@usefragments/core 1.5.1 → 1.6.0

package/dist/index.js

@@ -44,6 +44,8 @@ import {
   CODES,
   EXPLAIN_URL_BASE,
   FactIndex,
+  RULE_FAMILY_IDS,
+  RULE_FAMILY_MEMBERS,
   asComponentId,
   bridgeSourceViolation,
   bridgeSourceViolations,
@@ -56,6 +58,8 @@ import {
   componentGovernanceRecordSchema,
   componentGovernanceRecordsSchema,
   componentId,
+  describePolicyExclude,
+  excludeGlobToRegExp,
   explainUrlForCode,
   factId,
   g,
@@ -65,6 +69,8 @@ import {
   governanceConfigSchema,
   governanceSeveritySchema,
   hash64Hex,
+  isPresetSourcedRule,
+  isRuleFamilyId,
   makeA11yNameRequiredFact,
   makeCanonicalCandidateFact,
   makeCanonicalMappingFact,
@@ -105,14 +111,22 @@ import {
   makeUsageNodeFact,
   makeUsagePropResolvedFact,
   makeUsageTextChildFact,
+  markPresetSourcedRules,
+  matchPolicyExclude,
   matchesGlob,
+  normalizeExcludePath,
   normalizeGovernanceConfig,
+  normalizePolicyExcludes,
   ownedComponentIdsEqual,
   ownedImportMatchesRoot,
   ownedImportsEqual,
+  policyExcludeMatchesPath,
+  policyExcludeSchema,
+  projectSupersededImportPathPreferences,
   resolveComponentGovernance,
+  ruleFamilyMembers,
   scaleGovernanceRecordSchema
-} from "./chunk-AOG4FTV6.js";
+} from "./chunk-WVFNDPM4.js";
 import {
   AGENT_FORMAT_SCHEMA_VERSION,
   agentErrorEnvelopeSchema,
@@ -1841,9 +1855,14 @@ var governedFragmentDefinitionSchema = z4.object({
 var recipeDefinitionSchema = blockDefinitionSchema;
 
 // src/config.ts
+var RAW_CONFIG_DECLARATION = /* @__PURE__ */ Symbol.for("@usefragments/core/raw-config-declaration");
 function formatZodErrors(errors) {
   return errors.map((error) => `  - ${error.path.join(".")}: ${error.message}`).join("\n");
 }
+function configDeclarationForDiagnostics(config) {
+  if (!config || typeof config !== "object") return config;
+  return config[RAW_CONFIG_DECLARATION] ?? config;
+}
 function defineConfig(config) {
   const normalized = normalizeGovernanceConfig(config);
   const result = fragmentsConfigSchema.safeParse(normalized);
@@ -1851,6 +1870,12 @@ function defineConfig(config) {
     throw new Error(`Invalid fragments config:
 ${formatZodErrors(result.error.errors)}`);
   }
+  Object.defineProperty(result.data, RAW_CONFIG_DECLARATION, {
+    value: normalized,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
   return result.data;
 }
 
@@ -4485,6 +4510,19 @@ function readUsageNode(ix, id) {
   const fact = ix.get(id);
   return fact && fact.kind === "usage_node" ? fact : void 0;
 }
+function hoppedValue(fact) {
+  const from = fact.valueFrom;
+  if (!from) return void 0;
+  const declaredAt = `${from.location.file}:${from.location.line}`;
+  return {
+    suffix: ` Value comes from \`${from.name}\`, declared at ${declaredAt}.`,
+    attributes: {
+      valueFrom: "const-binding",
+      declaredAs: from.name,
+      declaredAt
+    }
+  };
+}
 function contractPrefixFamilies(names) {
   const families = /* @__PURE__ */ new Set();
   for (const name of names) {
@@ -4966,7 +5004,7 @@ function projectCanonicalDirectionConflicts(ix, canonicalSources) {
   const conflicts = [];
   for (const definition of ix.byKind("component_definition")) {
     if (!definition.exported || definition.renderRoot.resolution !== "canonical") continue;
-    const target = npmTarget(definition.renderRoot.canonical, npmSources);
+    const target = npmTarget(definition.renderRoot, npmSources);
     if (!target) continue;
     const identity = identityByComponent.get(definition.componentKey);
     if (identity?.decisionId && decisionTargetsExport(identity.canonicalTarget, target.exportName)) {
@@ -5000,7 +5038,10 @@ function canonicalDirectionConflictsTarget(conflicts, importPath, exportName) {
     (conflict) => ownedImportMatchesRoot(importPath, conflict.packageName) && conflict.exportName === exportName
   );
 }
-function npmTarget(canonicalTarget, sources) {
+function npmTarget(renderRoot, sources) {
+  return npmTargetFromCanonicalKey(renderRoot.canonical, sources) ?? npmTargetFromImportSource(renderRoot, sources);
+}
+function npmTargetFromCanonicalKey(canonicalTarget, sources) {
   const separator = canonicalTarget.lastIndexOf("#");
   if (separator <= 0 || separator === canonicalTarget.length - 1) return null;
   const importPath = canonicalTarget.slice(0, separator);
@@ -5017,6 +5058,19 @@ function npmTarget(canonicalTarget, sources) {
   }
   return null;
 }
+function npmTargetFromImportSource(renderRoot, sources) {
+  const separator = renderRoot.canonical.lastIndexOf("#");
+  if (separator <= 0 || separator === renderRoot.canonical.length - 1) return null;
+  const exportName = renderRoot.canonical.slice(separator + 1).split(".").at(-1);
+  if (!exportName || exportName === "default") return null;
+  for (const source of sources) {
+    if (!ownedImportMatchesRoot(renderRoot.importSource, source.specifier)) continue;
+    if (source.exclude?.includes(exportName)) continue;
+    if (source.include && !source.include.includes(exportName)) continue;
+    return { packageName: source.specifier, exportName };
+  }
+  return null;
+}
 function packageSubpath(importPath, packageName) {
   return importPath === packageName ? "" : importPath.slice(packageName.length + 1);
 }
@@ -6217,19 +6271,15 @@ function ruleJsxPreferredImportPath(ix) {
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
   for (const usage of ix.byKind("usage_import")) {
+    const bridgeGoverned = policies.some((policy) => bridgeGovernsUnderlyingImport(policy, usage));
     const matches = policies.filter((policy) => {
       if (policy.bridge) {
         if (policy.bridge.implementationFiles.some((file) => sameRepoPath(file, usage.file))) {
           return false;
         }
-        if (!ownedImportMatchesRoot(usage.source, policy.from)) return false;
-        if (ownedImportsEqual(usage.source, policy.from)) {
-          return usage.imported === policy.bridge.underlyingExportName;
-        }
-        const subpath = usage.source.slice(policy.from.length + 1);
-        const leaf = subpath.split("/").at(-1);
-        return leaf === policy.bridge.underlyingExportName && (usage.imported === "default" || usage.imported === policy.bridge.underlyingExportName);
+        return bridgeGovernsUnderlyingImport(policy, usage);
       }
+      if (bridgeGoverned) return false;
       if (!ownedImportsEqual(policy.from, usage.source)) return false;
       if (policy.imported !== void 0 && policy.imported !== usage.imported) return false;
       return true;
@@ -6283,6 +6333,17 @@ function ruleJsxPreferredImportPath(ix) {
   }
   return findings;
 }
+function bridgeGovernsUnderlyingImport(policy, usage) {
+  const bridge = policy.bridge;
+  if (!bridge) return false;
+  if (!ownedImportMatchesRoot(usage.source, policy.from)) return false;
+  if (ownedImportsEqual(usage.source, policy.from)) {
+    return usage.imported === bridge.underlyingExportName;
+  }
+  const subpath = usage.source.slice(policy.from.length + 1);
+  const leaf = subpath.split("/").at(-1);
+  return leaf === bridge.underlyingExportName && (usage.imported === "default" || usage.imported === bridge.underlyingExportName);
+}
 function sameRepoPath(left, right) {
   return normalizeRepoPath(left) === normalizeRepoPath(right);
 }
@@ -6538,14 +6599,15 @@ function ruleStylesNoRawColor(ix) {
     if (!color) continue;
     if (isExemptColor(color, policy.except)) continue;
     const resolution = resolveColorToken(decl.property, color, colorTokens);
-    const fixEmission = resolution?.kind === "exact" ? buildTokenFix(decl.property, decl.value, color, resolution, ix) : void 0;
+    const hopped = hoppedValue(decl);
+    const fixEmission = resolution?.kind === "exact" && !hopped ? buildTokenFix(decl.property, decl.value, color, resolution, ix) : void 0;
     const evidenceIds = resolution ? [decl.id, policy.id, resolution.token.id] : [decl.id, policy.id];
     findings.push(
       makeFinding({
         ruleId: RULE_ID9,
         ruleVersion: RULE_VERSION10,
         severity: policy.severity,
-        message: colorMessage(color, `\`${decl.property}\``, resolution, preferLabel),
+        message: colorMessage(color, `\`${decl.property}\``, resolution, preferLabel) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6564,7 +6626,8 @@ function ruleStylesNoRawColor(ix) {
           source: "css",
           suggestedToken: resolution?.token.name,
           ...resolution ? { tokenMatch: resolution.kind } : {},
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6610,7 +6673,8 @@ function ruleStylesNoRawColor(ix) {
     if (!node) continue;
     const componentEvidenceId = componentByNode.get(node.id)?.id;
     const resolution = resolveColorToken(inline.property, color, colorTokens);
-    const fixEmission = resolution?.kind === "exact" ? buildTokenFix(inline.property, inline.value, color, resolution, ix) : void 0;
+    const hopped = hoppedValue(inline);
+    const fixEmission = resolution?.kind === "exact" && !hopped ? buildTokenFix(inline.property, inline.value, color, resolution, ix) : void 0;
     const baseEvidence = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id] : [node.id, inline.id, policy.id];
     const evidenceIds = resolution ? [...baseEvidence, resolution.token.id] : baseEvidence;
     findings.push(
@@ -6618,7 +6682,7 @@ function ruleStylesNoRawColor(ix) {
         ruleId: RULE_ID9,
         ruleVersion: RULE_VERSION10,
         severity: policy.severity,
-        message: colorMessage(color, `inline \`${inline.property}\``, resolution, preferLabel),
+        message: colorMessage(color, `inline \`${inline.property}\``, resolution, preferLabel) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6637,7 +6701,8 @@ function ruleStylesNoRawColor(ix) {
           source: "jsx",
           suggestedToken: resolution?.token.name,
           ...resolution ? { tokenMatch: resolution.kind } : {},
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6829,13 +6894,14 @@ function ruleStylesNoRawDimensions(ix) {
     if (!resolution) continue;
     const tokenIds = resolutionTokenIds(resolution);
     const evidenceIds = tokenIds.length ? [decl.id, policy.id, ...tokenIds] : [decl.id, policy.id];
-    const fixEmission = dimensionFix(decl.property, resolution, ix);
+    const hopped = hoppedValue(decl);
+    const fixEmission = hopped ? void 0 : dimensionFix(decl.property, resolution, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID10,
         ruleVersion: RULE_VERSION11,
         severity: policy.severity,
-        message: dimensionMessage(decl.value, decl.property, preferLabel, resolution, false),
+        message: dimensionMessage(decl.value, decl.property, preferLabel, resolution, false) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6852,7 +6918,8 @@ function ruleStylesNoRawDimensions(ix) {
           rawValue: decl.value,
           source: "css",
           suggestedToken: resolutionSuggestedToken(resolution),
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6871,13 +6938,14 @@ function ruleStylesNoRawDimensions(ix) {
     const baseEvidence = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id] : [node.id, inline.id, policy.id];
     const tokenIds = resolutionTokenIds(resolution);
     const evidenceIds = tokenIds.length ? [...baseEvidence, ...tokenIds] : baseEvidence;
-    const fixEmission = dimensionFix(inline.property, resolution, ix);
+    const hopped = hoppedValue(inline);
+    const fixEmission = hopped ? void 0 : dimensionFix(inline.property, resolution, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID10,
         ruleVersion: RULE_VERSION11,
         severity: policy.severity,
-        message: dimensionMessage(inline.value, inline.property, preferLabel, resolution, true),
+        message: dimensionMessage(inline.value, inline.property, preferLabel, resolution, true) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6894,7 +6962,8 @@ function ruleStylesNoRawDimensions(ix) {
           rawValue: inline.value,
           source: "jsx",
           suggestedToken: resolutionSuggestedToken(resolution),
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -7184,12 +7253,13 @@ function checkDeclaration(ix, decl, lookupFor) {
     tokens: lookupFor(scale)
   });
   if (!checked) return null;
-  const fixEmission = buildSpacingFix(decl.property, checked, ix);
+  const hopped = hoppedValue(decl);
+  const fixEmission = hopped ? void 0 : buildSpacingFix(decl.property, checked, ix);
   return makeFinding({
     ruleId: RULE_ID11,
     ruleVersion: RULE_VERSION12,
     severity: policy.severity,
-    message: spacingMessage(decl.property, decl.value, allowed, scale.unit, checked),
+    message: spacingMessage(decl.property, decl.value, allowed, scale, checked) + (hopped?.suffix ?? ""),
     location: decl.location,
     evidence: ix.evidence([decl.id, policy.id, scale.id]),
     fingerprintIdentity: {
@@ -7215,7 +7285,8 @@ function checkDeclaration(ix, decl, lookupFor) {
       assumedRootFontSizePx: checked.assumedRootFontSizePx,
       assumedEmBasePx: checked.assumedEmBasePx,
       source: "css",
-      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+      ...hopped?.attributes ?? {}
     }
   });
 }
@@ -7235,7 +7306,8 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
     bareNumberFix: inline.valueKind === "number"
   });
   if (!checked) return null;
-  const fixEmission = buildSpacingFix(inline.property, checked, ix);
+  const hopped = hoppedValue(inline);
+  const fixEmission = hopped ? void 0 : buildSpacingFix(inline.property, checked, ix);
   const node = readUsageNode(ix, inline.nodeId);
   if (!node) return null;
   const componentEvidenceId = componentByNode.get(node.id)?.id;
@@ -7244,7 +7316,7 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
     ruleId: RULE_ID11,
     ruleVersion: RULE_VERSION12,
     severity: policy.severity,
-    message: spacingMessage(inline.property, inline.value, allowed, scale.unit, checked),
+    message: spacingMessage(inline.property, inline.value, allowed, scale, checked) + (hopped?.suffix ?? ""),
     location: node.location,
     evidence: ix.evidence(evidenceIds),
     fingerprintIdentity: {
@@ -7270,7 +7342,8 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
       assumedRootFontSizePx: checked.assumedRootFontSizePx,
       assumedEmBasePx: checked.assumedEmBasePx,
       source: "jsx",
-      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+      ...hopped?.attributes ?? {}
     }
   });
 }
@@ -7292,14 +7365,14 @@ function buildSpacingFix(property, checked, ix) {
     ix
   );
 }
-function spacingMessage(property, value, allowed, unit, checked) {
+function spacingMessage(property, value, allowed, scale, checked) {
   if (checked.reason === "token-equivalent" && checked.matchedToken) {
     return `\`${property}: ${value}\` is a raw literal that matches token \`${checked.matchedToken}\`. Reference the token instead.`;
   }
   const sample = allowed.slice().sort((a, b) => a - b).slice(0, 6);
-  const suffix = `${sample.join(unit + ", ")}${unit}`;
+  const suffix = `${sample.join(scale.unit + ", ")}${scale.unit}`;
   const ellipsis = allowed.length > sample.length ? ", \u2026" : "";
-  return `\`${property}: ${value}\` is not on the spacing scale. Allowed: ${suffix}${ellipsis}.`;
+  return `\`${property}: ${value}\` is not on the \`${scale.name}\` scale. Allowed: ${suffix}${ellipsis}. Configure \`govern.scales.${scale.name}\` to change it.`;
 }
 
 // src/rules/styles-no-raw-typography.ts
@@ -7319,13 +7392,14 @@ function ruleStylesNoRawTypography(ix) {
     if (decl.property.toLowerCase() !== "font-size") continue;
     const checked = checkFontSize(decl.value, allowed, scale, tokens);
     if (!checked) continue;
-    const fixEmission = buildFix(decl.property, checked, ix);
+    const hopped = hoppedValue(decl);
+    const fixEmission = hopped ? void 0 : buildFix(decl.property, checked, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID12,
         ruleVersion: RULE_VERSION13,
         severity: policy.severity,
-        message: typographyMessage(decl.property, decl.value, allowed, scale.unit, checked),
+        message: typographyMessage(decl.property, decl.value, allowed, scale.unit, checked) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence([decl.id, policy.id, scale.id]),
         fingerprintIdentity: {
@@ -7345,7 +7419,8 @@ function ruleStylesNoRawTypography(ix) {
           suggestedValue: checked.suggestedValue,
           matchedToken: checked.matchedToken,
           source: "css",
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -7362,7 +7437,8 @@ function ruleStylesNoRawTypography(ix) {
       inline.valueKind === "number"
     );
     if (!checked) continue;
-    const fixEmission = buildFix(inline.property, checked, ix);
+    const hopped = hoppedValue(inline);
+    const fixEmission = hopped ? void 0 : buildFix(inline.property, checked, ix);
     const node = readUsageNode(ix, inline.nodeId);
     if (!node) continue;
     const componentEvidenceId = componentByNode.get(node.id)?.id;
@@ -7372,7 +7448,7 @@ function ruleStylesNoRawTypography(ix) {
         ruleId: RULE_ID12,
         ruleVersion: RULE_VERSION13,
         severity: policy.severity,
-        message: typographyMessage(inline.property, inline.value, allowed, scale.unit, checked),
+        message: typographyMessage(inline.property, inline.value, allowed, scale.unit, checked) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -7392,7 +7468,8 @@ function ruleStylesNoRawTypography(ix) {
           suggestedValue: checked.suggestedValue,
           matchedToken: checked.matchedToken,
           source: "jsx",
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -8612,6 +8689,374 @@ function policyDeclaresCssVars(policy) {
 function dedupe(values) {
   return [...new Set(values)];
 }
+var CONSUMED_RULE_IDS = new Set(Object.keys(RULE_TIER));
+var RECOGNIZED_RULE_IDS = /* @__PURE__ */ new Set([...CONSUMED_RULE_IDS, ...RULE_FAMILY_IDS]);
+var RULE_CONFIG_KEYS = /* @__PURE__ */ new Set(["enabled", "severity", "options", "exclude"]);
+var PASSTHROUGH_KEYS = [
+  {
+    path: ["tokens"],
+    keys: [
+      "include",
+      "sources",
+      "packages",
+      "aliases",
+      "upstream",
+      "exclude",
+      "themeSelectors",
+      "enabled",
+      "format",
+      "namespace"
+    ]
+  },
+  {
+    path: ["screenshots"],
+    keys: ["viewport", "threshold", "delay", "outputDir", "themes"]
+  },
+  {
+    path: ["service"],
+    keys: ["poolSize", "idleTimeout"]
+  },
+  {
+    path: ["registry"],
+    keys: ["requireStory", "publicOnly", "categoryDepth", "includeProps", "embedFragments"]
+  },
+  {
+    path: ["govern", "tailwind"],
+    keys: ["palette"]
+  },
+  {
+    path: ["govern", "agent"],
+    keys: ["repairOrder"]
+  },
+  {
+    path: ["govern", "ci"],
+    keys: ["failOnWarnings", "failOnInert"]
+  }
+];
+function objectRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  return value;
+}
+function valueAtPath(value, path) {
+  let current = value;
+  for (const segment of path) {
+    const record = objectRecord(current);
+    if (!record) return void 0;
+    current = record[segment];
+  }
+  return current;
+}
+function configPath(path) {
+  return path.reduce(
+    (output, segment) => typeof segment === "number" ? `${output}[${segment}]` : output ? `${output}.${segment}` : segment,
+    ""
+  );
+}
+function unconsumedKeyDiagnostic(path) {
+  const renderedPath = configPath(path);
+  return {
+    code: "FUI9004",
+    kind: "unconsumed-key",
+    severity: "warn",
+    path: renderedPath,
+    message: `${renderedPath} is not consumed by Fragments and has no effect. Remove it or use a supported config key.`
+  };
+}
+var CONFIG_RECORD_FACT_KINDS = {
+  scale: { section: "govern.scales", record: "scale", keys: ["name"] },
+  scale_value: { section: "govern.scales", record: "scale.values", keys: ["scale", "value"] },
+  style_raw_color_forbidden: {
+    section: "govern.styles",
+    record: "style.rawColors.forbid",
+    keys: []
+  },
+  style_raw_dimension_forbidden: {
+    section: "govern.styles",
+    record: "style.rawDimensions.forbid",
+    keys: []
+  },
+  style_property_scale: {
+    section: "govern.styles",
+    record: "style.rawSpacing.mustMatchScale",
+    keys: ["property"]
+  },
+  style_font_size_scale: {
+    section: "govern.styles",
+    record: "style.fontSize.mustMatchScale",
+    keys: []
+  },
+  style_css_vars_must_be_defined: {
+    section: "govern.styles",
+    record: "style.cssVars.mustBeDefined",
+    keys: []
+  },
+  jsx_unknown_props_forbidden: {
+    section: "govern.jsx",
+    record: "jsx.unknownProps.forbid",
+    keys: []
+  },
+  jsx_inline_style_forbidden_raw: {
+    section: "govern.jsx",
+    record: "jsx.inlineStyle.forbidRaw",
+    keys: ["property"]
+  },
+  jsx_import_path_preferred: {
+    section: "govern.jsx",
+    record: "jsx.importPath.prefer",
+    keys: ["from", "to", "imported"]
+  },
+  jsx_component_preferred: {
+    section: "govern.jsx",
+    record: "jsx.component.prefer",
+    keys: ["from", "to"]
+  },
+  prop_value_avoided: {
+    section: "govern.components",
+    record: "prop.value.avoid",
+    keys: ["componentId", "prop", "value"]
+  },
+  prop_value_forbidden: {
+    section: "govern.components",
+    record: "prop.value.forbid",
+    keys: ["componentId", "prop", "value", "pathPattern"]
+  },
+  a11y_name_required: {
+    section: "govern.components",
+    record: "a11y.requireName",
+    keys: ["componentId"]
+  },
+  tailwind_palette_allow: {
+    section: "govern.tailwind",
+    record: "palette.allow",
+    keys: []
+  },
+  tailwind_palette_deny: { section: "govern.tailwind", record: "palette.deny", keys: [] },
+  tailwind_unknown_class_enabled: {
+    section: "govern.tailwind",
+    record: "unknownClass",
+    keys: []
+  },
+  governance_rule_config: { section: "govern.rules", record: "rule", keys: ["ruleId"] }
+};
+var COLLISION_DETAIL_KEYS = [
+  "severity",
+  "scale",
+  "prefer",
+  "enabled",
+  "appliesTo",
+  "except",
+  "properties",
+  "because"
+];
+function renderFactFields(fact, keys) {
+  return keys.filter((key) => fact[key] !== void 0).map((key) => `${key}=${Array.isArray(fact[key]) ? JSON.stringify(fact[key]) : fact[key]}`).join(" ");
+}
+function collidingRecordDiagnostic(conflict) {
+  return collidingRecordDiagnostics([conflict])[0] ?? null;
+}
+function collidingRecordDiagnostics(conflicts) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const conflict of conflicts) {
+    const shape = CONFIG_RECORD_FACT_KINDS[conflict.kept.kind];
+    if (!shape || conflict.kept.kind !== conflict.skipped.kind) continue;
+    const keptFact = conflict.kept;
+    const skippedFact = conflict.skipped;
+    const identity = renderFactFields(keptFact, shape.keys);
+    const path = `${shape.section}[${identity ? `${shape.record} ${identity}` : shape.record}]`;
+    const group = groups.get(path) ?? {
+      record: shape.record,
+      kept: renderFactFields(keptFact, COLLISION_DETAIL_KEYS),
+      dropped: [],
+      keptFallback: "the first record"
+    };
+    const dropped = renderFactFields(skippedFact, COLLISION_DETAIL_KEYS);
+    group.dropped.push(dropped || `record ${group.dropped.length + 2}`);
+    groups.set(path, group);
+  }
+  return [...groups].map(([path, group]) => ({
+    code: "FUI9007",
+    kind: "colliding-record",
+    severity: "warn",
+    path,
+    message: `${path} has ${group.dropped.length + 1} \`${group.record}\` records that compile to the same policy fact \u2014 enforcing ${group.kept || group.keptFallback} and dropping ${group.dropped.join("; ")}. Author one record for this policy, or scope them apart, so the enforced setting is the one you can read.`
+  }));
+}
+function configRecordShape(kind) {
+  const shape = CONFIG_RECORD_FACT_KINDS[kind];
+  return shape ? { section: shape.section, record: shape.record } : null;
+}
+function overriddenRecordSeverityDiagnostic(input) {
+  const path = `${input.section}[${input.record}]`;
+  return {
+    code: "FUI9008",
+    kind: "overridden-record-severity",
+    severity: "warn",
+    path,
+    message: `${path} authored severity=${input.authored}, but ${input.source} enforces severity=${input.enforced} on \`${input.ruleId}\`. The record's severity is not what gates CI \u2014 drop the rule override, or author the record at the severity you want enforced.`
+  };
+}
+function collectStrippedKeys(authored, parsed, path, diagnostics) {
+  if (Array.isArray(authored)) {
+    if (!Array.isArray(parsed)) return;
+    authored.forEach((item, index) => {
+      collectStrippedKeys(item, parsed[index], [...path, index], diagnostics);
+    });
+    return;
+  }
+  const authoredRecord = objectRecord(authored);
+  const parsedRecord = objectRecord(parsed);
+  if (!authoredRecord || !parsedRecord) return;
+  for (const key of Object.keys(authoredRecord).sort()) {
+    if (!Object.prototype.hasOwnProperty.call(parsedRecord, key)) {
+      diagnostics.push(unconsumedKeyDiagnostic([...path, key]));
+      continue;
+    }
+    collectStrippedKeys(authoredRecord[key], parsedRecord[key], [...path, key], diagnostics);
+  }
+}
+function collectPassthroughKeys(authored, path, allowed, diagnostics) {
+  const record = objectRecord(valueAtPath(authored, path));
+  if (!record) return;
+  for (const key of Object.keys(record).sort()) {
+    if (!allowed.has(key)) diagnostics.push(unconsumedKeyDiagnostic([...path, key]));
+  }
+}
+function collectRuleConfigKeys(authored, path, diagnostics) {
+  const rules = objectRecord(valueAtPath(authored, path));
+  if (!rules) return;
+  for (const ruleId of Object.keys(rules).sort()) {
+    if (!RECOGNIZED_RULE_IDS.has(ruleId)) {
+      diagnostics.push(unconsumedKeyDiagnostic([...path, ruleId]));
+      continue;
+    }
+    const config = objectRecord(rules[ruleId]);
+    if (!config) continue;
+    for (const key of Object.keys(config).sort()) {
+      if (!RULE_CONFIG_KEYS.has(key)) {
+        diagnostics.push(unconsumedKeyDiagnostic([...path, ruleId, key]));
+      }
+    }
+  }
+}
+function collectPassthroughRecordValues(authored, path, allowed, diagnostics) {
+  const entries = objectRecord(valueAtPath(authored, path));
+  if (!entries) return;
+  for (const [entryName, value] of Object.entries(entries).sort(
+    ([left], [right]) => left.localeCompare(right)
+  )) {
+    const record = objectRecord(value);
+    if (!record) continue;
+    for (const key of Object.keys(record).sort()) {
+      if (!allowed.has(key)) {
+        diagnostics.push(unconsumedKeyDiagnostic([...path, entryName, key]));
+      }
+    }
+  }
+}
+function stableConfigDiagnostics(diagnostics) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    unique.set(`${diagnostic.code}\0${diagnostic.path}`, diagnostic);
+  }
+  return [...unique.values()].sort(
+    (left, right) => left.path.localeCompare(right.path) || left.code.localeCompare(right.code) || left.message.localeCompare(right.message)
+  );
+}
+function detectUnconsumedConfigKeys(authoredConfig, parsedConfig) {
+  const diagnostics = [];
+  collectStrippedKeys(authoredConfig, parsedConfig, [], diagnostics);
+  for (const boundary of PASSTHROUGH_KEYS) {
+    collectPassthroughKeys(
+      authoredConfig,
+      boundary.path,
+      new Set(boundary.keys),
+      diagnostics
+    );
+  }
+  collectRuleConfigKeys(authoredConfig, ["govern", "rules"], diagnostics);
+  collectPassthroughRecordValues(
+    authoredConfig,
+    ["govern", "agents"],
+    /* @__PURE__ */ new Set(["rules"]),
+    diagnostics
+  );
+  collectPassthroughKeys(authoredConfig, ["govern", "audit"], /* @__PURE__ */ new Set(), diagnostics);
+  collectPassthroughRecordValues(authoredConfig, ["govern", "runners"], /* @__PURE__ */ new Set(), diagnostics);
+  return stableConfigDiagnostics(diagnostics);
+}
+function authoredPolicyExcludes(policy) {
+  const out = [];
+  const collect = (path, scope, raw) => {
+    for (const exclude of normalizePolicyExcludes(raw) ?? []) {
+      out.push({ path, scope, exclude });
+    }
+  };
+  (policy?.styles ?? []).forEach((record, index) => {
+    collect(`govern.styles[${index}].exclude`, record.kind, record.exclude);
+  });
+  (policy?.jsx ?? []).forEach((record, index) => {
+    collect(`govern.jsx[${index}].exclude`, record.kind, record.exclude);
+  });
+  for (const ruleId of Object.keys(policy?.rules ?? {}).sort()) {
+    const record = objectRecord(policy?.rules?.[ruleId]);
+    if (!record) continue;
+    collect(`govern.rules.${ruleId}.exclude`, ruleId, record.exclude);
+  }
+  return out;
+}
+function detectUnmatchedPolicyExcludes(policy, scannedFiles) {
+  if (scannedFiles.length === 0) return [];
+  const diagnostics = [];
+  for (const { path, scope, exclude } of authoredPolicyExcludes(policy)) {
+    if (scannedFiles.some((file) => policyExcludeMatchesPath(exclude, file))) continue;
+    diagnostics.push({
+      code: "FUI9006",
+      kind: "unmatched-exclude",
+      severity: "warn",
+      path,
+      message: `${path} pattern "${exclude.glob}" matched no scanned file, so ${scope} is not actually scoped by it. Correct the glob to a path this scan covers, or remove it.`
+    });
+  }
+  return stableConfigDiagnostics(diagnostics);
+}
+function effectiveScaleBindings(policy) {
+  const bindings = [];
+  for (const style of policy?.styles ?? []) {
+    if (style.kind === "style.rawSpacing.mustMatchScale") {
+      bindings.push({
+        label: "Spacing properties",
+        mechanism: "style.rawSpacing.mustMatchScale",
+        scale: style.scale
+      });
+    } else if (style.kind === "style.fontSize.mustMatchScale") {
+      bindings.push({
+        label: "Font-size properties",
+        mechanism: "style.fontSize.mustMatchScale",
+        scale: style.scale
+      });
+    }
+  }
+  return bindings;
+}
+function detectOrphanGovernanceScales(declaredPolicy, effectivePolicy) {
+  const bindings = effectiveScaleBindings(effectivePolicy);
+  const referenced = new Set(bindings.map((binding) => binding.scale));
+  const diagnostics = [];
+  for (const scale of Object.keys(declaredPolicy?.scales ?? {}).sort()) {
+    if (referenced.has(scale)) continue;
+    const path = `govern.scales.${scale}`;
+    const preferred = (scale.toLowerCase().includes("spac") ? bindings.find((binding) => binding.mechanism === "style.rawSpacing.mustMatchScale") : void 0) ?? (scale.toLowerCase().includes("font") ? bindings.find((binding) => binding.mechanism === "style.fontSize.mustMatchScale") : void 0) ?? bindings[0];
+    const remediation = preferred ? `${preferred.label} are bound to the scale named "${preferred.scale}" \u2014 rename the key to "${preferred.scale}" or bind it via ${preferred.mechanism}.` : `Bind it via style.rawSpacing.mustMatchScale or style.fontSize.mustMatchScale, or remove it.`;
+    diagnostics.push({
+      code: "FUI9005",
+      kind: "orphan-scale",
+      severity: "warn",
+      path,
+      message: `${path} is not referenced by any property policy. ${remediation}`
+    });
+  }
+  return stableConfigDiagnostics(diagnostics);
+}
 function summarize(status, flags) {
   if (status === "inert") {
     return "Governance inert \u2014 no enforceable rule family is armed";
@@ -8627,6 +9072,7 @@ function summarize(status, flags) {
 }
 function evaluateGovernanceIntegrity(input) {
   const configs = effectiveRuleConfigs(input.policy);
+  const configDiagnostics = stableConfigDiagnostics(input.configDiagnostics ?? []);
   const policyArmed = input.policy !== void 0 && input.policySource !== "none";
   const policyFamily = {
     id: "policy",
@@ -8727,6 +9173,17 @@ function evaluateGovernanceIntegrity(input) {
     families.map((family) => family.remediation).filter((remediation) => remediation !== void 0)
   );
   const summary = summarize(status, { componentsArmed, tokensArmed, blockingArmed });
+  const configuredRuleCount = [...configs.keys()].filter(
+    (ruleId) => CONSUMED_RULE_IDS.has(ruleId)
+  ).length;
+  const activeRuleCount = [...configs.entries()].filter(
+    ([ruleId, config]) => CONSUMED_RULE_IDS.has(ruleId) && config.enabled
+  ).length;
+  const roster = {
+    configured: configuredRuleCount + configDiagnostics.length,
+    active: activeRuleCount,
+    inert: configDiagnostics.length
+  };
   return {
     status,
     declared: input.declared,
@@ -8735,7 +9192,9 @@ function evaluateGovernanceIntegrity(input) {
     families,
     armed,
     summary,
-    remediations
+    remediations,
+    configDiagnostics,
+    roster
   };
 }
 
@@ -8756,6 +9215,19 @@ function canonicalBridgeContractMappings(bridges) {
     }
   }));
 }
+function canonicalBridgeIdentityBindings(bridges) {
+  return (bridges ?? []).map((bridge) => ({
+    source: {
+      kind: "npm",
+      specifier: bridge.underlying.packageName,
+      include: [bridge.underlying.exportName]
+    },
+    localComponentKey: bridge.local.componentKey
+  }));
+}
+function canonicalBridgeIdentitySources(bridges) {
+  return canonicalBridgeIdentityBindings(bridges).map((binding) => binding.source);
+}
 
 // src/effective-governance-inputs.ts
 var EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA = "effective-governance-inputs:v1";
@@ -9322,6 +9794,8 @@ export {
   REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
   REGISTRY_MANIFEST_SCHEMA_VERSION,
   RULES,
+  RULE_FAMILY_IDS,
+  RULE_FAMILY_MEMBERS,
   RULE_TIER,
   SEVERITIES,
   SEVERITY_RANK,
@@ -9359,6 +9833,8 @@ export {
   calculateDeltaE,
   canBlock,
   canonicalBridgeContractMappings,
+  canonicalBridgeIdentityBindings,
+  canonicalBridgeIdentitySources,
   canonicalBridgeV1Schema,
   canonicalDirectionConflictsTarget,
   canonicalJson,
@@ -9373,6 +9849,8 @@ export {
   classifyComplexity,
   classifyIdentity,
   collectRegistryInstallDependencies,
+  collidingRecordDiagnostic,
+  collidingRecordDiagnostics,
   colorSimilarity,
   compareByVocabularyRank,
   compareColors,
@@ -9396,6 +9874,8 @@ export {
   compositionMetadataSchema,
   compositionPatternSchema,
   computeRegistryHash,
+  configDeclarationForDiagnostics,
+  configRecordShape,
   containsTailwindV4Theme,
   contractComponentsFromFragments,
   contractHash,
@@ -9406,12 +9886,17 @@ export {
   defineConfig,
   defineFragment,
   defineRecipe,
+  describePolicyExclude,
+  detectOrphanGovernanceScales,
   detectSubComponentPaths,
+  detectUnconsumedConfigKeys,
+  detectUnmatchedPolicyExcludes,
   diffContractDomains,
   discoverComponents,
   dtcgTokenFileSchema,
   emptyConformResult,
   evaluateGovernanceIntegrity,
+  excludeGlobToRegExp,
   executeVariantLoaders,
   explainUrlForCode,
   factEvidenceSchema,
@@ -9484,8 +9969,10 @@ export {
   isFigmaPropMapping,
   isForceIncluded,
   isPortableRepoPath,
+  isPresetSourcedRule,
   isRawHtmlAdvisoryTier,
   isReactComponent,
+  isRuleFamilyId,
   localCanonicalContractMappings,
   lowerCompositionContract,
   makeA11yNameRequiredFact,
@@ -9529,6 +10016,8 @@ export {
   makeUsageNodeFact,
   makeUsagePropResolvedFact,
   makeUsageTextChildFact,
+  markPresetSourcedRules,
+  matchPolicyExclude,
   matchesGlob,
   maxSeverity,
   mcpBlockSchema,
@@ -9554,8 +10043,10 @@ export {
   nearestSignedScaleValue,
   normalizeColor,
   normalizeConfigPath,
+  normalizeExcludePath,
   normalizeFinding,
   normalizeGovernanceConfig,
+  normalizePolicyExcludes,
   normalizeRegistryRepoPath,
   normalizeSeverity,
   normalizeStyleValue,
@@ -9563,6 +10054,7 @@ export {
   normalizeTokenGroupComment,
   normalizeTokenValue,
   normalizeViolation,
+  overriddenRecordSeverityDiagnostic,
   ownedImportEquivalents,
   parseColor,
   parseColorToRgb,
@@ -9578,9 +10070,12 @@ export {
   parseTailwindV4Theme,
   parseTokenFile,
   parseTokens,
+  policyExcludeMatchesPath,
+  policyExcludeSchema,
   portableRepoPathError,
   projectCanonicalDirectionConflicts,
   projectContractPreimage,
+  projectSupersededImportPathPreferences,
   projectV1OwnedComponentId,
   projectV1OwnedImportIdentity,
   propDefinitionSchema,
@@ -9624,6 +10119,7 @@ export {
   ruleComponentsPreferLibrary,
   ruleComponentsShadowComponent,
   ruleComponentsUnknownProp,
+  ruleFamilyMembers,
   ruleJsxPreferredComponent,
   ruleJsxPreferredImportPath,
   rulePropsInvalidValue,