@usefragments/core 1.11.0 → 2.0.1

package/dist/{chunk-3LLRNCPX.js → chunk-MZ2FS7U4.js}

@@ -108,4 +108,4 @@ function resolveArea(repoRelPath, topology) {
 export {
   resolveArea
 };
-//# sourceMappingURL=chunk-3LLRNCPX.js.map
+//# sourceMappingURL=chunk-MZ2FS7U4.js.map

package/dist/chunk-MZ2FS7U4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/topology/resolve-area.ts"],"sourcesContent":["/**\n * Topology — map a repo-relative file path to its product area.\n *\n * This is the DRY keystone of the topology layer: the ONLY area-matching\n * implementation in the monorepo. Consumers (CLI scan, Cloud managed-editor\n * preview, cross-repo reconciliation) import it; none reimplements glob/area\n * logic. Pure and browser-safe — no Node, no parser deps.\n *\n * See `docs/fragments-v1/ARCHITECTURE.md §1`.\n */\n\nexport type AreaCriticality = \"low\" | \"medium\" | \"high\" | \"revenue\" | \"regulated\";\n\nexport interface Area {\n  id: string;\n  name: string;\n  criticality: AreaCriticality;\n  owners: string[];\n  /** Globs matched against repo-relative file paths in v0. */\n  files: string[];\n  /** Stored for later route-topology adapters; NOT matched in v0. */\n  routes?: string[];\n  /** Tie-break: higher wins. Defaults to declaration order. */\n  priority?: number;\n}\n\nexport interface Topology {\n  /** Bump signals \"re-tag\" to consumers that cache. */\n  version: number;\n  /** Whether area file globs are matched relative to app.path or repo root. Defaults to \"app\". */\n  base?: \"app\" | \"repo\";\n  /** Array (not a keyed record) so precedence is deterministic. */\n  areas: Area[];\n}\n\nexport interface AreaMatch {\n  areaId: string;\n  areaName: string;\n  criticality: AreaCriticality;\n  owners: string[];\n  /** The winning pattern — surfaced in reports for transparency. */\n  matchedGlob: string;\n}\n\n/**\n * Compile a minimal glob to an anchored RegExp. We intentionally do NOT depend\n * on picomatch: core stays lean, the surface we need is small, and we want\n * exact control over Next.js route-group parens (`(marketing)` is a literal\n * path segment here, not an extglob group).\n *\n * Semantics:\n *   - `/**` at a segment boundary (end-of-glob or before `/`) → \"this directory\n *     and everything under it\": the leading slash is optional, so\n *     `src/app/checkout/**` matches `src/app/checkout` AND any descendant.\n *   - a bare/leading `**` → matches across path separators (`.*`). Note a\n *     leading globstar-then-slash does NOT match the root (use a lone `**`\n *     for \"everything\").\n *   - `*`   → matches within a single segment (`[^/]*`)\n *   - `?`   → a single non-separator char\n *   - `{a,b}` → alternation `(?:a|b)`\n *   - every other regex-significant char (`.`, `(`, `)`, `+`, …) is literal\n *\n * Throws on a malformed pattern (e.g. an unbalanced `{`). Callers compile via\n * `compile()`, which catches the throw so a config typo degrades one glob to a\n * non-match instead of aborting the whole scan.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let out = \"\";\n  let braceDepth = 0;\n  let i = 0;\n  while (i < glob.length) {\n    const ch = glob[i];\n\n    // `/**` at a segment boundary → optional slash + anything-below. Matches\n    // the directory itself (`a/**` ⇒ `a`) and every descendant.\n    if (\n      ch === \"/\" &&\n      glob[i + 1] === \"*\" &&\n      glob[i + 2] === \"*\" &&\n      (glob[i + 3] === undefined || glob[i + 3] === \"/\")\n    ) {\n      out += \"(?:/.*)?\";\n      i += 3; // consume `/**`; a trailing `/` (in `a/**/b`) is handled next pass\n      continue;\n    }\n\n    // Bare/leading globstar — crosses path separators.\n    if (ch === \"*\" && glob[i + 1] === \"*\") {\n      out += \".*\";\n      i += 2;\n      continue;\n    }\n\n    switch (ch) {\n      case \"*\":\n        out += \"[^/]*\"; // single segment\n        break;\n      case \"?\":\n        out += \"[^/]\";\n        break;\n      case \"{\":\n        braceDepth += 1;\n        out += \"(?:\";\n        break;\n      case \"}\":\n        if (braceDepth > 0) {\n          braceDepth -= 1;\n          out += \")\";\n        } else {\n          out += \"\\\\}\";\n        }\n        break;\n      case \",\":\n        out += braceDepth > 0 ? \"|\" : \",\";\n        break;\n      // Regex-significant chars kept literal (parens cover route groups).\n      case \".\":\n      case \"(\":\n      case \")\":\n      case \"+\":\n      case \"^\":\n      case \"$\":\n      case \"|\":\n      case \"[\":\n      case \"]\":\n      case \"\\\\\":\n        out += `\\\\${ch}`;\n        break;\n      default:\n        out += ch;\n    }\n    i += 1;\n  }\n  return new RegExp(`^${out}$`);\n}\n\ninterface CompiledArea {\n  area: Area;\n  matchers: { glob: string; re: RegExp }[];\n}\n\n/**\n * Cache compiled matchers per topology object. Consumers pass the same\n * `topology` for every finding in a run, so this turns N×globs recompiles into\n * one. A reloaded config is a new object → fresh entry, so `version` bumps need\n * no manual invalidation.\n */\nconst compiledCache = new WeakMap<Topology, CompiledArea[]>();\n\nfunction compile(topology: Topology): CompiledArea[] {\n  const cached = compiledCache.get(topology);\n  if (cached) return cached;\n\n  // Order by (priority desc, declaration order). Decorate-sort-undecorate keeps\n  // the sort stable across engines.\n  const ordered = topology.areas\n    .map((area, index) => ({ area, index }))\n    .sort((a, b) => {\n      const pa = a.area.priority ?? 0;\n      const pb = b.area.priority ?? 0;\n      if (pa !== pb) return pb - pa;\n      return a.index - b.index;\n    })\n    .map(({ area }) => ({\n      area,\n      matchers: area.files.flatMap((glob) => {\n        try {\n          return [{ glob, re: globToRegExp(glob) }];\n        } catch {\n          // A malformed glob (e.g. unbalanced `{`) compiles to an invalid\n          // RegExp. Skip it rather than aborting the entire scan — topology\n          // config is user-authored, so one typo must not take down\n          // `fragments check`. Its files simply fall through to \"Unassigned\".\n          if (typeof console !== \"undefined\") {\n            console.warn(\n              `[topology] ignoring invalid glob in area \"${area.id}\": ${JSON.stringify(glob)}`\n            );\n          }\n          return [];\n        }\n      }),\n    }));\n\n  compiledCache.set(topology, ordered);\n  return ordered;\n}\n\n/** Normalize to a POSIX, repo-relative path before matching. */\nfunction normalizePath(repoRelPath: string): string {\n  return repoRelPath.replace(/\\\\/g, \"/\").replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n}\n\n/**\n * Resolve the product area for a repo-relative path. First match by\n * `(priority desc, declaration order)`. Returns `null` when nothing matches —\n * the caller buckets that as the explicit \"Unassigned\" area (never dropped;\n * dropping unmatched evidence would make coverage lie).\n */\nexport function resolveArea(repoRelPath: string, topology: Topology): AreaMatch | null {\n  const path = normalizePath(repoRelPath);\n  for (const { area, matchers } of compile(topology)) {\n    for (const { glob, re } of matchers) {\n      if (re.test(path)) {\n        return {\n          areaId: area.id,\n          areaName: area.name,\n          criticality: area.criticality,\n          owners: area.owners,\n          matchedGlob: glob,\n        };\n      }\n    }\n  }\n  return null;\n}\n"],"mappings":";AAkEA,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,QAAQ;AACtB,UAAM,KAAK,KAAK,CAAC;AAIjB,QACE,OAAO,OACP,KAAK,IAAI,CAAC,MAAM,OAChB,KAAK,IAAI,CAAC,MAAM,QACf,KAAK,IAAI,CAAC,MAAM,UAAa,KAAK,IAAI,CAAC,MAAM,MAC9C;AACA,aAAO;AACP,WAAK;AACL;AAAA,IACF;AAGA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,aAAO;AACP,WAAK;AACL;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO;AACP;AAAA,MACF,KAAK;AACH,eAAO;AACP;AAAA,MACF,KAAK;AACH,sBAAc;AACd,eAAO;AACP;AAAA,MACF,KAAK;AACH,YAAI,aAAa,GAAG;AAClB,wBAAc;AACd,iBAAO;AAAA,QACT,OAAO;AACL,iBAAO;AAAA,QACT;AACA;AAAA,MACF,KAAK;AACH,eAAO,aAAa,IAAI,MAAM;AAC9B;AAAA;AAAA,MAEF,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO,KAAK,EAAE;AACd;AAAA,MACF;AACE,eAAO;AAAA,IACX;AACA,SAAK;AAAA,EACP;AACA,SAAO,IAAI,OAAO,IAAI,GAAG,GAAG;AAC9B;AAaA,IAAM,gBAAgB,oBAAI,QAAkC;AAE5D,SAAS,QAAQ,UAAoC;AACnD,QAAM,SAAS,cAAc,IAAI,QAAQ;AACzC,MAAI,OAAQ,QAAO;AAInB,QAAM,UAAU,SAAS,MACtB,IAAI,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,EAAE,EACtC,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,KAAK,EAAE,KAAK,YAAY;AAC9B,UAAM,KAAK,EAAE,KAAK,YAAY;AAC9B,QAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,WAAO,EAAE,QAAQ,EAAE;AAAA,EACrB,CAAC,EACA,IAAI,CAAC,EAAE,KAAK,OAAO;AAAA,IAClB;AAAA,IACA,UAAU,KAAK,MAAM,QAAQ,CAAC,SAAS;AACrC,UAAI;AACF,eAAO,CAAC,EAAE,MAAM,IAAI,aAAa,IAAI,EAAE,CAAC;AAAA,MAC1C,QAAQ;AAKN,YAAI,OAAO,YAAY,aAAa;AAClC,kBAAQ;AAAA,YACN,6CAA6C,KAAK,EAAE,MAAM,KAAK,UAAU,IAAI,CAAC;AAAA,UAChF;AAAA,QACF;AACA,eAAO,CAAC;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,EAAE;AAEJ,gBAAc,IAAI,UAAU,OAAO;AACnC,SAAO;AACT;AAGA,SAAS,cAAc,aAA6B;AAClD,SAAO,YAAY,QAAQ,OAAO,GAAG,EAAE,QAAQ,SAAS,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAChF;AAQO,SAAS,YAAY,aAAqB,UAAsC;AACrF,QAAM,OAAO,cAAc,WAAW;AACtC,aAAW,EAAE,MAAM,SAAS,KAAK,QAAQ,QAAQ,GAAG;AAClD,eAAW,EAAE,MAAM,GAAG,KAAK,UAAU;AACnC,UAAI,GAAG,KAAK,IAAI,GAAG;AACjB,eAAO;AAAA,UACL,QAAQ,KAAK;AAAA,UACb,UAAU,KAAK;AAAA,UACf,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-RPSEABY3.js → chunk-QPOKQ5H6.js}

@@ -571,6 +571,16 @@ var CODES = [
     lifecycle: "experimental",
     fixAvailable: false,
     evidenceRequired: false
+  }),
+  code({
+    code: "FUI9012",
+    ruleId: "contract/write-not-entitled",
+    category: "system",
+    defaultSeverity: "critical",
+    title: "Contract write requires a paid workspace",
+    lifecycle: "experimental",
+    fixAvailable: false,
+    evidenceRequired: false
   })
 ];
 var byCode = new Map(
@@ -589,7 +599,6 @@ import { z as z2 } from "zod";
 // src/domain-ids.ts
 import { z } from "zod";
 var FULL_DIGEST_PATTERN = /^[0-9a-f]{64}$/u;
-var WORKFLOW_ENTROPY_PATTERN = /^[0-9a-f]{32}$/u;
 var digestHexStringSchema = z.string().regex(FULL_DIGEST_PATTERN, "Expected 64 lowercase hexadecimal characters");
 var digestHexSchema = digestHexStringSchema;
 var analysisPlanIdStringSchema = z.string().regex(/^apl_[0-9a-f]{64}$/u, "Invalid analysis plan ID");
@@ -598,14 +607,6 @@ var analysisPlanIdSchema = analysisPlanIdStringSchema.transform(
 );
 var evaluationReceiptIdSchema = z.string().regex(/^evr_[0-9a-f]{64}$/u, "Invalid evaluation receipt ID").transform((value) => value);
 var evaluationReceiptIdStringSchema = z.string().regex(/^evr_[0-9a-f]{64}$/u, "Invalid evaluation receipt ID");
-var featurePlanIdStringSchema = z.string().regex(/^fpl_[0-9a-f]{32}$/u, "Invalid feature plan ID");
-var featurePlanIdSchema = featurePlanIdStringSchema.transform(
-  (value) => value
-);
-var featureRevisionIdStringSchema = z.string().regex(/^fpr_[0-9a-f]{64}$/u, "Invalid feature revision ID");
-var featureRevisionIdSchema = featureRevisionIdStringSchema.transform(
-  (value) => value
-);
 function parseDigestHex(value) {
   return digestHexSchema.parse(value);
 }
@@ -618,27 +619,12 @@ function evaluationReceiptIdFromDigest(digest) {
 function mintEvaluationReceiptId(resultDigest) {
   return evaluationReceiptIdFromDigest(resultDigest);
 }
-function featureRevisionIdFromDigest(digest) {
-  return featureRevisionIdSchema.parse(`fpr_${parseDigestHex(digest)}`);
-}
-function featurePlanIdFromEntropy(entropyHex) {
-  if (!WORKFLOW_ENTROPY_PATTERN.test(entropyHex)) {
-    throw new TypeError("Feature plan entropy must be exactly 128-bit lowercase hexadecimal");
-  }
-  return featurePlanIdSchema.parse(`fpl_${entropyHex}`);
-}
 function parseAnalysisPlanId(value) {
   return analysisPlanIdSchema.parse(value);
 }
 function parseEvaluationReceiptId(value) {
   return evaluationReceiptIdSchema.parse(value);
 }
-function parseFeaturePlanId(value) {
-  return featurePlanIdSchema.parse(value);
-}
-function parseFeatureRevisionId(value) {
-  return featureRevisionIdSchema.parse(value);
-}
 
 // src/facts/integrity.ts
 var CANONICAL_FACT_MAX_CONFLICTS_V1 = 1e3;
@@ -875,6 +861,7 @@ function makeComponentDefinitionFact(input) {
     componentKey: input.componentKey,
     renderRoot: input.renderRoot,
     propSurface: [...input.propSurface],
+    ...input.location ? { location: { ...input.location } } : {},
     ...input.stylingChannel ? { stylingChannel: { ...input.stylingChannel } } : {}
   };
 }
@@ -1218,7 +1205,8 @@ function makeUsageComponentFact(input) {
     }),
     kind: "usage_component",
     nodeId: input.nodeId,
-    componentId: input.componentId
+    componentId: input.componentId,
+    ...input.definitionKey ? { definitionKey: input.definitionKey } : {}
   };
 }
 function makeUsageImportFact(input) {
@@ -1438,6 +1426,10 @@ function logicalFactForComparison(fact) {
     const { location: _location, sourceNames: _sourceNames, ...logicalFact } = fact;
     return logicalFact;
   }
+  if (fact.kind === "component_definition") {
+    const { location: _location, ...logicalFact } = fact;
+    return { ...logicalFact, componentId: logicalComponentId(fact.componentId) };
+  }
   if (fact.kind === "jsx_import_path_preferred") {
     return {
       ...fact,
@@ -1900,6 +1892,17 @@ var componentGovernanceRecordSchema = z4.discriminatedUnion("kind", [
   a11yRequireNameRecordSchema
 ]);
 var componentGovernanceRecordsSchema = z4.array(componentGovernanceRecordSchema);
+function parseComponentGovernancePolicyJson(policyJson) {
+  try {
+    const parsed = JSON.parse(policyJson);
+    const record = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    const candidate = Array.isArray(parsed) ? parsed : record?.governance ?? record?.rules;
+    const result = componentGovernanceRecordsSchema.safeParse(candidate);
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
 var componentPolicyMatchSchema = z4.object({
   componentKey: z4.string().min(1).optional(),
   componentId: z4.string().min(1).optional(),
@@ -3061,20 +3064,12 @@ export {
   analysisPlanIdSchema,
   evaluationReceiptIdSchema,
   evaluationReceiptIdStringSchema,
-  featurePlanIdStringSchema,
-  featurePlanIdSchema,
-  featureRevisionIdStringSchema,
-  featureRevisionIdSchema,
   parseDigestHex,
   analysisPlanIdFromDigest,
   evaluationReceiptIdFromDigest,
   mintEvaluationReceiptId,
-  featureRevisionIdFromDigest,
-  featurePlanIdFromEntropy,
   parseAnalysisPlanId,
   parseEvaluationReceiptId,
-  parseFeaturePlanId,
-  parseFeatureRevisionId,
   CANONICAL_FACT_MAX_CONFLICTS_V1,
   CANONICAL_FACT_MAX_VALUES_PER_CONFLICT_V1,
   CANONICAL_FACT_MAX_PROVENANCE_PER_VALUE_V1,
@@ -3147,6 +3142,7 @@ export {
   globalGovernanceRecordSchema,
   componentGovernanceRecordSchema,
   componentGovernanceRecordsSchema,
+  parseComponentGovernancePolicyJson,
   canonicalBridgeV1Schema,
   governanceConfigSchema,
   markPresetSourcedRules,
@@ -3190,4 +3186,4 @@ export {
   normalizeFinding,
   normalizeViolation
 };
-//# sourceMappingURL=chunk-RPSEABY3.js.map
+//# sourceMappingURL=chunk-QPOKQ5H6.js.map