@usefragments/core 1.4.0 → 1.5.1

package/dist/index.js

@@ -49,6 +49,7 @@ import {
   bridgeSourceViolations,
   byCode,
   byRuleId,
+  canonicalBridgeV1Schema,
   canonicalJson,
   compileComponentFacts,
   compileGlobalGovernanceFacts,
@@ -71,6 +72,8 @@ import {
   makeClassNameDynamicFact,
   makeClassNameLiteralFact,
   makeComponentCapabilityFact,
+  makeComponentDefinitionFact,
+  makeComponentIdentityFact,
   makeComponentMetadataFact,
   makeContractTokenFact,
   makeJsxComponentPreferredFact,
@@ -109,7 +112,7 @@ import {
   ownedImportsEqual,
   resolveComponentGovernance,
   scaleGovernanceRecordSchema
-} from "./chunk-CBSNXFOD.js";
+} from "./chunk-AOG4FTV6.js";
 import {
   AGENT_FORMAT_SCHEMA_VERSION,
   agentErrorEnvelopeSchema,
@@ -134,7 +137,7 @@ import {
   suppressionDirectiveSchema,
   validatorResultSchema,
   violationSchema
-} from "./chunk-57QDBEHQ.js";
+} from "./chunk-ZHS52OT4.js";
 import {
   OWNED_PACKAGE_IDENTITY_EPOCH,
   OWNED_PACKAGE_IDENTITY_SOURCE_SHA256,
@@ -1685,6 +1688,14 @@ var tokenConfigSchema = z4.object({
   // vocabulary seeds the known-token set (#7c). A packages-only tokens block
   // is valid — see the superRefine below.
   packages: z4.array(z4.string().min(1)).optional(),
+  aliases: z4.record(z4.string().min(1)).optional(),
+  upstream: z4.array(
+    z4.object({
+      packageName: z4.string().min(1),
+      version: z4.string().min(1).optional(),
+      digest: z4.string().regex(/^[a-f0-9]{64}$/u).optional()
+    })
+  ).optional(),
   exclude: z4.array(repoRelativePathSchema).optional(),
   themeSelectors: z4.record(z4.string()).optional(),
   enabled: z4.boolean().optional(),
@@ -1776,7 +1787,18 @@ var fragmentsConfigSchema = z4.object({
       })
     ).optional()
   }).optional(),
-  recognizedClassHelpers: z4.array(z4.string().min(1)).optional()
+  recognizedClassHelpers: z4.array(z4.string().min(1)).optional(),
+  identity: z4.object({
+    decisions: z4.array(
+      z4.object({
+        component: z4.string().min(1),
+        kind: z4.enum(["sanction", "reject", "dismiss"]),
+        canonicalTarget: z4.string().min(1).optional(),
+        reason: z4.string().optional(),
+        decisionId: z4.string().min(1).optional()
+      })
+    ).optional()
+  }).optional()
 });
 var compositionMetadataSchema = z4.object({
   pattern: z4.enum(["compound", "simple", "controlled", "wrapper"]).optional(),
@@ -4762,13 +4784,20 @@ function isExemptColor(value, except) {
   }
   return false;
 }
-function tokenReference(name) {
-  if (name.startsWith("$")) return name;
-  const cssVarName = name.startsWith("--") ? name : `--${name.replace(/\./g, "-")}`;
-  return `var(${cssVarName})`;
+function tokenReference(token) {
+  if (token.referenceFormat === "css-var") {
+    const cssVarName = [token.name, ...token.sourceNames ?? []].find(
+      (name) => name.startsWith("--")
+    );
+    return cssVarName ? `var(${cssVarName})` : token.name;
+  }
+  if (token.referenceFormat === "scss-var") {
+    return [token.name, ...token.sourceNames ?? []].find((name) => name.startsWith("$")) ?? (token.name.startsWith("--") ? `$${token.name.slice(2)}` : token.name);
+  }
+  return token.sourceNames?.[0] ?? token.name;
 }
 function isApplicableTokenReference(referenceFormat) {
-  return referenceFormat === void 0 || referenceFormat === "css-var" || referenceFormat === "scss-var";
+  return referenceFormat === "css-var" || referenceFormat === "scss-var";
 }
 
 // src/rules/a11y-required-accessible-name.ts
@@ -4925,6 +4954,77 @@ function isEnforceableHtmlEquivalent(args) {
   return builtIn !== null && builtIn.canonical === args.canonical;
 }
 
+// src/canonical-direction.ts
+function projectCanonicalDirectionConflicts(ix, canonicalSources) {
+  const npmSources = canonicalSources.filter(
+    (source) => source.kind === "npm"
+  );
+  if (npmSources.length === 0) return [];
+  const identityByComponent = new Map(
+    ix.byKind("component_identity").map((identity) => [identity.componentKey, identity])
+  );
+  const conflicts = [];
+  for (const definition of ix.byKind("component_definition")) {
+    if (!definition.exported || definition.renderRoot.resolution !== "canonical") continue;
+    const target = npmTarget(definition.renderRoot.canonical, npmSources);
+    if (!target) continue;
+    const identity = identityByComponent.get(definition.componentKey);
+    if (identity?.decisionId && decisionTargetsExport(identity.canonicalTarget, target.exportName)) {
+      if (identity.state === "shadow") continue;
+      if (identity.state === "variant" && identity.confidence === "confirmed") {
+        conflicts.push({
+          ...target,
+          wrapperComponentKey: definition.componentKey,
+          wrapperFile: definition.file,
+          wrapperExportName: definition.exportName,
+          state: "sanctioned"
+        });
+        continue;
+      }
+    }
+    conflicts.push({
+      ...target,
+      wrapperComponentKey: definition.componentKey,
+      wrapperFile: definition.file,
+      wrapperExportName: definition.exportName,
+      state: "unresolved"
+    });
+  }
+  return conflicts.sort(
+    (left, right) => left.packageName.localeCompare(right.packageName) || left.exportName.localeCompare(right.exportName) || left.wrapperComponentKey.localeCompare(right.wrapperComponentKey)
+  );
+}
+function canonicalDirectionConflictsTarget(conflicts, importPath, exportName) {
+  if (!importPath) return false;
+  return conflicts.some(
+    (conflict) => ownedImportMatchesRoot(importPath, conflict.packageName) && conflict.exportName === exportName
+  );
+}
+function npmTarget(canonicalTarget, sources) {
+  const separator = canonicalTarget.lastIndexOf("#");
+  if (separator <= 0 || separator === canonicalTarget.length - 1) return null;
+  const importPath = canonicalTarget.slice(0, separator);
+  const imported = canonicalTarget.slice(separator + 1).split(".").at(-1);
+  if (!imported) return null;
+  for (const source of sources) {
+    if (!ownedImportMatchesRoot(importPath, source.specifier)) continue;
+    const subpath = packageSubpath(importPath, source.specifier);
+    const exportName = imported === "default" ? subpath.split("/").filter(Boolean).at(-1) : imported;
+    if (!exportName) continue;
+    if (source.exclude?.includes(exportName)) continue;
+    if (source.include && !source.include.includes(exportName)) continue;
+    return { packageName: source.specifier, exportName };
+  }
+  return null;
+}
+function packageSubpath(importPath, packageName) {
+  return importPath === packageName ? "" : importPath.slice(packageName.length + 1);
+}
+function decisionTargetsExport(target, exportName) {
+  if (!target) return true;
+  return target === exportName || target.split("#").at(-1)?.split(".").at(-1) === exportName;
+}
+
 // src/rules/components-prefer-library.ts
 var RULE_ID2 = "components/prefer-library";
 var RULE_VERSION2 = "1";
@@ -5068,8 +5168,12 @@ function findClassNameReimpl(node, classTokensByNode, targets) {
 function ruleComponentsPreferLibrary(ix) {
   const policy = ix.policy.ruleConfig(RULE_ID2);
   if (!policy?.enabled) return [];
-  const sources = canonicalSourcesFromPolicy(policy.options?.canonicalSources);
-  const mappings = canonicalMappingsFromPolicy(policy.options?.canonicalMappings);
+  const configuredSources = canonicalSourcesFromPolicy(policy.options?.canonicalSources);
+  const conflicts = projectCanonicalDirectionConflicts(ix, configuredSources);
+  const sources = configuredSources.map((source) => suppressConflictedExports(source, conflicts));
+  const mappings = canonicalMappingsFromPolicy(policy.options?.canonicalMappings).filter(
+    (mapping) => !canonicalDirectionConflictsTarget(conflicts, mapping.importPath, mapping.name)
+  );
   if (sources.length === 0 && mappings.length === 0) return [];
   const importsByFileAndLocal = indexImportsByFileAndLocal(ix);
   const propsByNode = indexPropsByNodeId(ix);
@@ -5077,12 +5181,14 @@ function ruleComponentsPreferLibrary(ix) {
   const classTokensByNode = indexClassTokensByNode(ix);
   const reimplTargets = canonicalReimplTargets(sources, mappings);
   const canonicalDirectoryResolvedNodes = indexCanonicalDirectoryResolvedNodes(ix, sources);
+  const shadowRenderRootNodeIds = indexShadowRenderRootNodeIds(ix);
   const findings = [];
   const seenImportFixes = /* @__PURE__ */ new Set();
   for (const node of ix.byKind("usage_node")) {
     if (isCanonicalSourceImplementationFile(node.file, sources)) continue;
     if (node.element.includes(".")) continue;
     if (canonicalDirectoryResolvedNodes.has(node.id)) continue;
+    if (shadowRenderRootNodeIds.has(node.id)) continue;
     const props = propsByNode.get(node.id) ?? [];
     const textChildren = textByNode.get(node.id) ?? [];
     const importsForFile = importsByFileAndLocal.get(node.file);
@@ -5330,6 +5436,28 @@ function ruleComponentsPreferLibrary(ix) {
   }
   return findings;
 }
+function suppressConflictedExports(source, conflicts) {
+  if (source.kind !== "npm") return source;
+  const names = conflicts.filter((conflict) => ownedImportMatchesRoot(source.specifier, conflict.packageName)).map((conflict) => conflict.exportName);
+  if (names.length === 0) return source;
+  const blocked = new Set(names);
+  if (source.include) {
+    return { ...source, include: source.include.filter((name) => !blocked.has(name)) };
+  }
+  return { ...source, exclude: [.../* @__PURE__ */ new Set([...source.exclude ?? [], ...names])].sort() };
+}
+function indexShadowRenderRootNodeIds(ix) {
+  const identities = ix.byKind("component_identity");
+  if (identities.length === 0) return /* @__PURE__ */ new Set();
+  const nodeIds = /* @__PURE__ */ new Set();
+  for (const identity of identities) {
+    if (identity.state !== "shadow") continue;
+    for (const evidenceId of identity.evidence) {
+      if (ix.get(evidenceId)?.kind === "usage_node") nodeIds.add(evidenceId);
+    }
+  }
+  return nodeIds;
+}
 function findBuiltInRawHtmlMatch(node, props, textChildren, inputType) {
   if (isIconOnlyButton(node, props, textChildren)) {
     return { canonical: "IconButton", tier: "icon-only" };
@@ -5656,9 +5784,95 @@ function isIdentifier(value) {
   return /^[A-Za-z_$][\w$]*$/.test(value);
 }
 
-// src/rules/components-forbidden-prop-value.ts
-var RULE_ID3 = "components/forbidden-prop-value";
+// src/identity/usage.ts
+function indexComponentIdentityUsage(ix) {
+  const nodesById = new Map(ix.byKind("usage_node").map((node) => [node.id, node]));
+  const nodesByComponent = /* @__PURE__ */ new Map();
+  for (const usage of ix.byKind("usage_component")) {
+    const node = nodesById.get(usage.nodeId);
+    if (!node) continue;
+    const componentKey = String(usage.componentId);
+    const nodes = nodesByComponent.get(componentKey) ?? /* @__PURE__ */ new Map();
+    nodes.set(node.id, node);
+    nodesByComponent.set(componentKey, nodes);
+  }
+  return new Map(
+    [...nodesByComponent].map(([componentKey, nodesByIdForComponent]) => {
+      const nodes = [...nodesByIdForComponent.values()];
+      return [
+        componentKey,
+        {
+          usageCount: nodes.length,
+          blastRadius: new Set(nodes.map((node) => node.file)).size,
+          nodes
+        }
+      ];
+    })
+  );
+}
+
+// src/rules/components-shadow-component.ts
+var RULE_ID3 = "components/shadow-component";
 var RULE_VERSION3 = "1";
+function ruleComponentsShadowComponent(ix) {
+  const policy = ix.policy.ruleConfig(RULE_ID3);
+  if (!policy?.enabled) return [];
+  const definitions = new Map(
+    ix.byKind("component_definition").map((definition) => [definition.componentKey, definition])
+  );
+  const usageByComponent = indexComponentIdentityUsage(ix);
+  const findings = [];
+  for (const identity of ix.byKind("component_identity")) {
+    const reviewVariant = identity.state === "variant" && identity.confidence === "review";
+    if (identity.state !== "shadow" && !reviewVariant) continue;
+    const definition = definitions.get(identity.componentKey);
+    if (!definition) continue;
+    const usage = usageByComponent.get(identity.componentKey);
+    const usageCount = usage?.usageCount ?? 0;
+    const blastRadius = usage?.blastRadius ?? 0;
+    findings.push(
+      makeFinding({
+        ruleId: RULE_ID3,
+        ruleVersion: RULE_VERSION3,
+        severity: reviewVariant ? "info" : policy.severity ?? "warn",
+        message: reviewVariant ? `${definition.exportName} wraps ${identity.canonicalTarget ?? "a canonical component"}; sanction it as a variant or consolidate its usages.` : `${definition.exportName} shadows ${identity.canonicalTarget ?? "a canonical component"} across ${usageCount} usage${usageCount === 1 ? "" : "s"}.`,
+        location: definitionLocation(ix, definition, identity),
+        evidence: ix.evidence(identity.evidence),
+        fingerprintIdentity: {
+          componentKey: identity.componentKey,
+          canonicalTarget: identity.canonicalTarget
+        },
+        attributes: {
+          canonicalTarget: identity.canonicalTarget,
+          usageCount,
+          blastRadius,
+          confidence: identity.confidence,
+          state: identity.state,
+          ...reviewVariant ? { advisory: true } : {}
+        }
+      })
+    );
+  }
+  return findings;
+}
+function definitionLocation(ix, definition, identity) {
+  const evidence = ix.evidence(identity.evidence).map(({ fact }) => fact);
+  const inDefinitionFile = evidence.find(
+    (fact) => "location" in fact && fact.location?.file === definition.file
+  );
+  if (inDefinitionFile && "location" in inDefinitionFile && inDefinitionFile.location) {
+    return inDefinitionFile.location;
+  }
+  const sourceLocated = evidence.find((fact) => "location" in fact && fact.location);
+  if (sourceLocated && "location" in sourceLocated && sourceLocated.location) {
+    return sourceLocated.location;
+  }
+  return { file: definition.file, line: 1, column: 0 };
+}
+
+// src/rules/components-forbidden-prop-value.ts
+var RULE_ID4 = "components/forbidden-prop-value";
+var RULE_VERSION4 = "1";
 function ruleComponentsForbiddenPropValue(ix) {
   const findings = [];
   const componentByNode = indexComponentByNodeId(ix);
@@ -5688,8 +5902,8 @@ function ruleComponentsForbiddenPropValue(ix) {
       } : void 0;
       findings.push(
         makeFinding({
-          ruleId: RULE_ID3,
-          ruleVersion: RULE_VERSION3,
+          ruleId: RULE_ID4,
+          ruleVersion: RULE_VERSION4,
           severity: policy.severity,
           message: buildMessage(
             node.element,
@@ -5733,8 +5947,8 @@ function buildMessage(element, prop, value, because, replacement) {
 }
 
 // src/rules/components-unknown-prop.ts
-var RULE_ID4 = "components/unknown-prop";
-var RULE_VERSION4 = "1";
+var RULE_ID5 = "components/unknown-prop";
+var RULE_VERSION5 = "1";
 function ruleComponentsUnknownProp(ix) {
   const policy = ix.policy.jsxUnknownPropsForbidden();
   if (!policy) return [];
@@ -5755,8 +5969,8 @@ function ruleComponentsUnknownProp(ix) {
       if (knownNames.has(propUsage.prop)) continue;
       findings.push(
         makeFinding({
-          ruleId: RULE_ID4,
-          ruleVersion: RULE_VERSION4,
+          ruleId: RULE_ID5,
+          ruleVersion: RULE_VERSION5,
           severity: policy.severity,
           message: `Unknown prop "${propUsage.prop}" on <${node.element}>. Allowed props: ${formatPropList(knownNames)}.`,
           location: node.location,
@@ -5788,7 +6002,7 @@ function formatPropList(names) {
 // src/rules/composition-pattern.ts
 var CARDINALITY_RULE_ID = "composition/cardinality";
 var CO_OCCURRENCE_RULE_ID = "composition/co-occurrence";
-var RULE_VERSION5 = "1";
+var RULE_VERSION6 = "1";
 function ruleCompositionCardinality(ix) {
   return evaluate(ix, CARDINALITY_RULE_ID, "cardinality");
 }
@@ -5856,7 +6070,7 @@ function checkCardinality(ctx, region, pattern, constraint, selected) {
     const extras = selected.slice(constraint.max);
     return makeFinding({
       ruleId: ctx.ruleId,
-      ruleVersion: RULE_VERSION5,
+      ruleVersion: RULE_VERSION6,
       severity: ctx.severity,
       message: cardinalityMaxMessage(pattern, constraint.max, count),
       location: extras[0].location,
@@ -5867,7 +6081,7 @@ function checkCardinality(ctx, region, pattern, constraint, selected) {
   if (constraint.min !== void 0 && count < constraint.min) {
     return makeFinding({
       ruleId: ctx.ruleId,
-      ruleVersion: RULE_VERSION5,
+      ruleVersion: RULE_VERSION6,
       severity: ctx.severity,
       message: cardinalityMinMessage(pattern, constraint.min, count),
       location: region.container.location,
@@ -5888,7 +6102,7 @@ function checkCoOccurrence(ctx, region, pattern, constraint, selected) {
   if (satisfied) return null;
   return makeFinding({
     ruleId: ctx.ruleId,
-    ruleVersion: RULE_VERSION5,
+    ruleVersion: RULE_VERSION6,
     severity: ctx.severity,
     message: coOccurrenceMessage(pattern, constraint),
     location: region.container.location,
@@ -5940,8 +6154,8 @@ function coOccurrenceMessage(pattern, constraint) {
 }
 
 // src/rules/jsx-preferred-component.ts
-var RULE_ID5 = "components/preferred-component";
-var RULE_VERSION6 = "1";
+var RULE_ID6 = "components/preferred-component";
+var RULE_VERSION7 = "1";
 function ruleJsxPreferredComponent(ix) {
   const policies = ix.policy.jsxComponentPreferred();
   if (policies.length === 0) return [];
@@ -5957,8 +6171,8 @@ function ruleJsxPreferredComponent(ix) {
       if (!replacement) continue;
       findings.push(
         makeFinding({
-          ruleId: RULE_ID5,
-          ruleVersion: RULE_VERSION6,
+          ruleId: RULE_ID6,
+          ruleVersion: RULE_VERSION7,
           severity: policy.severity,
           message: `<${node.element}> should use <${replacement}>.`,
           location: node.location,
@@ -5995,8 +6209,8 @@ function componentNameFromId(componentId2) {
 }
 
 // src/rules/jsx-preferred-import-path.ts
-var RULE_ID6 = "imports/preferred-path";
-var RULE_VERSION7 = "1";
+var RULE_ID7 = "imports/preferred-path";
+var RULE_VERSION8 = "1";
 function ruleJsxPreferredImportPath(ix) {
   const policies = ix.policy.jsxImportPathPreferred();
   if (policies.length === 0) return [];
@@ -6004,6 +6218,18 @@ function ruleJsxPreferredImportPath(ix) {
   const seen = /* @__PURE__ */ new Set();
   for (const usage of ix.byKind("usage_import")) {
     const matches = policies.filter((policy) => {
+      if (policy.bridge) {
+        if (policy.bridge.implementationFiles.some((file) => sameRepoPath(file, usage.file))) {
+          return false;
+        }
+        if (!ownedImportMatchesRoot(usage.source, policy.from)) return false;
+        if (ownedImportsEqual(usage.source, policy.from)) {
+          return usage.imported === policy.bridge.underlyingExportName;
+        }
+        const subpath = usage.source.slice(policy.from.length + 1);
+        const leaf = subpath.split("/").at(-1);
+        return leaf === policy.bridge.underlyingExportName && (usage.imported === "default" || usage.imported === policy.bridge.underlyingExportName);
+      }
       if (!ownedImportsEqual(policy.from, usage.source)) return false;
       if (policy.imported !== void 0 && policy.imported !== usage.imported) return false;
       return true;
@@ -6016,10 +6242,10 @@ function ruleJsxPreferredImportPath(ix) {
       seen.add(key);
       findings.push(
         makeFinding({
-          ruleId: RULE_ID6,
-          ruleVersion: RULE_VERSION7,
+          ruleId: RULE_ID7,
+          ruleVersion: RULE_VERSION8,
           severity: policy.severity,
-          message: `Import from "${usage.source}" should use "${policy.to}".`,
+          message: policy.bridge ? `Import ${policy.bridge.underlyingExportName} through the confirmed local ${policy.bridge.localExportName} wrapper from "${policy.to}".` : `Import from "${usage.source}" should use "${policy.to}".`,
           location: usage.location,
           evidence: ix.evidence([usage.id, policy.id]),
           fingerprintIdentity: {
@@ -6030,7 +6256,7 @@ function ruleJsxPreferredImportPath(ix) {
             line: usage.location.line,
             column: usage.location.column
           },
-          fix: {
+          fix: policy.bridge ? void 0 : {
             kind: "replaceImport",
             title: policy.because ?? `Replace import path with "${policy.to}"`,
             from: usage.source,
@@ -6042,7 +6268,14 @@ function ruleJsxPreferredImportPath(ix) {
             suggestedImport: policy.to,
             imported: usage.imported,
             local: usage.local,
-            rawValue: usage.source
+            rawValue: usage.source,
+            ...policy.bridge ? {
+              canonicalBridge: true,
+              canonicalTarget: policy.bridge.componentKey,
+              suggestedComponent: policy.bridge.localExportName,
+              implementationFiles: policy.bridge.implementationFiles,
+              decisionSource: policy.bridge.decisionSource
+            } : {}
           }
         })
       );
@@ -6050,12 +6283,18 @@ function ruleJsxPreferredImportPath(ix) {
   }
   return findings;
 }
+function sameRepoPath(left, right) {
+  return normalizeRepoPath(left) === normalizeRepoPath(right);
+}
+function normalizeRepoPath(path) {
+  return path.replace(/\\/gu, "/").replace(/^\.\//u, "");
+}
 
 // src/rules/props-invalid-value.ts
-var RULE_ID7 = "props/invalid-value";
-var RULE_VERSION8 = "1";
+var RULE_ID8 = "props/invalid-value";
+var RULE_VERSION9 = "1";
 function rulePropsInvalidValue(ix) {
-  const policy = ix.policy.ruleConfig(RULE_ID7);
+  const policy = ix.policy.ruleConfig(RULE_ID8);
   if (!policy?.enabled) return [];
   const findings = [];
   const componentByNode = indexComponentByNodeId(ix);
@@ -6084,8 +6323,8 @@ function rulePropsInvalidValue(ix) {
       } : void 0;
       findings.push(
         makeFinding({
-          ruleId: RULE_ID7,
-          ruleVersion: RULE_VERSION8,
+          ruleId: RULE_ID8,
+          ruleVersion: RULE_VERSION9,
           severity: policy.severity ?? "warn",
           message: buildMessage2(node.element, propUsage.prop, propUsage.value, allowedValues),
           location: propUsage.location ?? node.location,
@@ -6260,13 +6499,36 @@ function srgbGamma(linear) {
   return clamped <= 31308e-7 ? 12.92 * clamped : 1.055 * Math.pow(clamped, 1 / 2.4) - 0.055;
 }
 
+// src/rules/token-candidates.ts
+function normalizedTokenValue(token) {
+  const value = token.value.trim();
+  return token.category === "color" ? normalizeColor(value) : value.replace(/\s+/g, " ");
+}
+function localTokenCandidates(ix, category) {
+  const all = ix.tokens.list();
+  const upstreamByName = /* @__PURE__ */ new Map();
+  for (const token of all) {
+    if (token.role !== "upstream") continue;
+    const matches = upstreamByName.get(token.name) ?? [];
+    matches.push(token);
+    upstreamByName.set(token.name, matches);
+  }
+  return all.filter((token) => {
+    if (token.role === "upstream" || category !== void 0 && token.category !== category) {
+      return false;
+    }
+    const matches = upstreamByName.get(token.upstreamName ?? token.name) ?? [];
+    return matches.length !== 1 || normalizedTokenValue(token) === normalizedTokenValue(matches[0]);
+  });
+}
+
 // src/rules/styles-no-raw-color.ts
-var RULE_ID8 = "styles/no-raw-color";
-var RULE_VERSION9 = "1";
+var RULE_ID9 = "styles/no-raw-color";
+var RULE_VERSION10 = "1";
 function ruleStylesNoRawColor(ix) {
   const policy = ix.policy.rawColorPolicy();
   if (!policy) return [];
-  const colorTokens = ix.tokens.byCategory("color");
+  const colorTokens = localTokenCandidates(ix, "color");
   const preferLabel = policy.prefer === "token" ? "design token" : "CSS variable";
   const findings = [];
   const advisorySeverity = policy.severity === "error" ? "warn" : policy.severity;
@@ -6280,8 +6542,8 @@ function ruleStylesNoRawColor(ix) {
     const evidenceIds = resolution ? [decl.id, policy.id, resolution.token.id] : [decl.id, policy.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID8,
-        ruleVersion: RULE_VERSION9,
+        ruleId: RULE_ID9,
+        ruleVersion: RULE_VERSION10,
         severity: policy.severity,
         message: colorMessage(color, `\`${decl.property}\``, resolution, preferLabel),
         location: decl.location,
@@ -6316,8 +6578,8 @@ function ruleStylesNoRawColor(ix) {
       const evidenceIds2 = componentEvidenceId2 ? [node2.id, componentEvidenceId2, inline.id, policy.id] : [node2.id, inline.id, policy.id];
       findings.push(
         makeFinding({
-          ruleId: RULE_ID8,
-          ruleVersion: RULE_VERSION9,
+          ruleId: RULE_ID9,
+          ruleVersion: RULE_VERSION10,
           severity: advisorySeverity,
           message: `Runtime-constructed raw color \`${inline.value}\` on inline \`${inline.property}\`. Use a ${preferLabel} instead.`,
           location: node2.location,
@@ -6353,8 +6615,8 @@ function ruleStylesNoRawColor(ix) {
     const evidenceIds = resolution ? [...baseEvidence, resolution.token.id] : baseEvidence;
     findings.push(
       makeFinding({
-        ruleId: RULE_ID8,
-        ruleVersion: RULE_VERSION9,
+        ruleId: RULE_ID9,
+        ruleVersion: RULE_VERSION10,
         severity: policy.severity,
         message: colorMessage(color, `inline \`${inline.property}\``, resolution, preferLabel),
         location: node.location,
@@ -6397,8 +6659,8 @@ function ruleStylesNoRawColor(ix) {
     const evidenceIds = resolution ? [...baseEvidence, resolution.token.id] : baseEvidence;
     findings.push(
       makeFinding({
-        ruleId: RULE_ID8,
-        ruleVersion: RULE_VERSION9,
+        ruleId: RULE_ID9,
+        ruleVersion: RULE_VERSION10,
         severity: advisorySeverity,
         message: colorMessage(color, `\`${prop.prop}\``, resolution, preferLabel),
         location: prop.location ?? node.location,
@@ -6520,7 +6782,7 @@ function normalizeColor2(value) {
   return lower;
 }
 function buildTokenFix(property, rawValue, rawColor, match, ix) {
-  const reference = tokenReference(match.token.name);
+  const reference = tokenReference(match.token);
   const value = replaceRawColor(rawValue, rawColor, reference);
   return emitFix(
     {
@@ -6549,14 +6811,14 @@ function escapeRegExp(value) {
 }
 
 // src/rules/styles-no-raw-dimensions.ts
-var RULE_ID9 = "styles/no-raw-dimensions";
-var RULE_VERSION10 = "1";
+var RULE_ID10 = "styles/no-raw-dimensions";
+var RULE_VERSION11 = "1";
 function ruleStylesNoRawDimensions(ix) {
   const policy = ix.policy.rawDimensionPolicy();
   if (!policy) return [];
   const appliesTo = new Set(policy.appliesTo);
-  const spacingTokens = ix.tokens.byCategory("spacing");
-  const radiusTokens = ix.tokens.byCategory("radius");
+  const spacingTokens = localTokenCandidates(ix, "spacing");
+  const radiusTokens = localTokenCandidates(ix, "radius");
   const preferLabel = policy.prefer === "token" ? "design token" : "CSS variable";
   const findings = [];
   for (const decl of ix.byKind("style_declaration")) {
@@ -6570,8 +6832,8 @@ function ruleStylesNoRawDimensions(ix) {
     const fixEmission = dimensionFix(decl.property, resolution, ix);
     findings.push(
       makeFinding({
-        ruleId: RULE_ID9,
-        ruleVersion: RULE_VERSION10,
+        ruleId: RULE_ID10,
+        ruleVersion: RULE_VERSION11,
         severity: policy.severity,
         message: dimensionMessage(decl.value, decl.property, preferLabel, resolution, false),
         location: decl.location,
@@ -6612,8 +6874,8 @@ function ruleStylesNoRawDimensions(ix) {
     const fixEmission = dimensionFix(inline.property, resolution, ix);
     findings.push(
       makeFinding({
-        ruleId: RULE_ID9,
-        ruleVersion: RULE_VERSION10,
+        ruleId: RULE_ID10,
+        ruleVersion: RULE_VERSION11,
         severity: policy.severity,
         message: dimensionMessage(inline.value, inline.property, preferLabel, resolution, true),
         location: node.location,
@@ -6767,9 +7029,7 @@ function normalizeDimension(value) {
   return `${parsed.value}${parsed.unit ?? "px"}`;
 }
 function tokenVar(token) {
-  if (token.name.startsWith("$")) return token.name;
-  const cssVarName = token.name.startsWith("--") ? token.name : `--${token.name.replace(/\./g, "-")}`;
-  return `var(${cssVarName})`;
+  return tokenReference(token);
 }
 
 // src/rules/spacing-resolution.ts
@@ -6807,7 +7067,7 @@ function resolveSpacingValue(input) {
         continue;
       }
       anyViolation = true;
-      const reference = tokenReference(exactToken.name);
+      const reference = tokenReference(exactToken);
       if (!normalized.deterministicFix) allValuePreserving = false;
       suggestedParts.push(reference);
       if (!firstViolation) {
@@ -6839,7 +7099,7 @@ function resolveSpacingValue(input) {
     } else {
       const nearestToken = input.tokens.get(Math.abs(nearest));
       suggestedToken = nearestToken?.name;
-      suggestedPart = nearestToken ? tokenReference(nearestToken.name) : input.bareNumberFix ? `${nearest}` : `${nearest}${input.scale.unit}`;
+      suggestedPart = nearestToken ? tokenReference(nearestToken) : input.bareNumberFix ? `${nearest}` : `${nearest}${input.scale.unit}`;
       suggestedParts.push(suggestedPart);
       if (!normalized.deterministicFix) reliableSuggestion = false;
     }
@@ -6883,15 +7143,15 @@ function parseLengthParts(raw) {
 }
 
 // src/rules/styles-no-raw-spacing.ts
-var RULE_ID10 = "styles/no-raw-spacing";
-var RULE_VERSION11 = "1";
+var RULE_ID11 = "styles/no-raw-spacing";
+var RULE_VERSION12 = "1";
 function ruleStylesNoRawSpacing(ix) {
   const findings = [];
   const lookupCache = /* @__PURE__ */ new Map();
   const lookupFor = (scale) => {
     let lookup = lookupCache.get(scale.name);
     if (!lookup) {
-      lookup = buildSpacingTokenLookup(ix.tokens.byCategory("spacing"), scale);
+      lookup = buildSpacingTokenLookup(localTokenCandidates(ix, "spacing"), scale);
       lookupCache.set(scale.name, lookup);
     }
     return lookup;
@@ -6926,8 +7186,8 @@ function checkDeclaration(ix, decl, lookupFor) {
   if (!checked) return null;
   const fixEmission = buildSpacingFix(decl.property, checked, ix);
   return makeFinding({
-    ruleId: RULE_ID10,
-    ruleVersion: RULE_VERSION11,
+    ruleId: RULE_ID11,
+    ruleVersion: RULE_VERSION12,
     severity: policy.severity,
     message: spacingMessage(decl.property, decl.value, allowed, scale.unit, checked),
     location: decl.location,
@@ -6981,8 +7241,8 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
   const componentEvidenceId = componentByNode.get(node.id)?.id;
   const evidenceIds = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id, scale.id] : [node.id, inline.id, policy.id, scale.id];
   return makeFinding({
-    ruleId: RULE_ID10,
-    ruleVersion: RULE_VERSION11,
+    ruleId: RULE_ID11,
+    ruleVersion: RULE_VERSION12,
     severity: policy.severity,
     message: spacingMessage(inline.property, inline.value, allowed, scale.unit, checked),
     location: node.location,
@@ -7025,7 +7285,7 @@ function buildSpacingFix(property, checked, ix) {
       deterministic: true
     },
     {
-      symbols: tokenSymbolsInText(checked.suggestedValue),
+      symbols: checked.matchedToken ? [checked.matchedToken] : tokenSymbolsInText(checked.suggestedValue),
       editKind: "replaceStyleValue",
       valuePreserving: checked.deterministicFix
     },
@@ -7043,8 +7303,8 @@ function spacingMessage(property, value, allowed, unit, checked) {
 }
 
 // src/rules/styles-no-raw-typography.ts
-var RULE_ID11 = "styles/no-raw-typography";
-var RULE_VERSION12 = "1";
+var RULE_ID12 = "styles/no-raw-typography";
+var RULE_VERSION13 = "1";
 var FONT_SIZE_PROPERTIES = /* @__PURE__ */ new Set(["font-size", "fontsize"]);
 function ruleStylesNoRawTypography(ix) {
   const policy = ix.policy.fontSizeScale();
@@ -7062,8 +7322,8 @@ function ruleStylesNoRawTypography(ix) {
     const fixEmission = buildFix(decl.property, checked, ix);
     findings.push(
       makeFinding({
-        ruleId: RULE_ID11,
-        ruleVersion: RULE_VERSION12,
+        ruleId: RULE_ID12,
+        ruleVersion: RULE_VERSION13,
         severity: policy.severity,
         message: typographyMessage(decl.property, decl.value, allowed, scale.unit, checked),
         location: decl.location,
@@ -7109,8 +7369,8 @@ function ruleStylesNoRawTypography(ix) {
     const evidenceIds = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id, scale.id] : [node.id, inline.id, policy.id, scale.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID11,
-        ruleVersion: RULE_VERSION12,
+        ruleId: RULE_ID12,
+        ruleVersion: RULE_VERSION13,
         severity: policy.severity,
         message: typographyMessage(inline.property, inline.value, allowed, scale.unit, checked),
         location: node.location,
@@ -7141,7 +7401,7 @@ function ruleStylesNoRawTypography(ix) {
 }
 function buildTypographyTokenLookup(ix, scale) {
   const out = /* @__PURE__ */ new Map();
-  for (const token of ix.tokens.byCategory("typography")) {
+  for (const token of localTokenCandidates(ix, "typography")) {
     const parsed = parseLengthValue(token.value);
     if (!parsed || parsed.unit === null) continue;
     const normalized = normalizeLengthForScale(parsed, scale);
@@ -7163,7 +7423,7 @@ function checkFontSize(raw, allowed, scale, tokens, bareNumberFix = false) {
   if (matchesScale(normalized.value, allowed)) {
     if (!exactToken) return null;
     return {
-      suggestedValue: tokenReference(exactToken.name),
+      suggestedValue: tokenReference(exactToken),
       fixEmittable: true,
       deterministicFix: normalized.deterministicFix,
       reason: "token-equivalent",
@@ -7175,7 +7435,7 @@ function checkFontSize(raw, allowed, scale, tokens, bareNumberFix = false) {
     return { fixEmittable: false, deterministicFix: false, reason: "off-scale" };
   }
   const nearestToken = tokens.get(Math.abs(nearest));
-  const suggestedValue = nearestToken ? tokenReference(nearestToken.name) : bareNumberFix ? `${nearest}` : `${nearest}${scale.unit}`;
+  const suggestedValue = nearestToken ? tokenReference(nearestToken) : bareNumberFix ? `${nearest}` : `${nearest}${scale.unit}`;
   return {
     suggestedValue,
     fixEmittable: normalized.deterministicFix,
@@ -7194,7 +7454,7 @@ function buildFix(property, checked, ix) {
       deterministic: true
     },
     {
-      symbols: tokenSymbolsInText(checked.suggestedValue),
+      symbols: checked.matchedToken ? [checked.matchedToken] : tokenSymbolsInText(checked.suggestedValue),
       editKind: "replaceStyleValue",
       valuePreserving: checked.deterministicFix
     },
@@ -7212,15 +7472,15 @@ function typographyMessage(property, value, allowed, unit, checked) {
 }
 
 // src/rules/theme-no-theme-coupled-literal.ts
-var RULE_ID12 = "theme/no-theme-coupled-literal";
-var RULE_VERSION13 = "1";
+var RULE_ID13 = "theme/no-theme-coupled-literal";
+var RULE_VERSION14 = "1";
 var COLOR_LITERAL_GLOBAL = /#[0-9a-fA-F]{3,8}\b|\b(?:rgba?|hsla?|oklab|oklch|lab|lch)\(\s*[\d.%\s,\/]+\s*\)/g;
 var WHITE_RGBA = /^rgba?\(\s*255\s*,\s*255\s*,\s*255/i;
 var BLACK_RGBA = /^rgba?\(\s*0\s*,\s*0\s*,\s*0/i;
 var BOX_SHADOW_PROP = /^(?:-webkit-|-moz-)?box-shadow$/i;
 var NEUTRAL_SHADOW = /^(?:none|inherit|initial|unset|revert|revert-layer)\s*$/i;
 function ruleThemeNoThemeCoupledLiteral(ix) {
-  const policy = ix.policy.ruleConfig(RULE_ID12);
+  const policy = ix.policy.ruleConfig(RULE_ID13);
   if (!policy?.enabled) return [];
   const findings = [];
   for (const decl of ix.byKind("style_declaration")) {
@@ -7229,8 +7489,8 @@ function ruleThemeNoThemeCoupledLiteral(ix) {
     if (!hit) continue;
     findings.push(
       makeFinding({
-        ruleId: RULE_ID12,
-        ruleVersion: RULE_VERSION13,
+        ruleId: RULE_ID13,
+        ruleVersion: RULE_VERSION14,
         severity: policy.severity ?? "warn",
         message: hit.message,
         location: decl.location,
@@ -7320,8 +7580,8 @@ function isTokenFile(filePath) {
 }
 
 // src/rules/tailwind-arbitrary-color.ts
-var RULE_ID13 = "tailwind/arbitrary-color";
-var RULE_VERSION14 = "1";
+var RULE_ID14 = "tailwind/arbitrary-color";
+var RULE_VERSION15 = "1";
 var COLOR_UTILITIES = /* @__PURE__ */ new Set([
   "accent",
   "bg",
@@ -7363,8 +7623,8 @@ function ruleTailwindArbitraryColor(ix) {
     const evidenceIds = node ? [node.id, klass.id, policy.id] : [klass.id, policy.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID13,
-        ruleVersion: RULE_VERSION14,
+        ruleId: RULE_ID14,
+        ruleVersion: RULE_VERSION15,
         severity: policy.severity,
         message: `\`${klass.raw}\` uses arbitrary raw color ${color}. Use a ${policy.prefer === "token" ? "design token" : "CSS variable"} instead.`,
         location: klass.location,
@@ -7395,8 +7655,8 @@ function fingerprintIdentity(klass, color) {
 }
 
 // src/rules/tailwind-arbitrary-spacing.ts
-var RULE_ID14 = "tailwind/arbitrary-spacing";
-var RULE_VERSION15 = "1";
+var RULE_ID15 = "tailwind/arbitrary-spacing";
+var RULE_VERSION16 = "1";
 var SPACING_UTILITY_TO_PROPERTY = /* @__PURE__ */ new Map([
   ["m", "margin"],
   ["mt", "margin"],
@@ -7442,8 +7702,8 @@ function ruleTailwindArbitrarySpacing(ix) {
     const fix = buildFix2(klass);
     findings.push(
       makeFinding({
-        ruleId: RULE_ID14,
-        ruleVersion: RULE_VERSION15,
+        ruleId: RULE_ID15,
+        ruleVersion: RULE_VERSION16,
         severity: policy.severity,
         message: `\`${klass.raw}\` is an arbitrary spacing value not on the project's spacing scale.`,
         location: klass.location,
@@ -7574,8 +7834,8 @@ function matchesTokenGlob(value, pattern) {
 }
 
 // src/rules/tailwind-forbidden-palette.ts
-var RULE_ID15 = "tailwind/forbidden-palette";
-var RULE_VERSION16 = "1";
+var RULE_ID16 = "tailwind/forbidden-palette";
+var RULE_VERSION17 = "1";
 function ruleTailwindForbiddenPalette(ix) {
   const deny = ix.policy.tailwindPaletteDeny();
   const allow = ix.policy.tailwindPaletteAllow();
@@ -7600,8 +7860,8 @@ function ruleTailwindForbiddenPalette(ix) {
     const evidenceIds = node ? [node.id, klass.id, resolved.id, policy.id] : [klass.id, resolved.id, policy.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID15,
-        ruleVersion: RULE_VERSION16,
+        ruleId: RULE_ID16,
+        ruleVersion: RULE_VERSION17,
         severity: policy.severity,
         message: messageFor(klass, token, deniedPattern, allow?.patterns ?? []),
         location: klass.location,
@@ -7648,8 +7908,8 @@ function buildFix3(klass) {
 }
 
 // src/rules/tailwind-off-scale-spacing-token.ts
-var RULE_ID16 = "tailwind/off-scale-spacing-token";
-var RULE_VERSION17 = "1";
+var RULE_ID17 = "tailwind/off-scale-spacing-token";
+var RULE_VERSION18 = "1";
 function ruleTailwindOffScaleSpacingToken(ix) {
   const resolvedByKey = indexResolvedTailwindTokens(ix);
   const findings = [];
@@ -7675,8 +7935,8 @@ function ruleTailwindOffScaleSpacingToken(ix) {
     const evidenceIds = node ? [node.id, klass.id, resolved.id, policy.id, scale.id] : [klass.id, resolved.id, policy.id, scale.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID16,
-        ruleVersion: RULE_VERSION17,
+        ruleId: RULE_ID17,
+        ruleVersion: RULE_VERSION18,
         severity: policy.severity,
         message: `\`${klass.raw}\` resolves to ${formatResolvedValue(signedValue, scale.unit)}, which is not on the project's spacing scale [${allowed.join(", ")}].`,
         location: klass.location,
@@ -7725,8 +7985,8 @@ function buildFix4(raw, utility) {
 }
 
 // src/rules/tailwind-raw-color-via-token.ts
-var RULE_ID17 = "tailwind/raw-color-via-token";
-var RULE_VERSION18 = "1";
+var RULE_ID18 = "tailwind/raw-color-via-token";
+var RULE_VERSION19 = "1";
 function ruleTailwindRawColorViaToken(ix) {
   const allow = ix.policy.tailwindPaletteAllow();
   if (!allow || allow.patterns.length === 0) return [];
@@ -7746,8 +8006,8 @@ function ruleTailwindRawColorViaToken(ix) {
     const evidenceIds = node ? [node.id, klass.id, resolved.id, allow.id] : [klass.id, resolved.id, allow.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID17,
-        ruleVersion: RULE_VERSION18,
+        ruleId: RULE_ID18,
+        ruleVersion: RULE_VERSION19,
         severity: allow.severity,
         message: `\`${klass.raw}\` resolves to raw color \`${color}\` (${sourceLabel2(resolved.resolved.source)}). Project policy requires \`${allow.patterns.join("`, `")}\` palette tokens.`,
         location: klass.location,
@@ -7780,8 +8040,8 @@ function sourceLabel2(source) {
 }
 
 // src/rules/tailwind-unknown-class.ts
-var RULE_ID18 = "tailwind/unknown-class";
-var RULE_VERSION19 = "1";
+var RULE_ID19 = "tailwind/unknown-class";
+var RULE_VERSION20 = "1";
 var UNIVERSAL_COLOR_KEYWORDS = /* @__PURE__ */ new Set([
   "white",
   "black",
@@ -7802,8 +8062,8 @@ function ruleTailwindUnknownClass(ix) {
       const evidenceIds2 = node2 ? [node2.id, klass.id, policy.id] : [klass.id, policy.id];
       findings.push(
         makeFinding({
-          ruleId: RULE_ID18,
-          ruleVersion: RULE_VERSION19,
+          ruleId: RULE_ID19,
+          ruleVersion: RULE_VERSION20,
           severity: policy.severity,
           message: `\`${klass.raw}\` could not be parsed as a known Tailwind utility.`,
           location: klass.location,
@@ -7837,8 +8097,8 @@ function ruleTailwindUnknownClass(ix) {
     const evidenceIds = node ? [node.id, klass.id, resolved.id, policy.id] : [klass.id, resolved.id, policy.id];
     findings.push(
       makeFinding({
-        ruleId: RULE_ID18,
-        ruleVersion: RULE_VERSION19,
+        ruleId: RULE_ID19,
+        ruleVersion: RULE_VERSION20,
         severity: policy.severity,
         message: `\`${klass.raw}\` did not resolve to any known palette token.`,
         location: klass.location,
@@ -7866,14 +8126,14 @@ function ruleTailwindUnknownClass(ix) {
 }
 
 // src/rules/tokens-require-dual-fallback.ts
-var RULE_ID19 = "tokens/require-dual-fallback";
-var RULE_VERSION20 = "1";
+var RULE_ID20 = "tokens/require-dual-fallback";
+var RULE_VERSION21 = "1";
 var CSS_VAR_WITH_OPTIONAL_FALLBACK = /var\(\s*(--[A-Za-z0-9_-]+)(\s*,\s*[^)]*)?\)/g;
 var SASS_FILE = /\.(scss|sass)$/i;
 function ruleTokensRequireDualFallback(ix) {
-  const policy = ix.policy.ruleConfig(RULE_ID19);
+  const policy = ix.policy.ruleConfig(RULE_ID20);
   if (!policy?.enabled) return [];
-  const tokensByCssVariable = indexTokensByCssVariable(ix.tokens.list());
+  const tokensByCssVariable = indexTokensByCssVariable(localTokenCandidates(ix));
   const findings = [];
   for (const decl of ix.byKind("style_declaration")) {
     if (!SASS_FILE.test(decl.file)) continue;
@@ -7906,8 +8166,8 @@ function ruleTokensRequireDualFallback(ix) {
       ) : void 0;
       findings.push(
         makeFinding({
-          ruleId: RULE_ID19,
-          ruleVersion: RULE_VERSION20,
+          ruleId: RULE_ID20,
+          ruleVersion: RULE_VERSION21,
           severity: policy.severity ?? "warn",
           message: hasScssVariable ? `var(${tokenName}) is missing an SCSS fallback. Use var(${tokenName}, ${scssVar}).` : `var(${tokenName}) is missing a fallback. No matching SCSS variable was found in the token source; add a fallback manually or define ${scssVar}.`,
           location: decl.location,
@@ -7947,8 +8207,8 @@ function indexTokensByCssVariable(tokens) {
 }
 
 // src/rules/tokens-css-vars-must-be-defined.ts
-var RULE_ID20 = "tokens/css-vars-must-be-defined";
-var RULE_VERSION21 = "1";
+var RULE_ID21 = "tokens/css-vars-must-be-defined";
+var RULE_VERSION22 = "1";
 var CSS_VAR_REFERENCE = /var\(\s*(--[A-Za-z0-9_-]+)/gi;
 function ruleTokensCssVarsMustBeDefined(ix) {
   const policy = ix.policy.cssVarsMustBeDefined();
@@ -7975,8 +8235,8 @@ function ruleTokensCssVarsMustBeDefined(ix) {
       seen.add(tokenName);
       findings.push(
         makeFinding({
-          ruleId: RULE_ID20,
-          ruleVersion: RULE_VERSION21,
+          ruleId: RULE_ID21,
+          ruleVersion: RULE_VERSION22,
           severity: policy.severity,
           message: `var(${tokenName}) is not in the contract token vocabulary. Use a token defined in your contract's token source files.`,
           location: decl.location,
@@ -8022,6 +8282,57 @@ function skipToCloseParen(value, openParenIndex) {
   return value.length;
 }
 
+// src/rules/tokens-upstream-drift.ts
+var RULE_ID22 = "tokens/upstream-drift";
+var RULE_VERSION23 = "1";
+function ruleTokensUpstreamDrift(ix) {
+  const local = ix.tokens.list().filter((token) => token.role !== "upstream");
+  const upstream = ix.tokens.list().filter((token) => token.role === "upstream");
+  const upstreamByName = /* @__PURE__ */ new Map();
+  for (const token of upstream) {
+    const matches = upstreamByName.get(token.name) ?? [];
+    matches.push(token);
+    upstreamByName.set(token.name, matches);
+  }
+  const findings = [];
+  for (const token of local) {
+    const upstreamName = token.upstreamName ?? token.name;
+    const matches = (upstreamByName.get(upstreamName) ?? []).sort(
+      (a, b) => (a.sourceIdentity ?? "").localeCompare(b.sourceIdentity ?? "")
+    );
+    if (matches.length !== 1) continue;
+    const expected = matches[0];
+    if (normalizedTokenValue(token) === normalizedTokenValue(expected)) continue;
+    const location = token.location ?? {
+      file: token.sourceIdentity ?? "tokens",
+      line: 1,
+      column: 1
+    };
+    findings.push(
+      makeFinding({
+        ruleId: RULE_ID22,
+        ruleVersion: RULE_VERSION23,
+        severity: "warn",
+        message: `Local token ${token.name} is ${token.value}, but upstream ${upstreamName} is ${expected.value}.`,
+        location,
+        evidence: ix.evidence([token.id, expected.id]),
+        fingerprintIdentity: {
+          local: token.name,
+          upstream: upstreamName,
+          localSource: token.sourceIdentity,
+          upstreamSource: expected.sourceIdentity
+        },
+        attributes: {
+          local: { name: token.name, value: token.value, location: token.location },
+          upstream: { name: expected.name, value: expected.value, location: expected.location },
+          autoFix: false
+        }
+      })
+    );
+  }
+  return findings;
+}
+
 // src/rules/emit-gate.ts
 var BLOCKING_RULE_ALLOWLIST = /* @__PURE__ */ new Set([
   "styles/no-raw-color",
@@ -8056,10 +8367,14 @@ function isDenyEligible(finding, failOnWarnings) {
 // src/rules/tiers.ts
 var RULE_TIER = {
   // ---- Tier A — contract vocabulary -------------------------------------
+  "components/shadow-component": "contract",
+  // canonical-component identity drift
   "components/prefer-library": "contract",
   // canonical-component bypass (FUI1004)
   "tokens/css-vars-must-be-defined": "contract",
   // token drift (FUI2015)
+  "tokens/upstream-drift": "contract",
+  // authored local/upstream value drift (FUI2017)
   // ---- Tier B — generic hygiene -----------------------------------------
   "components/unknown-prop": "hygiene",
   "components/forbidden-prop-value": "hygiene",
@@ -8101,8 +8416,10 @@ function hygieneTierRuleIds() {
   return Object.keys(RULE_TIER).filter((id) => !isContractTierRule(id));
 }
 var VOCABULARY_ORDER = [
+  "components/shadow-component",
   "components/prefer-library",
-  "tokens/css-vars-must-be-defined"
+  "tokens/css-vars-must-be-defined",
+  "tokens/upstream-drift"
 ];
 function vocabularyRank(ruleId) {
   const index = VOCABULARY_ORDER.indexOf(ruleId);
@@ -8161,6 +8478,11 @@ var RULES = [
     version: "1",
     run: ruleComponentsPreferLibrary
   },
+  {
+    id: "components/shadow-component",
+    version: "1",
+    run: ruleComponentsShadowComponent
+  },
   {
     id: "styles/no-raw-color",
     version: "1",
@@ -8221,6 +8543,11 @@ var RULES = [
     version: "1",
     run: ruleTokensCssVarsMustBeDefined
   },
+  {
+    id: "tokens/upstream-drift",
+    version: "1",
+    run: ruleTokensUpstreamDrift
+  },
   {
     id: "theme/no-theme-coupled-literal",
     version: "1",
@@ -8310,19 +8637,23 @@ function evaluateGovernanceIntegrity(input) {
     policyFamily.reason = "no governance policy resolved";
   }
   const componentsConfig = configs.get("components/prefer-library");
-  const componentsArmed = componentsConfig?.enabled === true && hasEffectiveComponentVocabulary(componentsConfig.options);
+  const confirmedBridges = input.policy?.canonicalBridges ?? [];
+  const componentsArmed = confirmedBridges.length > 0 || componentsConfig?.enabled === true && hasEffectiveComponentVocabulary(componentsConfig.options);
   const componentsFamily = {
     id: "components",
     armed: componentsArmed,
-    rules: ["components/prefer-library"]
+    rules: [
+      ...confirmedBridges.length > 0 ? ["imports/preferred-path"] : [],
+      ...componentsConfig?.enabled === true ? ["components/prefer-library"] : []
+    ]
   };
   if (!componentsArmed) {
     if (componentsConfig?.enabled === true) {
       componentsFamily.reason = "components/prefer-library enabled but no effective canonical source";
-      componentsFamily.remediation = "add govern.canonicalSources (a directory source, or npm/registry with a non-empty include) or designSystem.path/packageName";
+      componentsFamily.remediation = "add govern.canonicalBridges for local wrappers, govern.canonicalSources, or designSystem.path/packageName";
     } else {
       componentsFamily.reason = "components/prefer-library not enabled";
-      componentsFamily.remediation = "add govern.canonicalSources (a directory source, or npm/registry with a non-empty include) or designSystem.path/packageName";
+      componentsFamily.remediation = "add govern.canonicalBridges for local wrappers, govern.canonicalSources, or designSystem.path/packageName";
     }
   }
   const cssVarsActive = input.cssVarsActive ?? policyDeclaresCssVars(input.policy);
@@ -8408,6 +8739,74 @@ function evaluateGovernanceIntegrity(input) {
   };
 }
 
+// src/canonical-bridge.ts
+function canonicalBridgeContractMappings(bridges) {
+  return (bridges ?? []).map((bridge) => ({
+    component: `${bridge.underlying.packageName}#${bridge.underlying.exportName}`,
+    canonical: bridge.local.componentKey,
+    status: "confirmed",
+    importPath: bridge.local.moduleSpecifier,
+    bridge: {
+      underlyingPackageName: bridge.underlying.packageName,
+      underlyingExportName: bridge.underlying.exportName,
+      localComponentKey: bridge.local.componentKey,
+      localExportName: bridge.local.exportName,
+      implementationFiles: [...bridge.local.implementationFiles],
+      decisionSource: bridge.decision.source
+    }
+  }));
+}
+
+// src/effective-governance-inputs.ts
+var EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA = "effective-governance-inputs:v1";
+function compileEffectiveGovernanceInputs(options) {
+  const projection = {
+    schema: EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA,
+    policySource: options.policySource,
+    config: {
+      path: options.configPath ? normalizePath2(options.configPath) : null,
+      digest: options.configDigest
+    },
+    components: {
+      canonicalSources: sortRecords(options.policy?.canonicalSources ?? []),
+      canonicalBridges: sortRecords(options.policy?.canonicalBridges ?? []),
+      definitionFiles: normalizePaths(options.componentDefinitionFiles)
+    },
+    tokens: {
+      declared: normalizePaths(options.tokens.declared),
+      loadedDefinitions: options.tokens.loadedDefinitions,
+      diagnostics: [...options.tokens.diagnostics].sort(),
+      ...options.tokens.catalog ? {
+        catalog: {
+          ...options.tokens.catalog,
+          configuredSources: normalizePaths(options.tokens.catalog.configuredSources),
+          parsedSources: normalizePaths(options.tokens.catalog.parsedSources),
+          definitions: sortRecords(options.tokens.catalog.definitions),
+          diagnostics: sortRecords(options.tokens.catalog.diagnostics),
+          references: sortRecords(options.tokens.catalog.references),
+          ...options.tokens.catalog.sourceStates ? { sourceStates: sortRecords(options.tokens.catalog.sourceStates) } : {}
+        }
+      } : {}
+    },
+    eligibility: {
+      include: normalizePaths(options.eligibility.include),
+      exclude: normalizePaths(options.eligibility.exclude)
+    }
+  };
+  return { ...projection, inputsHash: contractHash(projection) };
+}
+function normalizePaths(values) {
+  return [...new Set(values.map(normalizePath2))].sort();
+}
+function normalizePath2(value) {
+  return value.replace(/\\/gu, "/").replace(/^\.\//u, "");
+}
+function sortRecords(values) {
+  return [...values].sort(
+    (left, right) => canonicalPreimage(left).localeCompare(canonicalPreimage(right))
+  );
+}
+
 // src/contract/preimage.ts
 var CONTRACT_DOMAINS = ["components", "tokens", "canonicalMap", "policy"];
 var CONTRACT_PREIMAGE_SCHEMA = "fcid-preimage:v1";
@@ -8463,6 +8862,15 @@ function projectCanonicalMap(mappings) {
       component: mapping.component,
       canonical: mapping.canonical,
       importPath: mapping.importPath ? projectV1OwnedImportIdentity(mapping.importPath) : void 0,
+      bridge: mapping.bridge ? {
+        underlyingPackageName: projectV1OwnedImportIdentity(
+          mapping.bridge.underlyingPackageName
+        ),
+        underlyingExportName: mapping.bridge.underlyingExportName,
+        localComponentKey: projectV1OwnedComponentId(mapping.bridge.localComponentKey),
+        localExportName: mapping.bridge.localExportName,
+        implementationFiles: [...mapping.bridge.implementationFiles].sort()
+      } : void 0,
       resolves: mapping.resolves ? sortCanonical(mapping.resolves) : void 0,
       propMapping: mapping.propMapping ? sortCanonical(
         mapping.propMapping.map((entry) => ({
@@ -8755,6 +9163,133 @@ function readPreferLibraryRule(config) {
   const raw = config?.rules?.["components/prefer-library"];
   return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
 }
+
+// src/identity/component-key.ts
+function buildComponentKey({ repoRelativeFile, exportName }) {
+  const file = normalizeRepoRelativeFile(repoRelativeFile);
+  const name = exportName.trim();
+  if (!file) throw new Error("repoRelativeFile must not be empty");
+  if (!name) throw new Error("exportName must not be empty");
+  return `${file}#${name}`;
+}
+function normalizeRepoRelativeFile(file) {
+  const slashNormalized = file.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+  const absolute = slashNormalized.startsWith("/");
+  const parts = [];
+  for (const part of slashNormalized.split("/")) {
+    if (!part || part === ".") continue;
+    if (part === ".." && parts.length > 0 && parts.at(-1) !== "..") {
+      parts.pop();
+      continue;
+    }
+    parts.push(part);
+  }
+  return `${absolute ? "/" : ""}${parts.join("/")}`;
+}
+
+// src/identity/classify.ts
+function classifyIdentity(input) {
+  const { definition, renderRoot } = input;
+  if (definition.canonical) return { state: "canonical", confidence: "confirmed" };
+  const decision = input.decisions?.find(
+    (candidate) => candidate.componentKey === definition.componentKey
+  );
+  if (decision?.decision === "sanctioned-wrapper") {
+    return withTarget("variant", "confirmed", decision.canonicalTarget ?? rootTarget(input));
+  }
+  if (decision?.decision === "rejected-wrapper") {
+    return withTarget("shadow", "confirmed", decision.canonicalTarget ?? shadowTarget(input));
+  }
+  if (renderRoot.kind === "canonical") {
+    if ((input.usageCounts?.nestedElements ?? 0) > 0 || (input.usageCounts?.staticTextChildren ?? 0) > 0) {
+      return withTarget("composite", "confirmed", renderRoot.target.componentKey);
+    }
+    const confidence = strongOverlap(input.propSurfaceOverlap) ? "likely" : "review";
+    return withTarget("variant", confidence, renderRoot.target.componentKey);
+  }
+  if (renderRoot.kind === "intrinsic") {
+    return classifyIntrinsic(input, renderRoot);
+  }
+  if (renderRoot.kind === "mixed") {
+    if (renderRoot.canonicalTargets.length > 0) {
+      const target = bestCanonicalReference(
+        definition.exportName,
+        renderRoot.canonicalTargets
+      )?.componentKey;
+      const fullyResolved = renderRoot.externalTargets.length === 0 && renderRoot.unresolvedNames.length === 0;
+      return withTarget("composite", fullyResolved ? "confirmed" : "likely", target);
+    }
+    if (renderRoot.externalTargets.length > 0 && renderRoot.localTargets.length === 0 && renderRoot.unresolvedNames.length === 0) {
+      return { state: "external", confidence: "likely" };
+    }
+    return withTarget("unresolved", "review", rootTarget(input));
+  }
+  if (renderRoot.kind === "external") {
+    return { state: "external", confidence: "confirmed" };
+  }
+  return withTarget("unresolved", "review", rootTarget(input));
+}
+function classifyIntrinsic(input, root) {
+  const target = bestCanonicalReference(input.definition.exportName, root.canonicalTargets);
+  if (!target || !root.interactive && !root.hasRole) {
+    return withTarget("unresolved", "review", rootTarget(input));
+  }
+  let confidence = root.precisionTier === "exact-html" || root.precisionTier === "role-reimpl" ? "confirmed" : "likely";
+  if (confidence === "likely" && input.stylingOwnership !== "layout-only" && (strongOverlap(input.propSurfaceOverlap) || input.stylingOwnership === "visual-role")) {
+    confidence = "confirmed";
+  }
+  return { state: "shadow", confidence, canonicalTarget: target.role };
+}
+function rootTarget(input) {
+  const { renderRoot } = input;
+  if (renderRoot.kind === "canonical") return renderRoot.target.componentKey;
+  if (renderRoot.kind === "intrinsic") {
+    return bestCanonicalReference(input.definition.exportName, renderRoot.canonicalTargets)?.role;
+  }
+  if (renderRoot.kind === "mixed") {
+    return bestCanonicalReference(input.definition.exportName, renderRoot.canonicalTargets)?.componentKey;
+  }
+  return bestMessageTarget(input.definition.exportName, input.nameSimilarityTargets ?? []);
+}
+function shadowTarget(input) {
+  const { renderRoot } = input;
+  if (renderRoot.kind === "canonical") return renderRoot.target.role;
+  if (renderRoot.kind === "intrinsic") {
+    return bestCanonicalReference(input.definition.exportName, renderRoot.canonicalTargets)?.role;
+  }
+  if (renderRoot.kind === "mixed") {
+    return bestCanonicalReference(input.definition.exportName, renderRoot.canonicalTargets)?.role;
+  }
+  return bestMessageTarget(input.definition.exportName, input.nameSimilarityTargets ?? []);
+}
+function bestCanonicalReference(definitionName, candidates) {
+  return [...candidates].sort(
+    (left, right) => nameSimilarityScore(definitionName, right.role) - nameSimilarityScore(definitionName, left.role) || left.componentKey.localeCompare(right.componentKey)
+  )[0];
+}
+function bestMessageTarget(definitionName, candidates) {
+  return [...candidates].sort(
+    (left, right) => nameSimilarityScore(definitionName, right) - nameSimilarityScore(definitionName, left) || left.localeCompare(right)
+  )[0];
+}
+function nameSimilarityScore(definitionName, target) {
+  const definition = normalizeName(definitionName);
+  const candidate = normalizeName(target);
+  if (!candidate) return 0;
+  if (definition === candidate) return 3;
+  if (definition.endsWith(candidate) || definition.startsWith(candidate)) return 2;
+  if (definition.includes(candidate) || candidate.includes(definition)) return 1;
+  return 0;
+}
+function normalizeName(value) {
+  return value.split(/[.#/]/).at(-1)?.replace(/[^a-z0-9]/gi, "").toLowerCase() ?? "";
+}
+function strongOverlap(overlap) {
+  return overlap !== void 0 && overlap >= 0.7;
+}
+function withTarget(state, confidence, canonicalTarget) {
+  return canonicalTarget ? { state, confidence, canonicalTarget } : { state, confidence };
+}
 export {
   AGENT_CONTEXT_RELATIVE_PATH,
   AGENT_FORMAT_SCHEMA_VERSION,
@@ -8768,6 +9303,7 @@ export {
   DEFAULTS,
   DEFAULT_ENHANCED_STYLE_PROPERTIES,
   DEFAULT_STYLE_PROPERTIES,
+  EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA,
   EVIDENCE_ORDER,
   EXPLAIN_URL_BASE,
   FRAGMENTS_INTERNAL_RULE_IDS,
@@ -8805,6 +9341,7 @@ export {
   bridgeSourceViolations,
   budgetBar,
   buildAgentFormat,
+  buildComponentKey,
   buildRegistryArtifact,
   buildRegistryFile,
   buildRegistryInstallPlan,
@@ -8821,6 +9358,9 @@ export {
   byRuleId,
   calculateDeltaE,
   canBlock,
+  canonicalBridgeContractMappings,
+  canonicalBridgeV1Schema,
+  canonicalDirectionConflictsTarget,
   canonicalJson,
   canonicalPreimage,
   canonicalizeOwnedComponentId,
@@ -8831,6 +9371,7 @@ export {
   checkStoryExclusion,
   clampMaxPasses,
   classifyComplexity,
+  classifyIdentity,
   collectRegistryInstallDependencies,
   colorSimilarity,
   compareByVocabularyRank,
@@ -8842,6 +9383,7 @@ export {
   compareStylesWithTokens,
   compileBlock,
   compileComponentFacts,
+  compileEffectiveGovernanceInputs,
   compileFragment,
   compileGlobalGovernanceFacts,
   compileRecipe,
@@ -8926,6 +9468,7 @@ export {
   hashRegistryFileContent,
   hexToRgb,
   hygieneTierRuleIds,
+  indexComponentIdentityUsage,
   inferTokenCategory,
   inferTokenGroup,
   isColorLike,
@@ -8952,6 +9495,8 @@ export {
   makeClassNameDynamicFact,
   makeClassNameLiteralFact,
   makeComponentCapabilityFact,
+  makeComponentDefinitionFact,
+  makeComponentIdentityFact,
   makeComponentMetadataFact,
   makeContractTokenFact,
   makeFinding,
@@ -9034,6 +9579,7 @@ export {
   parseTokenFile,
   parseTokens,
   portableRepoPathError,
+  projectCanonicalDirectionConflicts,
   projectContractPreimage,
   projectV1OwnedComponentId,
   projectV1OwnedImportIdentity,
@@ -9076,6 +9622,7 @@ export {
   ruleA11yRequiredAccessibleName,
   ruleComponentsForbiddenPropValue,
   ruleComponentsPreferLibrary,
+  ruleComponentsShadowComponent,
   ruleComponentsUnknownProp,
   ruleJsxPreferredComponent,
   ruleJsxPreferredImportPath,