@usefragments/core 1.8.0 → 1.9.0

package/dist/codes/index.d.ts

@@ -1,5 +1,5 @@
 import { Severity } from '../severity.js';
-import { n as Violation, F as Finding } from '../index-Cxk3SOQP.js';
+import { n as Violation, F as Finding } from '../index-DtHxs0Pf.js';
 import 'zod';
 
 declare const EXPLAIN_URL_BASE = "https://usefragments.com/errors/";

package/dist/codes/index.js

@@ -6,7 +6,7 @@ import {
   byCode,
   byRuleId,
   explainUrlForCode
-} from "../chunk-UUREQ4HD.js";
+} from "../chunk-DGHZQTLH.js";
 import "../chunk-JNBFJ34I.js";
 import "../chunk-EIYNNS77.js";
 import "../chunk-V4VQB57N.js";

package/dist/{index-Cxk3SOQP.d.ts → index-DtHxs0Pf.d.ts}

@@ -247,6 +247,12 @@ declare const findingSchema: z.ZodObject<{
     helpUrl: z.ZodOptional<z.ZodString>;
     message: z.ZodString;
     fingerprint: z.ZodString;
+    /**
+     * Fingerprint this finding carried before a fingerprint-identity migration.
+     * Emitted only by migrated rules during the grace window so baseline
+     * records keyed on the legacy hash keep matching instead of churning.
+     */
+    previousFingerprint: z.ZodOptional<z.ZodString>;
     location: z.ZodObject<{
         file: z.ZodString;
         line: z.ZodNumber;
@@ -442,6 +448,7 @@ declare const findingSchema: z.ZodObject<{
         matchedGlob: string;
     } | undefined;
     helpUrl?: string | undefined;
+    previousFingerprint?: string | undefined;
     evidenceGrade?: EvidenceGrade | undefined;
     attributes?: Record<string, unknown> | undefined;
 }, {
@@ -500,6 +507,7 @@ declare const findingSchema: z.ZodObject<{
         matchedGlob: string;
     } | undefined;
     helpUrl?: string | undefined;
+    previousFingerprint?: string | undefined;
     evidenceGrade?: EvidenceGrade | undefined;
     attributes?: Record<string, unknown> | undefined;
 }>;
@@ -642,6 +650,12 @@ declare const validatorResultSchema: z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -837,6 +851,7 @@ declare const validatorResultSchema: z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -895,6 +910,7 @@ declare const validatorResultSchema: z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -995,6 +1011,7 @@ declare const validatorResultSchema: z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -1083,6 +1100,7 @@ declare const validatorResultSchema: z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -1184,6 +1202,12 @@ declare const governanceVerdictSchema: z.ZodObject<{
             helpUrl: z.ZodOptional<z.ZodString>;
             message: z.ZodString;
             fingerprint: z.ZodString;
+            /**
+             * Fingerprint this finding carried before a fingerprint-identity migration.
+             * Emitted only by migrated rules during the grace window so baseline
+             * records keyed on the legacy hash keep matching instead of churning.
+             */
+            previousFingerprint: z.ZodOptional<z.ZodString>;
             location: z.ZodObject<{
                 file: z.ZodString;
                 line: z.ZodNumber;
@@ -1379,6 +1403,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }, {
@@ -1437,6 +1462,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }>, "many">>;
@@ -1537,6 +1563,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }[] | undefined;
@@ -1625,6 +1652,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }[] | undefined;
@@ -1743,6 +1771,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }[] | undefined;
@@ -1843,6 +1872,7 @@ declare const governanceVerdictSchema: z.ZodObject<{
                 matchedGlob: string;
             } | undefined;
             helpUrl?: string | undefined;
+            previousFingerprint?: string | undefined;
             evidenceGrade?: EvidenceGrade | undefined;
             attributes?: Record<string, unknown> | undefined;
         }[] | undefined;
@@ -2122,6 +2152,12 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -2317,6 +2353,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -2375,6 +2412,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -2607,6 +2645,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -2750,6 +2789,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -2919,6 +2959,12 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -3114,6 +3160,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -3172,6 +3219,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -3404,6 +3452,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -3547,6 +3596,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -3716,6 +3766,12 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -3911,6 +3967,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -3969,6 +4026,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -4215,6 +4273,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -4358,6 +4417,7 @@ declare const agentFormatSchema: z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -4643,6 +4703,12 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -4838,6 +4904,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -4896,6 +4963,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -5128,6 +5196,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -5271,6 +5340,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -5440,6 +5510,12 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -5635,6 +5711,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -5693,6 +5770,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -5925,6 +6003,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -6068,6 +6147,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -6237,6 +6317,12 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
         helpUrl: z.ZodOptional<z.ZodString>;
         message: z.ZodString;
         fingerprint: z.ZodString;
+        /**
+         * Fingerprint this finding carried before a fingerprint-identity migration.
+         * Emitted only by migrated rules during the grace window so baseline
+         * records keyed on the legacy hash keep matching instead of churning.
+         */
+        previousFingerprint: z.ZodOptional<z.ZodString>;
         location: z.ZodObject<{
             file: z.ZodString;
             line: z.ZodNumber;
@@ -6432,6 +6518,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }, {
@@ -6490,6 +6577,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }>, "many">>;
@@ -6736,6 +6824,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;
@@ -6879,6 +6968,7 @@ declare const agentOutputSchema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
             matchedGlob: string;
         } | undefined;
         helpUrl?: string | undefined;
+        previousFingerprint?: string | undefined;
         evidenceGrade?: EvidenceGrade | undefined;
         attributes?: Record<string, unknown> | undefined;
     }[] | undefined;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { GOVERNANCE_TELEMETRY_FIELDS, GOVERNANCE_TELEMETRY_SOURCE_DISCLOSURE, GOVERNANCE_TELEMETRY_TOP_LEVEL_FIELDS, GovernanceTelemetryCarriage, GovernanceTelemetryField, GovernanceTelemetryTopLevelField } from './governance-telemetry.js';
-import { F as Finding, A as AgentFormat, E as EvidenceGrade, a as FindingFix } from './index-Cxk3SOQP.js';
-export { b as AGENT_FORMAT_SCHEMA_VERSION, c as AgentErrorEnvelope, d as AgentOutput, G as CanonicalGovernanceVerdict, e as EVIDENCE_ORDER, f as FindingReplaceClassTokenFix, g as FindingReplaceComponentFix, h as FindingReplaceImportFix, i as FindingReplacePropValueFix, j as FindingReplaceStyleValueFix, k as Fix, l as GovernanceVerdictMetadata, I as InspectClaim, m as InspectClaimTier, S as SuppressionDirective, V as ValidatorResult, n as Violation, o as agentErrorEnvelopeSchema, p as agentFormatSchema, q as agentIntegritySchema, r as agentOutputSchema, s as canBlock, t as factEvidenceSchema, u as factLocationSchema, v as findingFixSchema, w as findingReplaceClassTokenFixSchema, x as findingReplaceComponentFixSchema, y as findingReplaceImportFixSchema, z as findingReplacePropValueFixSchema, B as findingReplaceStyleValueFixSchema, C as findingSchema, D as fixSchema, H as governanceVerdictMetadataSchema, J as governanceVerdictSchema, K as normalizeFinding, L as normalizeSeverity, M as normalizeViolation, N as suppressionDirectiveSchema, O as validatorResultSchema, P as violationSchema } from './index-Cxk3SOQP.js';
+import { F as Finding, A as AgentFormat, E as EvidenceGrade, a as FindingFix } from './index-DtHxs0Pf.js';
+export { b as AGENT_FORMAT_SCHEMA_VERSION, c as AgentErrorEnvelope, d as AgentOutput, G as CanonicalGovernanceVerdict, e as EVIDENCE_ORDER, f as FindingReplaceClassTokenFix, g as FindingReplaceComponentFix, h as FindingReplaceImportFix, i as FindingReplacePropValueFix, j as FindingReplaceStyleValueFix, k as Fix, l as GovernanceVerdictMetadata, I as InspectClaim, m as InspectClaimTier, S as SuppressionDirective, V as ValidatorResult, n as Violation, o as agentErrorEnvelopeSchema, p as agentFormatSchema, q as agentIntegritySchema, r as agentOutputSchema, s as canBlock, t as factEvidenceSchema, u as factLocationSchema, v as findingFixSchema, w as findingReplaceClassTokenFixSchema, x as findingReplaceComponentFixSchema, y as findingReplaceImportFixSchema, z as findingReplacePropValueFixSchema, B as findingReplaceStyleValueFixSchema, C as findingSchema, D as fixSchema, H as governanceVerdictMetadataSchema, J as governanceVerdictSchema, K as normalizeFinding, L as normalizeSeverity, M as normalizeViolation, N as suppressionDirectiveSchema, O as validatorResultSchema, P as violationSchema } from './index-DtHxs0Pf.js';
 import { Severity } from './severity.js';
 export { SEVERITIES, SEVERITY_RANK, SEVERITY_WEIGHTS, SeverityLevel, compareSeverity, maxSeverity, severityLevel, severitySchema, sortBySeverity } from './severity.js';
 export { BridgeViolationInput, CODES, CodeCategory, CodeLifecycle, EXPLAIN_URL_BASE, FuiCode, bridgeSourceViolation, bridgeSourceViolations, byCode, byRuleId, explainUrlForCode } from './codes/index.js';
@@ -11682,6 +11682,14 @@ interface MakeFindingInput {
     evidence: FactEvidence[];
     evidenceGrade?: EvidenceGrade;
     fingerprintIdentity: Record<string, unknown>;
+    /**
+     * Legacy identity tuple from before a fingerprint migration. When present,
+     * the finding also carries `previousFingerprint` (the legacy hash) so
+     * baseline classification can match records keyed on the old hash during
+     * the grace window. Position keys are permitted here — legacy identities
+     * are reproduced verbatim, contract violations included.
+     */
+    previousFingerprintIdentity?: Record<string, unknown>;
     fix?: FindingFix;
     attributes?: Record<string, unknown>;
 }

package/dist/index.js

@@ -159,7 +159,7 @@ import {
   suppressionDirectiveSchema,
   validatorResultSchema,
   violationSchema
-} from "./chunk-UUREQ4HD.js";
+} from "./chunk-DGHZQTLH.js";
 import {
   OWNED_PACKAGE_IDENTITY_EPOCH,
   OWNED_PACKAGE_IDENTITY_SOURCE_SHA256,
@@ -4682,13 +4682,21 @@ function isAriaHidden(props) {
 }
 
 // src/rules/finding.ts
+var POSITION_IDENTITY_KEYS = ["line", "column", "endLine", "endColumn", "offset", "location"];
 function makeFinding(input) {
   if (input.evidence.length === 0) {
     throw new Error(`makeFinding(${input.ruleId}): findings must carry at least one evidence fact`);
   }
+  const positionKeys = POSITION_IDENTITY_KEYS.filter((key) => key in input.fingerprintIdentity);
+  if (positionKeys.length > 0) {
+    throw new Error(
+      `makeFinding(${input.ruleId}): fingerprintIdentity must not contain position keys (${positionKeys.join(", ")}) \u2014 fingerprints hash what's wrong, never where it sits. Use a source-order occurrence index for repeats of the same identity.`
+    );
+  }
   const fingerprint = hash64Hex(
     canonicalJson({ ruleId: input.ruleId, ...input.fingerprintIdentity })
   );
+  const previousFingerprint = input.previousFingerprintIdentity ? hash64Hex(canonicalJson({ ruleId: input.ruleId, ...input.previousFingerprintIdentity })) : void 0;
   const code = byRuleId.get(input.ruleId);
   return normalizeFinding({
     ruleId: input.ruleId,
@@ -4698,6 +4706,7 @@ function makeFinding(input) {
     helpUrl: code?.explainUrl,
     message: input.message,
     fingerprint,
+    ...previousFingerprint !== void 0 ? { previousFingerprint } : {},
     location: input.location,
     evidence: input.evidence,
     evidenceGrade: input.evidenceGrade ?? "source_backed",
@@ -6746,6 +6755,7 @@ function ruleJsxPreferredImportPath(ix) {
   if (policies.length === 0) return [];
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
+  const occurrences = /* @__PURE__ */ new Map();
   for (const usage of ix.byKind("usage_import")) {
     const bridgeGoverned = policies.some((policy) => bridgeGovernsUnderlyingImport(policy, usage));
     const matches = policies.filter((policy) => {
@@ -6766,6 +6776,9 @@ function ruleJsxPreferredImportPath(ix) {
       const key = `${policy.id}\0${usage.file}\0${usage.source}\0${usage.location.line}\0${usage.location.column}\0${importedIdentity}`;
       if (seen.has(key)) continue;
       seen.add(key);
+      const identityKey = `${usage.file}\0${usage.source}\0${policy.to}\0${importedIdentity}`;
+      const occurrence = occurrences.get(identityKey) ?? 0;
+      occurrences.set(identityKey, occurrence + 1);
       findings.push(
         makeFinding({
           ruleId: RULE_ID8,
@@ -6775,6 +6788,15 @@ function ruleJsxPreferredImportPath(ix) {
           location: usage.location,
           evidence: ix.evidence([usage.id, policy.id]),
           fingerprintIdentity: {
+            file: usage.file,
+            from: usage.source,
+            to: policy.to,
+            imported: policy.imported,
+            occurrence
+          },
+          // Grace window (baseline v1 → v2): the pre-migration hash keyed on
+          // line/column. Drop with the v1 dual-match after one release.
+          previousFingerprintIdentity: {
             file: usage.file,
             from: usage.source,
             to: policy.to,