
+  line: z5.number().int().nonnegative(),
+  column: z5.number().int().nonnegative(),
+  endLine: z5.number().int().nonnegative().optional(),
+  endColumn: z5.number().int().nonnegative().optional()
 });
-var findingReplacePropValueFixSchema = z3.object({
-  kind: z3.literal("replacePropValue"),
-  title: z3.string(),
-  prop: z3.string(),
-  value: z3.unknown(),
-  deterministic: z3.boolean().optional()
+var findingReplacePropValueFixSchema = z5.object({
+  kind: z5.literal("replacePropValue"),
+  title: z5.string(),
+  prop: z5.string(),
+  value: z5.unknown(),
+  deterministic: z5.boolean().optional()
 });
-var findingReplaceStyleValueFixSchema = z3.object({
-  kind: z3.literal("replaceStyleValue"),
-  title: z3.string(),
-  property: z3.string(),
-  value: z3.string(),
-  deterministic: z3.boolean().optional()
+var findingReplaceStyleValueFixSchema = z5.object({
+  kind: z5.literal("replaceStyleValue"),
+  title: z5.string(),
+  property: z5.string(),
+  value: z5.string(),
+  deterministic: z5.boolean().optional()
 });
-var findingReplaceImportFixSchema = z3.object({
-  kind: z3.literal("replaceImport"),
-  title: z3.string(),
-  from: z3.string(),
-  to: z3.string(),
-  deterministic: z3.boolean().optional()
+var findingReplaceImportFixSchema = z5.object({
+  kind: z5.literal("replaceImport"),
+  title: z5.string(),
+  from: z5.string(),
+  to: z5.string(),
+  deterministic: z5.boolean().optional()
 });
-var findingReplaceComponentFixSchema = z3.object({
-  kind: z3.literal("replaceComponent"),
-  title: z3.string(),
-  from: z3.string(),
-  to: z3.string(),
-  deterministic: z3.boolean().optional()
+var findingReplaceComponentFixSchema = z5.object({
+  kind: z5.literal("replaceComponent"),
+  title: z5.string(),
+  from: z5.string(),
+  to: z5.string(),
+  deterministic: z5.boolean().optional()
 });
-var findingReplaceClassTokenFixSchema = z3.object({
-  kind: z3.literal("replaceClassToken"),
-  title: z3.string(),
-  from: z3.string(),
-  to: z3.string().nullable(),
-  utility: z3.string(),
-  deterministic: z3.boolean().optional()
+var findingReplaceClassTokenFixSchema = z5.object({
+  kind: z5.literal("replaceClassToken"),
+  title: z5.string(),
+  from: z5.string(),
+  to: z5.string().nullable(),
+  utility: z5.string(),
+  deterministic: z5.boolean().optional()
 });
-var findingFixSchema = z3.discriminatedUnion("kind", [
+var findingFixSchema = z5.discriminatedUnion("kind", [
   findingReplacePropValueFixSchema,
   findingReplaceStyleValueFixSchema,
   findingReplaceImportFixSchema,
   findingReplaceComponentFixSchema,
   findingReplaceClassTokenFixSchema
 ]);
-var factEvidenceSchema = z3.object({
-  factId: z3.string(),
-  fact: z3.object({
-    kind: z3.string(),
+var factEvidenceSchema = z5.object({
+  factId: z5.string(),
+  fact: z5.object({
+    kind: z5.string(),
     location: factLocationSchema.optional()
   }).passthrough()
 });
-var findingSchema = z3.object({
-  ruleId: z3.string(),
-  ruleVersion: z3.string(),
+var findingSchema = z5.object({
+  ruleId: z5.string(),
+  ruleVersion: z5.string(),
   severity: severitySchema,
   level: severityLevelSchema,
-  code: z3.string().regex(/^FUI\d{4}$/).optional(),
-  helpUrl: z3.string().url().optional(),
-  message: z3.string(),
-  fingerprint: z3.string(),
+  code: z5.string().regex(/^FUI\d{4}$/).optional(),
+  helpUrl: z5.string().url().optional(),
+  message: z5.string(),
+  fingerprint: z5.string(),
   /**
    * Fingerprint this finding carried before a fingerprint-identity migration.
    * Emitted only by migrated rules during the grace window so baseline
    * records keyed on the legacy hash keep matching instead of churning.
    */
-  previousFingerprint: z3.string().optional(),
+  previousFingerprint: z5.string().optional(),
   location: factLocationSchema,
-  evidence: z3.array(factEvidenceSchema).min(1),
+  evidence: z5.array(factEvidenceSchema).min(1),
   evidenceGrade: evidenceGradeSchema.optional(),
   fix: findingFixSchema.optional(),
-  attributes: z3.record(z3.unknown()).optional(),
+  attributes: z5.record(z5.unknown()).optional(),
   /**
    * Product area this finding's file resolved to (topology layer). Optional —
    * absent when the repo has no `topology` config. See `topology/resolve-area`.
    */
-  area: z3.object({
-    areaId: z3.string(),
-    areaName: z3.string(),
-    criticality: z3.enum(["low", "medium", "high", "revenue", "regulated"]),
-    owners: z3.array(z3.string()),
-    matchedGlob: z3.string()
+  area: z5.object({
+    areaId: z5.string(),
+    areaName: z5.string(),
+    criticality: z5.enum(["low", "medium", "high", "revenue", "regulated"]),
+    owners: z5.array(z5.string()),
+    matchedGlob: z5.string()
   }).optional()
 });
-var violationSchema = z3.object({
-  nodeId: z3.string(),
-  nodeType: z3.string(),
-  rule: z3.string(),
+var violationSchema = z5.object({
+  nodeId: z5.string(),
+  nodeType: z5.string(),
+  rule: z5.string(),
   severity: severitySchema,
   level: severityLevelSchema.optional(),
-  code: z3.string().regex(/^FUI\d{4}$/).optional(),
-  helpUrl: z3.string().url().optional(),
-  message: z3.string(),
-  path: z3.string().optional(),
-  suggestion: z3.string().optional(),
-  prop: z3.string().optional(),
-  filePath: z3.string().optional(),
-  line: z3.number().int().nonnegative().optional(),
-  column: z3.number().int().nonnegative().optional(),
-  rawValue: z3.string().optional(),
-  extra: z3.record(z3.unknown()).optional()
+  code: z5.string().regex(/^FUI\d{4}$/).optional(),
+  helpUrl: z5.string().url().optional(),
+  message: z5.string(),
+  path: z5.string().optional(),
+  suggestion: z5.string().optional(),
+  prop: z5.string().optional(),
+  filePath: z5.string().optional(),
+  line: z5.number().int().nonnegative().optional(),
+  column: z5.number().int().nonnegative().optional(),
+  rawValue: z5.string().optional(),
+  extra: z5.record(z5.unknown()).optional()
 });
-var fixSchema = z3.object({
-  nodeId: z3.string(),
-  prop: z3.string().optional(),
-  action: z3.enum(["remove", "replace", "add"]),
-  value: z3.unknown().optional(),
-  description: z3.string()
+var fixSchema = z5.object({
+  nodeId: z5.string(),
+  prop: z5.string().optional(),
+  action: z5.enum(["remove", "replace", "add"]),
+  value: z5.unknown().optional(),
+  description: z5.string()
 });
-var validatorResultSchema = z3.object({
-  validator: z3.string(),
+var validatorResultSchema = z5.object({
+  validator: z5.string(),
   severity: severitySchema,
-  passed: z3.boolean(),
-  violations: z3.array(violationSchema),
-  findings: z3.array(findingSchema).optional(),
-  suggestions: z3.array(fixSchema).optional()
+  passed: z5.boolean(),
+  violations: z5.array(violationSchema),
+  findings: z5.array(findingSchema).optional(),
+  suggestions: z5.array(fixSchema).optional()
 });
-var governanceVerdictMetadataSchema = z3.object({
-  runner: z3.string(),
-  policyVersion: z3.string().optional(),
-  duration: z3.number().nonnegative(),
-  nodeCount: z3.number().int().nonnegative(),
-  componentTypes: z3.array(z3.string())
+var governanceVerdictMetadataSchema = z5.object({
+  runner: z5.string(),
+  policyVersion: z5.string().optional(),
+  duration: z5.number().nonnegative(),
+  nodeCount: z5.number().int().nonnegative(),
+  componentTypes: z5.array(z5.string())
 });
-var governanceVerdictSchema = z3.object({
-  verdict: z3.enum(["pass", "warn", "fail"]).optional(),
-  passed: z3.boolean(),
-  score: z3.number(),
-  results: z3.array(validatorResultSchema),
+var governanceVerdictSchema = z5.object({
+  verdict: z5.enum(["pass", "warn", "fail"]).optional(),
+  passed: z5.boolean(),
+  score: z5.number(),
+  results: z5.array(validatorResultSchema),
   metadata: governanceVerdictMetadataSchema
 });
-var suppressionDirectiveSchema = z3.object({
-  ruleId: z3.string().optional(),
-  reason: z3.string().min(1),
-  expiresAt: z3.string().datetime().optional(),
-  expiresOn: z3.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
-  scope: z3.enum(["line", "block", "file"]).default("line"),
-  code: z3.string().regex(/^FUI\d{4}$/).optional()
+var suppressionDirectiveSchema = z5.object({
+  ruleId: z5.string().optional(),
+  reason: z5.string().min(1),
+  expiresAt: z5.string().datetime().optional(),
+  expiresOn: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
+  scope: z5.enum(["line", "block", "file"]).default("line"),
+  code: z5.string().regex(/^FUI\d{4}$/).optional()
 });
-var agentPlanSchema = z3.object({
-  tool: z3.enum([
+var agentPlanSchema = z5.object({
+  tool: z5.enum([
     "design_system/list_primitives",
     "design_system/conform",
     "design_system/prove_compliant"
   ]),
-  args: z3.record(z3.unknown()),
-  confidence: z3.number().min(0).max(1)
+  args: z5.record(z5.unknown()),
+  confidence: z5.number().min(0).max(1)
 });
-var agentFindingSchema = z3.object({
-  code: z3.string().regex(/^FUI\d{4}$/).optional(),
-  ruleId: z3.string(),
-  filePath: z3.string(),
-  line: z3.number().int().nonnegative(),
-  col: z3.number().int().nonnegative(),
+var agentFindingSchema = z5.object({
+  code: z5.string().regex(/^FUI\d{4}$/).optional(),
+  ruleId: z5.string(),
+  filePath: z5.string(),
+  line: z5.number().int().nonnegative(),
+  col: z5.number().int().nonnegative(),
   severity: severitySchema,
   level: severityLevelSchema,
-  message: z3.string(),
+  message: z5.string(),
   evidenceGrade: evidenceGradeSchema.optional(),
-  evidence: z3.array(factEvidenceSchema),
+  evidence: z5.array(factEvidenceSchema),
   plan: agentPlanSchema
 });
 var AGENT_FORMAT_SCHEMA_VERSION = "typestyle.agent.v2";
-var agentIntegritySchema = z3.object({
-  rulesLoaded: z3.number().int().nonnegative(),
-  status: z3.enum(["healthy", "degraded", "inert"]),
-  healthy: z3.boolean(),
-  inert: z3.boolean(),
-  reasons: z3.array(z3.string())
+var agentIntegritySchema = z5.object({
+  rulesLoaded: z5.number().int().nonnegative(),
+  status: z5.enum(["healthy", "degraded", "inert"]),
+  healthy: z5.boolean(),
+  inert: z5.boolean(),
+  reasons: z5.array(z5.string())
 });
-var agentRunProvenanceSchema = z3.object({
-  runId: z3.string().regex(/^run_[a-f0-9]{12}$/),
-  fcid: z3.string().min(1),
-  baselineId: z3.string().min(1).optional(),
-  scope: z3.object({
-    method: z3.enum(["three-dot", "tree-diff", "status", "fallback-full", "explicit", "full"]),
-    gitOk: z3.boolean()
+var agentRunProvenanceSchema = z5.object({
+  runId: z5.string().regex(/^run_[a-f0-9]{12}$/),
+  fcid: z5.string().min(1),
+  baselineId: z5.string().min(1).optional(),
+  scope: z5.object({
+    method: z5.enum(["three-dot", "tree-diff", "status", "fallback-full", "explicit", "full"]),
+    gitOk: z5.boolean()
   }),
-  engineVersion: z3.string().min(1),
-  scopeHash: z3.string().regex(/^[a-f0-9]{64}$/),
-  inputsHash: z3.string().regex(/^[a-f0-9]{64}$/).optional(),
-  inputFilesHash: z3.string().regex(/^[a-f0-9]{64}$/)
+  engineVersion: z5.string().min(1),
+  scopeHash: z5.string().regex(/^[a-f0-9]{64}$/),
+  inputsHash: z5.string().regex(/^[a-f0-9]{64}$/).optional(),
+  inputFilesHash: z5.string().regex(/^[a-f0-9]{64}$/)
 });
-var agentRunVerdictSchema = z3.object({
-  exitCode: z3.union([z3.literal(0), z3.literal(1)]),
-  reasons: z3.array(z3.string()),
-  gatingFindingCount: z3.number().int().nonnegative()
+var agentRunVerdictSchema = z5.object({
+  exitCode: z5.union([z5.literal(0), z5.literal(1)]),
+  reasons: z5.array(z5.string()),
+  gatingFindingCount: z5.number().int().nonnegative()
 });
-var agentFormatBaseSchema = z3.object({
-  schemaVersion: z3.literal(AGENT_FORMAT_SCHEMA_VERSION),
-  summary: z3.string(),
+var agentFormatBaseSchema = z5.object({
+  schemaVersion: z5.literal(AGENT_FORMAT_SCHEMA_VERSION),
+  summary: z5.string(),
   integrity: agentIntegritySchema,
-  fix_first: z3.array(agentFindingSchema),
-  remaining: z3.array(agentFindingSchema),
-  suppression_template: z3.object({
-    directive: z3.string(),
-    requiredFields: z3.array(z3.string()),
-    example: z3.string()
+  fix_first: z5.array(agentFindingSchema),
+  remaining: z5.array(agentFindingSchema),
+  suppression_template: z5.object({
+    directive: z5.string(),
+    requiredFields: z5.array(z5.string()),
+    example: z5.string()
   }),
-  budget: z3.object({
-    iteration: z3.number().int().nonnegative(),
-    maxIterations: z3.number().int().positive(),
-    scoreDelta: z3.number()
+  budget: z5.object({
+    iteration: z5.number().int().nonnegative(),
+    maxIterations: z5.number().int().positive(),
+    scoreDelta: z5.number()
   }),
-  findings: z3.array(findingSchema).optional(),
-  suppressions: z3.array(suppressionDirectiveSchema).optional(),
+  findings: z5.array(findingSchema).optional(),
+  suppressions: z5.array(suppressionDirectiveSchema).optional(),
   provenance: agentRunProvenanceSchema.optional(),
   verdict: agentRunVerdictSchema.optional()
 });
-var agentFormatSchema = z3.union([
+var agentFormatSchema = z5.union([
   agentFormatBaseSchema.extend({
-    passed: z3.boolean(),
-    score: z3.number(),
-    status: z3.never().optional(),
-    reasons: z3.never().optional(),
+    passed: z5.boolean(),
+    score: z5.number(),
+    status: z5.never().optional(),
+    reasons: z5.never().optional(),
     integrity: agentIntegritySchema.extend({
-      rulesLoaded: z3.number().int().positive()
+      rulesLoaded: z5.number().int().positive()
     })
   }),
   agentFormatBaseSchema.extend({
-    passed: z3.literal(false),
-    score: z3.never().optional(),
-    status: z3.literal("indeterminate"),
-    reasons: z3.tuple([z3.literal("zero_rules_loaded")]),
+    passed: z5.literal(false),
+    score: z5.never().optional(),
+    status: z5.literal("indeterminate"),
+    reasons: z5.tuple([z5.literal("zero_rules_loaded")]),
     integrity: agentIntegritySchema.extend({
-      rulesLoaded: z3.literal(0)
+      rulesLoaded: z5.literal(0)
     })
   }),
   // A finalized Run can explicitly allow inert governance. Preserve the
@@ -2669,30 +2916,30 @@ var agentFormatSchema = z3.union([
   // verdict; requiring Run pins prevents generic zero-rule envelopes from
   // accidentally becoming green.
   agentFormatBaseSchema.extend({
-    passed: z3.literal(true),
-    score: z3.never().optional(),
-    status: z3.literal("indeterminate"),
-    reasons: z3.tuple([z3.literal("zero_rules_loaded")]),
+    passed: z5.literal(true),
+    score: z5.never().optional(),
+    status: z5.literal("indeterminate"),
+    reasons: z5.tuple([z5.literal("zero_rules_loaded")]),
     integrity: agentIntegritySchema.extend({
-      rulesLoaded: z3.literal(0)
+      rulesLoaded: z5.literal(0)
     }),
     provenance: agentRunProvenanceSchema,
-    verdict: agentRunVerdictSchema.extend({ exitCode: z3.literal(0) })
+    verdict: agentRunVerdictSchema.extend({ exitCode: z5.literal(0) })
   })
 ]);
-var agentErrorEnvelopeSchema = z3.object({
-  schemaVersion: z3.literal(AGENT_FORMAT_SCHEMA_VERSION),
-  passed: z3.literal(false),
-  error: z3.object({
-    code: z3.string().min(1),
-    message: z3.string().min(1)
+var agentErrorEnvelopeSchema = z5.object({
+  schemaVersion: z5.literal(AGENT_FORMAT_SCHEMA_VERSION),
+  passed: z5.literal(false),
+  error: z5.object({
+    code: z5.string().min(1),
+    message: z5.string().min(1)
   }),
   provenance: agentRunProvenanceSchema.optional(),
   verdict: agentRunVerdictSchema.optional(),
-  cloudReport: z3.enum(["reported", "failed", "skipped"]).optional(),
-  notices: z3.array(z3.string()).optional()
+  cloudReport: z5.enum(["accepted", "reported", "failed", "skipped"]).optional(),
+  notices: z5.array(z5.string()).optional()
 });
-var agentOutputSchema = z3.union([agentFormatSchema, agentErrorEnvelopeSchema]);
+var agentOutputSchema = z5.union([agentFormatSchema, agentErrorEnvelopeSchema]);
 function normalizeSeverity(severity) {
   return severitySchema.safeParse(severity).success ? severity : severityFromLevel(legacySeverityLevelSchema.parse(severity));
 }
@@ -2805,6 +3052,25 @@ export {
   byCode,
   byRuleId,
   explainUrlForCode,
+  digestHexStringSchema,
+  digestHexSchema,
+  analysisPlanIdStringSchema,
+  analysisPlanIdSchema,
+  evaluationReceiptIdSchema,
+  evaluationReceiptIdStringSchema,
+  parseDigestHex,
+  analysisPlanIdFromDigest,
+  evaluationReceiptIdFromDigest,
+  mintEvaluationReceiptId,
+  parseAnalysisPlanId,
+  parseEvaluationReceiptId,
+  CANONICAL_FACT_MAX_CONFLICTS_V1,
+  CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1,
+  CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1,
+  canonicalFactConflictValueV1Schema,
+  canonicalFactConflictV1Schema,
+  canonicalFactIntegrityV1Schema,
+  normalizeCanonicalFactIntegrityV1,
   canonicalJson,
   hash64Hex,
   componentId,
@@ -2870,11 +3136,13 @@ export {
   globalGovernanceRecordSchema,
   componentGovernanceRecordSchema,
   componentGovernanceRecordsSchema,
+  parseComponentGovernancePolicyJson,
   canonicalBridgeV1Schema,
   governanceConfigSchema,
   markPresetSourcedRules,
   isPresetSourcedRule,
   resolveComponentGovernance,
+  resolveGovernanceRecordsForIdentity,
   normalizeGovernanceConfig,
   g,
   RULE_FAMILY_MEMBERS,
@@ -2912,4 +3180,4 @@ export {
   normalizeFinding,
   normalizeViolation
 };
-//# sourceMappingURL=chunk-XN3LSDPY.js.map
+//# sourceMappingURL=chunk-BMPYIUZE.js.map