@usefragments/core 1.5.2 → 1.6.0

package/dist/index.js

@@ -44,6 +44,8 @@ import {
   CODES,
   EXPLAIN_URL_BASE,
   FactIndex,
+  RULE_FAMILY_IDS,
+  RULE_FAMILY_MEMBERS,
   asComponentId,
   bridgeSourceViolation,
   bridgeSourceViolations,
@@ -56,6 +58,8 @@ import {
   componentGovernanceRecordSchema,
   componentGovernanceRecordsSchema,
   componentId,
+  describePolicyExclude,
+  excludeGlobToRegExp,
   explainUrlForCode,
   factId,
   g,
@@ -65,6 +69,8 @@ import {
   governanceConfigSchema,
   governanceSeveritySchema,
   hash64Hex,
+  isPresetSourcedRule,
+  isRuleFamilyId,
   makeA11yNameRequiredFact,
   makeCanonicalCandidateFact,
   makeCanonicalMappingFact,
@@ -105,14 +111,22 @@ import {
   makeUsageNodeFact,
   makeUsagePropResolvedFact,
   makeUsageTextChildFact,
+  markPresetSourcedRules,
+  matchPolicyExclude,
   matchesGlob,
+  normalizeExcludePath,
   normalizeGovernanceConfig,
+  normalizePolicyExcludes,
   ownedComponentIdsEqual,
   ownedImportMatchesRoot,
   ownedImportsEqual,
+  policyExcludeMatchesPath,
+  policyExcludeSchema,
+  projectSupersededImportPathPreferences,
   resolveComponentGovernance,
+  ruleFamilyMembers,
   scaleGovernanceRecordSchema
-} from "./chunk-BAHCOAVG.js";
+} from "./chunk-WVFNDPM4.js";
 import {
   AGENT_FORMAT_SCHEMA_VERSION,
   agentErrorEnvelopeSchema,
@@ -4496,6 +4510,19 @@ function readUsageNode(ix, id) {
   const fact = ix.get(id);
   return fact && fact.kind === "usage_node" ? fact : void 0;
 }
+function hoppedValue(fact) {
+  const from = fact.valueFrom;
+  if (!from) return void 0;
+  const declaredAt = `${from.location.file}:${from.location.line}`;
+  return {
+    suffix: ` Value comes from \`${from.name}\`, declared at ${declaredAt}.`,
+    attributes: {
+      valueFrom: "const-binding",
+      declaredAs: from.name,
+      declaredAt
+    }
+  };
+}
 function contractPrefixFamilies(names) {
   const families = /* @__PURE__ */ new Set();
   for (const name of names) {
@@ -4977,7 +5004,7 @@ function projectCanonicalDirectionConflicts(ix, canonicalSources) {
   const conflicts = [];
   for (const definition of ix.byKind("component_definition")) {
     if (!definition.exported || definition.renderRoot.resolution !== "canonical") continue;
-    const target = npmTarget(definition.renderRoot.canonical, npmSources);
+    const target = npmTarget(definition.renderRoot, npmSources);
     if (!target) continue;
     const identity = identityByComponent.get(definition.componentKey);
     if (identity?.decisionId && decisionTargetsExport(identity.canonicalTarget, target.exportName)) {
@@ -5011,7 +5038,10 @@ function canonicalDirectionConflictsTarget(conflicts, importPath, exportName) {
     (conflict) => ownedImportMatchesRoot(importPath, conflict.packageName) && conflict.exportName === exportName
   );
 }
-function npmTarget(canonicalTarget, sources) {
+function npmTarget(renderRoot, sources) {
+  return npmTargetFromCanonicalKey(renderRoot.canonical, sources) ?? npmTargetFromImportSource(renderRoot, sources);
+}
+function npmTargetFromCanonicalKey(canonicalTarget, sources) {
   const separator = canonicalTarget.lastIndexOf("#");
   if (separator <= 0 || separator === canonicalTarget.length - 1) return null;
   const importPath = canonicalTarget.slice(0, separator);
@@ -5028,6 +5058,19 @@ function npmTarget(canonicalTarget, sources) {
   }
   return null;
 }
+function npmTargetFromImportSource(renderRoot, sources) {
+  const separator = renderRoot.canonical.lastIndexOf("#");
+  if (separator <= 0 || separator === renderRoot.canonical.length - 1) return null;
+  const exportName = renderRoot.canonical.slice(separator + 1).split(".").at(-1);
+  if (!exportName || exportName === "default") return null;
+  for (const source of sources) {
+    if (!ownedImportMatchesRoot(renderRoot.importSource, source.specifier)) continue;
+    if (source.exclude?.includes(exportName)) continue;
+    if (source.include && !source.include.includes(exportName)) continue;
+    return { packageName: source.specifier, exportName };
+  }
+  return null;
+}
 function packageSubpath(importPath, packageName) {
   return importPath === packageName ? "" : importPath.slice(packageName.length + 1);
 }
@@ -6228,19 +6271,15 @@ function ruleJsxPreferredImportPath(ix) {
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
   for (const usage of ix.byKind("usage_import")) {
+    const bridgeGoverned = policies.some((policy) => bridgeGovernsUnderlyingImport(policy, usage));
     const matches = policies.filter((policy) => {
       if (policy.bridge) {
         if (policy.bridge.implementationFiles.some((file) => sameRepoPath(file, usage.file))) {
           return false;
         }
-        if (!ownedImportMatchesRoot(usage.source, policy.from)) return false;
-        if (ownedImportsEqual(usage.source, policy.from)) {
-          return usage.imported === policy.bridge.underlyingExportName;
-        }
-        const subpath = usage.source.slice(policy.from.length + 1);
-        const leaf = subpath.split("/").at(-1);
-        return leaf === policy.bridge.underlyingExportName && (usage.imported === "default" || usage.imported === policy.bridge.underlyingExportName);
+        return bridgeGovernsUnderlyingImport(policy, usage);
       }
+      if (bridgeGoverned) return false;
       if (!ownedImportsEqual(policy.from, usage.source)) return false;
       if (policy.imported !== void 0 && policy.imported !== usage.imported) return false;
       return true;
@@ -6294,6 +6333,17 @@ function ruleJsxPreferredImportPath(ix) {
   }
   return findings;
 }
+function bridgeGovernsUnderlyingImport(policy, usage) {
+  const bridge = policy.bridge;
+  if (!bridge) return false;
+  if (!ownedImportMatchesRoot(usage.source, policy.from)) return false;
+  if (ownedImportsEqual(usage.source, policy.from)) {
+    return usage.imported === bridge.underlyingExportName;
+  }
+  const subpath = usage.source.slice(policy.from.length + 1);
+  const leaf = subpath.split("/").at(-1);
+  return leaf === bridge.underlyingExportName && (usage.imported === "default" || usage.imported === bridge.underlyingExportName);
+}
 function sameRepoPath(left, right) {
   return normalizeRepoPath(left) === normalizeRepoPath(right);
 }
@@ -6549,14 +6599,15 @@ function ruleStylesNoRawColor(ix) {
     if (!color) continue;
     if (isExemptColor(color, policy.except)) continue;
     const resolution = resolveColorToken(decl.property, color, colorTokens);
-    const fixEmission = resolution?.kind === "exact" ? buildTokenFix(decl.property, decl.value, color, resolution, ix) : void 0;
+    const hopped = hoppedValue(decl);
+    const fixEmission = resolution?.kind === "exact" && !hopped ? buildTokenFix(decl.property, decl.value, color, resolution, ix) : void 0;
     const evidenceIds = resolution ? [decl.id, policy.id, resolution.token.id] : [decl.id, policy.id];
     findings.push(
       makeFinding({
         ruleId: RULE_ID9,
         ruleVersion: RULE_VERSION10,
         severity: policy.severity,
-        message: colorMessage(color, `\`${decl.property}\``, resolution, preferLabel),
+        message: colorMessage(color, `\`${decl.property}\``, resolution, preferLabel) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6575,7 +6626,8 @@ function ruleStylesNoRawColor(ix) {
           source: "css",
           suggestedToken: resolution?.token.name,
           ...resolution ? { tokenMatch: resolution.kind } : {},
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6621,7 +6673,8 @@ function ruleStylesNoRawColor(ix) {
     if (!node) continue;
     const componentEvidenceId = componentByNode.get(node.id)?.id;
     const resolution = resolveColorToken(inline.property, color, colorTokens);
-    const fixEmission = resolution?.kind === "exact" ? buildTokenFix(inline.property, inline.value, color, resolution, ix) : void 0;
+    const hopped = hoppedValue(inline);
+    const fixEmission = resolution?.kind === "exact" && !hopped ? buildTokenFix(inline.property, inline.value, color, resolution, ix) : void 0;
     const baseEvidence = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id] : [node.id, inline.id, policy.id];
     const evidenceIds = resolution ? [...baseEvidence, resolution.token.id] : baseEvidence;
     findings.push(
@@ -6629,7 +6682,7 @@ function ruleStylesNoRawColor(ix) {
         ruleId: RULE_ID9,
         ruleVersion: RULE_VERSION10,
         severity: policy.severity,
-        message: colorMessage(color, `inline \`${inline.property}\``, resolution, preferLabel),
+        message: colorMessage(color, `inline \`${inline.property}\``, resolution, preferLabel) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6648,7 +6701,8 @@ function ruleStylesNoRawColor(ix) {
           source: "jsx",
           suggestedToken: resolution?.token.name,
           ...resolution ? { tokenMatch: resolution.kind } : {},
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6840,13 +6894,14 @@ function ruleStylesNoRawDimensions(ix) {
     if (!resolution) continue;
     const tokenIds = resolutionTokenIds(resolution);
     const evidenceIds = tokenIds.length ? [decl.id, policy.id, ...tokenIds] : [decl.id, policy.id];
-    const fixEmission = dimensionFix(decl.property, resolution, ix);
+    const hopped = hoppedValue(decl);
+    const fixEmission = hopped ? void 0 : dimensionFix(decl.property, resolution, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID10,
         ruleVersion: RULE_VERSION11,
         severity: policy.severity,
-        message: dimensionMessage(decl.value, decl.property, preferLabel, resolution, false),
+        message: dimensionMessage(decl.value, decl.property, preferLabel, resolution, false) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6863,7 +6918,8 @@ function ruleStylesNoRawDimensions(ix) {
           rawValue: decl.value,
           source: "css",
           suggestedToken: resolutionSuggestedToken(resolution),
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -6882,13 +6938,14 @@ function ruleStylesNoRawDimensions(ix) {
     const baseEvidence = componentEvidenceId ? [node.id, componentEvidenceId, inline.id, policy.id] : [node.id, inline.id, policy.id];
     const tokenIds = resolutionTokenIds(resolution);
     const evidenceIds = tokenIds.length ? [...baseEvidence, ...tokenIds] : baseEvidence;
-    const fixEmission = dimensionFix(inline.property, resolution, ix);
+    const hopped = hoppedValue(inline);
+    const fixEmission = hopped ? void 0 : dimensionFix(inline.property, resolution, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID10,
         ruleVersion: RULE_VERSION11,
         severity: policy.severity,
-        message: dimensionMessage(inline.value, inline.property, preferLabel, resolution, true),
+        message: dimensionMessage(inline.value, inline.property, preferLabel, resolution, true) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -6905,7 +6962,8 @@ function ruleStylesNoRawDimensions(ix) {
           rawValue: inline.value,
           source: "jsx",
           suggestedToken: resolutionSuggestedToken(resolution),
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -7195,12 +7253,13 @@ function checkDeclaration(ix, decl, lookupFor) {
     tokens: lookupFor(scale)
   });
   if (!checked) return null;
-  const fixEmission = buildSpacingFix(decl.property, checked, ix);
+  const hopped = hoppedValue(decl);
+  const fixEmission = hopped ? void 0 : buildSpacingFix(decl.property, checked, ix);
   return makeFinding({
     ruleId: RULE_ID11,
     ruleVersion: RULE_VERSION12,
     severity: policy.severity,
-    message: spacingMessage(decl.property, decl.value, allowed, scale, checked),
+    message: spacingMessage(decl.property, decl.value, allowed, scale, checked) + (hopped?.suffix ?? ""),
     location: decl.location,
     evidence: ix.evidence([decl.id, policy.id, scale.id]),
     fingerprintIdentity: {
@@ -7226,7 +7285,8 @@ function checkDeclaration(ix, decl, lookupFor) {
       assumedRootFontSizePx: checked.assumedRootFontSizePx,
       assumedEmBasePx: checked.assumedEmBasePx,
       source: "css",
-      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+      ...hopped?.attributes ?? {}
     }
   });
 }
@@ -7246,7 +7306,8 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
     bareNumberFix: inline.valueKind === "number"
   });
   if (!checked) return null;
-  const fixEmission = buildSpacingFix(inline.property, checked, ix);
+  const hopped = hoppedValue(inline);
+  const fixEmission = hopped ? void 0 : buildSpacingFix(inline.property, checked, ix);
   const node = readUsageNode(ix, inline.nodeId);
   if (!node) return null;
   const componentEvidenceId = componentByNode.get(node.id)?.id;
@@ -7255,7 +7316,7 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
     ruleId: RULE_ID11,
     ruleVersion: RULE_VERSION12,
     severity: policy.severity,
-    message: spacingMessage(inline.property, inline.value, allowed, scale, checked),
+    message: spacingMessage(inline.property, inline.value, allowed, scale, checked) + (hopped?.suffix ?? ""),
     location: node.location,
     evidence: ix.evidence(evidenceIds),
     fingerprintIdentity: {
@@ -7281,7 +7342,8 @@ function checkInlineStyle(ix, inline, componentByNode, lookupFor) {
       assumedRootFontSizePx: checked.assumedRootFontSizePx,
       assumedEmBasePx: checked.assumedEmBasePx,
       source: "jsx",
-      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+      ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+      ...hopped?.attributes ?? {}
     }
   });
 }
@@ -7330,13 +7392,14 @@ function ruleStylesNoRawTypography(ix) {
     if (decl.property.toLowerCase() !== "font-size") continue;
     const checked = checkFontSize(decl.value, allowed, scale, tokens);
     if (!checked) continue;
-    const fixEmission = buildFix(decl.property, checked, ix);
+    const hopped = hoppedValue(decl);
+    const fixEmission = hopped ? void 0 : buildFix(decl.property, checked, ix);
     findings.push(
       makeFinding({
         ruleId: RULE_ID12,
         ruleVersion: RULE_VERSION13,
         severity: policy.severity,
-        message: typographyMessage(decl.property, decl.value, allowed, scale.unit, checked),
+        message: typographyMessage(decl.property, decl.value, allowed, scale.unit, checked) + (hopped?.suffix ?? ""),
         location: decl.location,
         evidence: ix.evidence([decl.id, policy.id, scale.id]),
         fingerprintIdentity: {
@@ -7356,7 +7419,8 @@ function ruleStylesNoRawTypography(ix) {
           suggestedValue: checked.suggestedValue,
           matchedToken: checked.matchedToken,
           source: "css",
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -7373,7 +7437,8 @@ function ruleStylesNoRawTypography(ix) {
       inline.valueKind === "number"
     );
     if (!checked) continue;
-    const fixEmission = buildFix(inline.property, checked, ix);
+    const hopped = hoppedValue(inline);
+    const fixEmission = hopped ? void 0 : buildFix(inline.property, checked, ix);
     const node = readUsageNode(ix, inline.nodeId);
     if (!node) continue;
     const componentEvidenceId = componentByNode.get(node.id)?.id;
@@ -7383,7 +7448,7 @@ function ruleStylesNoRawTypography(ix) {
         ruleId: RULE_ID12,
         ruleVersion: RULE_VERSION13,
         severity: policy.severity,
-        message: typographyMessage(inline.property, inline.value, allowed, scale.unit, checked),
+        message: typographyMessage(inline.property, inline.value, allowed, scale.unit, checked) + (hopped?.suffix ?? ""),
         location: node.location,
         evidence: ix.evidence(evidenceIds),
         fingerprintIdentity: {
@@ -7403,7 +7468,8 @@ function ruleStylesNoRawTypography(ix) {
           suggestedValue: checked.suggestedValue,
           matchedToken: checked.matchedToken,
           source: "jsx",
-          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {}
+          ...fixEmission?.downgradeReason ? { downgradeReason: fixEmission.downgradeReason } : {},
+          ...hopped?.attributes ?? {}
         }
       })
     );
@@ -8623,10 +8689,9 @@ function policyDeclaresCssVars(policy) {
 function dedupe(values) {
   return [...new Set(values)];
 }
-var RULE_FAMILY_IDS = /* @__PURE__ */ new Set(["tokens/hardcoded-values", "components/usage", "a11y/wcag"]);
 var CONSUMED_RULE_IDS = new Set(Object.keys(RULE_TIER));
 var RECOGNIZED_RULE_IDS = /* @__PURE__ */ new Set([...CONSUMED_RULE_IDS, ...RULE_FAMILY_IDS]);
-var RULE_CONFIG_KEYS = /* @__PURE__ */ new Set(["enabled", "severity", "options"]);
+var RULE_CONFIG_KEYS = /* @__PURE__ */ new Set(["enabled", "severity", "options", "exclude"]);
 var PASSTHROUGH_KEYS = [
   {
     path: ["tokens"],
@@ -8665,7 +8730,7 @@ var PASSTHROUGH_KEYS = [
   },
   {
     path: ["govern", "ci"],
-    keys: ["failOnWarnings"]
+    keys: ["failOnWarnings", "failOnInert"]
   }
 ];
 function objectRecord(value) {
@@ -8697,6 +8762,139 @@ function unconsumedKeyDiagnostic(path) {
     message: `${renderedPath} is not consumed by Fragments and has no effect. Remove it or use a supported config key.`
   };
 }
+var CONFIG_RECORD_FACT_KINDS = {
+  scale: { section: "govern.scales", record: "scale", keys: ["name"] },
+  scale_value: { section: "govern.scales", record: "scale.values", keys: ["scale", "value"] },
+  style_raw_color_forbidden: {
+    section: "govern.styles",
+    record: "style.rawColors.forbid",
+    keys: []
+  },
+  style_raw_dimension_forbidden: {
+    section: "govern.styles",
+    record: "style.rawDimensions.forbid",
+    keys: []
+  },
+  style_property_scale: {
+    section: "govern.styles",
+    record: "style.rawSpacing.mustMatchScale",
+    keys: ["property"]
+  },
+  style_font_size_scale: {
+    section: "govern.styles",
+    record: "style.fontSize.mustMatchScale",
+    keys: []
+  },
+  style_css_vars_must_be_defined: {
+    section: "govern.styles",
+    record: "style.cssVars.mustBeDefined",
+    keys: []
+  },
+  jsx_unknown_props_forbidden: {
+    section: "govern.jsx",
+    record: "jsx.unknownProps.forbid",
+    keys: []
+  },
+  jsx_inline_style_forbidden_raw: {
+    section: "govern.jsx",
+    record: "jsx.inlineStyle.forbidRaw",
+    keys: ["property"]
+  },
+  jsx_import_path_preferred: {
+    section: "govern.jsx",
+    record: "jsx.importPath.prefer",
+    keys: ["from", "to", "imported"]
+  },
+  jsx_component_preferred: {
+    section: "govern.jsx",
+    record: "jsx.component.prefer",
+    keys: ["from", "to"]
+  },
+  prop_value_avoided: {
+    section: "govern.components",
+    record: "prop.value.avoid",
+    keys: ["componentId", "prop", "value"]
+  },
+  prop_value_forbidden: {
+    section: "govern.components",
+    record: "prop.value.forbid",
+    keys: ["componentId", "prop", "value", "pathPattern"]
+  },
+  a11y_name_required: {
+    section: "govern.components",
+    record: "a11y.requireName",
+    keys: ["componentId"]
+  },
+  tailwind_palette_allow: {
+    section: "govern.tailwind",
+    record: "palette.allow",
+    keys: []
+  },
+  tailwind_palette_deny: { section: "govern.tailwind", record: "palette.deny", keys: [] },
+  tailwind_unknown_class_enabled: {
+    section: "govern.tailwind",
+    record: "unknownClass",
+    keys: []
+  },
+  governance_rule_config: { section: "govern.rules", record: "rule", keys: ["ruleId"] }
+};
+var COLLISION_DETAIL_KEYS = [
+  "severity",
+  "scale",
+  "prefer",
+  "enabled",
+  "appliesTo",
+  "except",
+  "properties",
+  "because"
+];
+function renderFactFields(fact, keys) {
+  return keys.filter((key) => fact[key] !== void 0).map((key) => `${key}=${Array.isArray(fact[key]) ? JSON.stringify(fact[key]) : fact[key]}`).join(" ");
+}
+function collidingRecordDiagnostic(conflict) {
+  return collidingRecordDiagnostics([conflict])[0] ?? null;
+}
+function collidingRecordDiagnostics(conflicts) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const conflict of conflicts) {
+    const shape = CONFIG_RECORD_FACT_KINDS[conflict.kept.kind];
+    if (!shape || conflict.kept.kind !== conflict.skipped.kind) continue;
+    const keptFact = conflict.kept;
+    const skippedFact = conflict.skipped;
+    const identity = renderFactFields(keptFact, shape.keys);
+    const path = `${shape.section}[${identity ? `${shape.record} ${identity}` : shape.record}]`;
+    const group = groups.get(path) ?? {
+      record: shape.record,
+      kept: renderFactFields(keptFact, COLLISION_DETAIL_KEYS),
+      dropped: [],
+      keptFallback: "the first record"
+    };
+    const dropped = renderFactFields(skippedFact, COLLISION_DETAIL_KEYS);
+    group.dropped.push(dropped || `record ${group.dropped.length + 2}`);
+    groups.set(path, group);
+  }
+  return [...groups].map(([path, group]) => ({
+    code: "FUI9007",
+    kind: "colliding-record",
+    severity: "warn",
+    path,
+    message: `${path} has ${group.dropped.length + 1} \`${group.record}\` records that compile to the same policy fact \u2014 enforcing ${group.kept || group.keptFallback} and dropping ${group.dropped.join("; ")}. Author one record for this policy, or scope them apart, so the enforced setting is the one you can read.`
+  }));
+}
+function configRecordShape(kind) {
+  const shape = CONFIG_RECORD_FACT_KINDS[kind];
+  return shape ? { section: shape.section, record: shape.record } : null;
+}
+function overriddenRecordSeverityDiagnostic(input) {
+  const path = `${input.section}[${input.record}]`;
+  return {
+    code: "FUI9008",
+    kind: "overridden-record-severity",
+    severity: "warn",
+    path,
+    message: `${path} authored severity=${input.authored}, but ${input.source} enforces severity=${input.enforced} on \`${input.ruleId}\`. The record's severity is not what gates CI \u2014 drop the rule override, or author the record at the severity you want enforced.`
+  };
+}
 function collectStrippedKeys(authored, parsed, path, diagnostics) {
   if (Array.isArray(authored)) {
     if (!Array.isArray(parsed)) return;
@@ -8786,6 +8984,41 @@ function detectUnconsumedConfigKeys(authoredConfig, parsedConfig) {
   collectPassthroughRecordValues(authoredConfig, ["govern", "runners"], /* @__PURE__ */ new Set(), diagnostics);
   return stableConfigDiagnostics(diagnostics);
 }
+function authoredPolicyExcludes(policy) {
+  const out = [];
+  const collect = (path, scope, raw) => {
+    for (const exclude of normalizePolicyExcludes(raw) ?? []) {
+      out.push({ path, scope, exclude });
+    }
+  };
+  (policy?.styles ?? []).forEach((record, index) => {
+    collect(`govern.styles[${index}].exclude`, record.kind, record.exclude);
+  });
+  (policy?.jsx ?? []).forEach((record, index) => {
+    collect(`govern.jsx[${index}].exclude`, record.kind, record.exclude);
+  });
+  for (const ruleId of Object.keys(policy?.rules ?? {}).sort()) {
+    const record = objectRecord(policy?.rules?.[ruleId]);
+    if (!record) continue;
+    collect(`govern.rules.${ruleId}.exclude`, ruleId, record.exclude);
+  }
+  return out;
+}
+function detectUnmatchedPolicyExcludes(policy, scannedFiles) {
+  if (scannedFiles.length === 0) return [];
+  const diagnostics = [];
+  for (const { path, scope, exclude } of authoredPolicyExcludes(policy)) {
+    if (scannedFiles.some((file) => policyExcludeMatchesPath(exclude, file))) continue;
+    diagnostics.push({
+      code: "FUI9006",
+      kind: "unmatched-exclude",
+      severity: "warn",
+      path,
+      message: `${path} pattern "${exclude.glob}" matched no scanned file, so ${scope} is not actually scoped by it. Correct the glob to a path this scan covers, or remove it.`
+    });
+  }
+  return stableConfigDiagnostics(diagnostics);
+}
 function effectiveScaleBindings(policy) {
   const bindings = [];
   for (const style of policy?.styles ?? []) {
@@ -8982,6 +9215,19 @@ function canonicalBridgeContractMappings(bridges) {
     }
   }));
 }
+function canonicalBridgeIdentityBindings(bridges) {
+  return (bridges ?? []).map((bridge) => ({
+    source: {
+      kind: "npm",
+      specifier: bridge.underlying.packageName,
+      include: [bridge.underlying.exportName]
+    },
+    localComponentKey: bridge.local.componentKey
+  }));
+}
+function canonicalBridgeIdentitySources(bridges) {
+  return canonicalBridgeIdentityBindings(bridges).map((binding) => binding.source);
+}
 
 // src/effective-governance-inputs.ts
 var EFFECTIVE_GOVERNANCE_INPUTS_SCHEMA = "effective-governance-inputs:v1";
@@ -9548,6 +9794,8 @@ export {
   REGISTRY_INSTALL_RECEIPT_SCHEMA_VERSION,
   REGISTRY_MANIFEST_SCHEMA_VERSION,
   RULES,
+  RULE_FAMILY_IDS,
+  RULE_FAMILY_MEMBERS,
   RULE_TIER,
   SEVERITIES,
   SEVERITY_RANK,
@@ -9585,6 +9833,8 @@ export {
   calculateDeltaE,
   canBlock,
   canonicalBridgeContractMappings,
+  canonicalBridgeIdentityBindings,
+  canonicalBridgeIdentitySources,
   canonicalBridgeV1Schema,
   canonicalDirectionConflictsTarget,
   canonicalJson,
@@ -9599,6 +9849,8 @@ export {
   classifyComplexity,
   classifyIdentity,
   collectRegistryInstallDependencies,
+  collidingRecordDiagnostic,
+  collidingRecordDiagnostics,
   colorSimilarity,
   compareByVocabularyRank,
   compareColors,
@@ -9623,6 +9875,7 @@ export {
   compositionPatternSchema,
   computeRegistryHash,
   configDeclarationForDiagnostics,
+  configRecordShape,
   containsTailwindV4Theme,
   contractComponentsFromFragments,
   contractHash,
@@ -9633,14 +9886,17 @@ export {
   defineConfig,
   defineFragment,
   defineRecipe,
+  describePolicyExclude,
   detectOrphanGovernanceScales,
   detectSubComponentPaths,
   detectUnconsumedConfigKeys,
+  detectUnmatchedPolicyExcludes,
   diffContractDomains,
   discoverComponents,
   dtcgTokenFileSchema,
   emptyConformResult,
   evaluateGovernanceIntegrity,
+  excludeGlobToRegExp,
   executeVariantLoaders,
   explainUrlForCode,
   factEvidenceSchema,
@@ -9713,8 +9969,10 @@ export {
   isFigmaPropMapping,
   isForceIncluded,
   isPortableRepoPath,
+  isPresetSourcedRule,
   isRawHtmlAdvisoryTier,
   isReactComponent,
+  isRuleFamilyId,
   localCanonicalContractMappings,
   lowerCompositionContract,
   makeA11yNameRequiredFact,
@@ -9758,6 +10016,8 @@ export {
   makeUsageNodeFact,
   makeUsagePropResolvedFact,
   makeUsageTextChildFact,
+  markPresetSourcedRules,
+  matchPolicyExclude,
   matchesGlob,
   maxSeverity,
   mcpBlockSchema,
@@ -9783,8 +10043,10 @@ export {
   nearestSignedScaleValue,
   normalizeColor,
   normalizeConfigPath,
+  normalizeExcludePath,
   normalizeFinding,
   normalizeGovernanceConfig,
+  normalizePolicyExcludes,
   normalizeRegistryRepoPath,
   normalizeSeverity,
   normalizeStyleValue,
@@ -9792,6 +10054,7 @@ export {
   normalizeTokenGroupComment,
   normalizeTokenValue,
   normalizeViolation,
+  overriddenRecordSeverityDiagnostic,
   ownedImportEquivalents,
   parseColor,
   parseColorToRgb,
@@ -9807,9 +10070,12 @@ export {
   parseTailwindV4Theme,
   parseTokenFile,
   parseTokens,
+  policyExcludeMatchesPath,
+  policyExcludeSchema,
   portableRepoPathError,
   projectCanonicalDirectionConflicts,
   projectContractPreimage,
+  projectSupersededImportPathPreferences,
   projectV1OwnedComponentId,
   projectV1OwnedImportIdentity,
   propDefinitionSchema,
@@ -9853,6 +10119,7 @@ export {
   ruleComponentsPreferLibrary,
   ruleComponentsShadowComponent,
   ruleComponentsUnknownProp,
+  ruleFamilyMembers,
   ruleJsxPreferredComponent,
   ruleJsxPreferredImportPath,
   rulePropsInvalidValue,