@agent-teams/engineering-foundation 0.3.0 → 0.4.0

package/dist/capabilities/suppression-governance/application/model/iso-date.js

@@ -0,0 +1,27 @@
+export function isoDateToEpochDay(value) {
+    const match = /^(20\d{2})-(\d{2})-(\d{2})$/u.exec(value);
+    if (match === null) {
+        return undefined;
+    }
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    if (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day)) {
+        return undefined;
+    }
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const monthLengths = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    const monthLength = monthLengths[month - 1];
+    if (monthLength === undefined || day < 1 || day > monthLength) {
+        return undefined;
+    }
+    let total = 365 * (year - 1);
+    total += Math.floor((year - 1) / 4);
+    total -= Math.floor((year - 1) / 100);
+    total += Math.floor((year - 1) / 400);
+    for (let index = 0; index < month - 1; index += 1) {
+        total += monthLengths[index] ?? 0;
+    }
+    return total + day;
+}
+//# sourceMappingURL=iso-date.js.map

package/dist/capabilities/suppression-governance/application/model/iso-date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-date.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/model/iso-date.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClD,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,GAAG,GAAG,CAAC;AACrB,CAAC"}

package/dist/capabilities/suppression-governance/application/model/suppression-governance.d.ts

@@ -0,0 +1,35 @@
+declare const WAIVERABLE_DIRECTIVES: readonly ["ast-grep-ignore", "oxlint-disable-line", "oxlint-disable-next-line", "typescript-expect-error"];
+export type WaiverableDirective = (typeof WAIVERABLE_DIRECTIVES)[number];
+export type SuppressionDirectiveKind = WaiverableDirective | "eslint-disable" | "eslint-disable-line" | "eslint-disable-next-line" | "oxlint-disable" | "typescript-ignore" | "typescript-nocheck";
+export interface SuppressionDirective {
+    readonly kind: SuppressionDirectiveKind;
+    readonly path: string;
+    readonly line: number;
+    readonly column: number;
+    readonly rules: readonly string[];
+    readonly scope: "file" | "line";
+}
+export interface SuppressionScan {
+    readonly path: string;
+    readonly parseErrorCount: number;
+    readonly directives: readonly SuppressionDirective[];
+}
+export interface SuppressionWaiver {
+    readonly id: string;
+    readonly path: string;
+    readonly line: number;
+    readonly directive: WaiverableDirective;
+    readonly rules: readonly string[];
+    readonly owner: string;
+    readonly reason: string;
+    readonly createdOn: string;
+    readonly expiresOn: string;
+    readonly decisionRef: string;
+}
+export interface SuppressionGovernancePolicy {
+    readonly governedRoots: readonly string[];
+    readonly nonWaivableRulePrefixes: readonly string[];
+    readonly waivers: readonly SuppressionWaiver[];
+}
+export {};
+//# sourceMappingURL=suppression-governance.d.ts.map

package/dist/capabilities/suppression-governance/application/model/suppression-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-governance.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/model/suppression-governance.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,qBAAqB,YACzB,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,CACjB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAChC,mBAAmB,GACnB,gBAAgB,GAChB,qBAAqB,GACrB,0BAA0B,GAC1B,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAChD"}

package/dist/capabilities/suppression-governance/application/model/suppression-governance.js

@@ -0,0 +1,8 @@
+const WAIVERABLE_DIRECTIVES = [
+    "ast-grep-ignore",
+    "oxlint-disable-line",
+    "oxlint-disable-next-line",
+    "typescript-expect-error"
+];
+export {};
+//# sourceMappingURL=suppression-governance.js.map

package/dist/capabilities/suppression-governance/application/model/suppression-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-governance.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/model/suppression-governance.ts"],"names":[],"mappings":"AAAA,MAAM,qBAAqB,GAAG;IAC5B,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,yBAAyB;CACjB,CAAC"}

package/dist/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.d.ts

@@ -0,0 +1,8 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { SuppressionGovernancePolicy, SuppressionScan } from "../model/suppression-governance.js";
+export declare function evaluateSuppressionGovernance(input: {
+    readonly policy: SuppressionGovernancePolicy;
+    readonly scans: readonly SuppressionScan[];
+    readonly today: string;
+}): readonly FoundationDiagnostic[];
+//# sourceMappingURL=evaluate-suppression-governance.d.ts.map

package/dist/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-suppression-governance.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EAEV,2BAA2B,EAC3B,eAAe,EAGhB,MAAM,oCAAoC,CAAC;AAwK5C,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,SAAS,oBAAoB,EAAE,CA+ElC"}

package/dist/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.js

@@ -0,0 +1,196 @@
+import { isoDateToEpochDay } from "../model/iso-date.js";
+import { SUPPRESSION_GOVERNANCE_RULES } from "../rules.js";
+const BUILT_IN_PROTECTED_RULE_PREFIXES = [
+    "security.",
+    "tenancy.",
+    "tenant-isolation."
+];
+const MAXIMUM_WAIVER_LIFETIME_DAYS = 90;
+function diagnostic(input) {
+    return {
+        ruleId: input.rule.id,
+        severity: input.rule.severity,
+        subject: input.subject,
+        message: input.message,
+        location: {
+            path: input.path,
+            start: { line: input.line, column: input.column ?? 1 }
+        },
+        relatedLocations: [],
+        evidence: input.evidence ?? [],
+        remediation: input.rule.remediation,
+        requiresArchitectureReview: input.rule.requiresArchitectureReview
+    };
+}
+function locationKey(path, line) {
+    return `${path}:${line}`;
+}
+function exactRules(left, right) {
+    return (left.length === right.length &&
+        left.toSorted().every((value, index) => value === right.toSorted()[index]));
+}
+function waiverable(kind) {
+    return (kind === "ast-grep-ignore" ||
+        kind === "oxlint-disable-line" ||
+        kind === "oxlint-disable-next-line" ||
+        kind === "typescript-expect-error");
+}
+function protectedRules(directive, policy) {
+    const prefixes = [
+        ...BUILT_IN_PROTECTED_RULE_PREFIXES,
+        ...policy.nonWaivableRulePrefixes
+    ];
+    return directive.rules.filter((ruleId) => prefixes.some((prefix) => ruleId.startsWith(prefix)));
+}
+function classifyProhibited(directive, policy) {
+    const base = {
+        subject: locationKey(directive.path, directive.line),
+        path: directive.path,
+        line: directive.line,
+        column: directive.column
+    };
+    if (directive.kind.startsWith("eslint-")) {
+        return diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.legacySuppression,
+            message: `Legacy suppression directive is prohibited: ${directive.kind}.`
+        });
+    }
+    if (directive.kind === "typescript-ignore" || directive.kind === "typescript-nocheck") {
+        return diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.prohibitedTypeScriptSuppression,
+            message: `TypeScript suppression directive is prohibited: ${directive.kind}.`
+        });
+    }
+    if (directive.scope === "file") {
+        return diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.broadSuppression,
+            message: `Broad suppression directive is prohibited: ${directive.kind}.`
+        });
+    }
+    if (directive.rules.length === 0) {
+        return diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.unscopedSuppression,
+            message: `Suppression directive does not name an exact rule: ${directive.kind}.`
+        });
+    }
+    const blockedRules = protectedRules(directive, policy);
+    if (blockedRules.length > 0) {
+        return diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.protectedRuleSuppression,
+            message: `Suppression targets non-waivable rule(s): ${blockedRules.join(", ")}.`,
+            evidence: blockedRules.map((value) => ({ kind: "protected-rule", value }))
+        });
+    }
+    return undefined;
+}
+function waiverTimeDiagnostics(waiver, today) {
+    const created = isoDateToEpochDay(waiver.createdOn);
+    const expires = isoDateToEpochDay(waiver.expiresOn);
+    const current = isoDateToEpochDay(today);
+    if (created === undefined || expires === undefined || current === undefined) {
+        return [];
+    }
+    const base = {
+        subject: waiver.id,
+        path: waiver.path,
+        line: waiver.line,
+        evidence: [{ kind: "waiver-id", value: waiver.id }]
+    };
+    const diagnostics = [];
+    if (created > current) {
+        diagnostics.push(diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.futureWaiver,
+            message: `Waiver ${waiver.id} has future createdOn ${waiver.createdOn}.`
+        }));
+    }
+    if (expires < current) {
+        diagnostics.push(diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.expiredWaiver,
+            message: `Waiver ${waiver.id} expired on ${waiver.expiresOn}.`
+        }));
+    }
+    if (expires - created > MAXIMUM_WAIVER_LIFETIME_DAYS) {
+        diagnostics.push(diagnostic({
+            ...base,
+            rule: SUPPRESSION_GOVERNANCE_RULES.excessiveLifetime,
+            message: `Waiver ${waiver.id} exceeds ${MAXIMUM_WAIVER_LIFETIME_DAYS} days.`
+        }));
+    }
+    return diagnostics;
+}
+export function evaluateSuppressionGovernance(input) {
+    const diagnostics = [];
+    const waiversByLocation = new Map(input.policy.waivers.map((waiver) => [locationKey(waiver.path, waiver.line), waiver]));
+    const consumedWaivers = new Set();
+    for (const scan of input.scans) {
+        if (scan.parseErrorCount > 0) {
+            diagnostics.push(diagnostic({
+                rule: SUPPRESSION_GOVERNANCE_RULES.sourceParseError,
+                subject: scan.path,
+                message: `Source parser reported ${scan.parseErrorCount} error(s).`,
+                path: scan.path,
+                line: 1
+            }));
+            continue;
+        }
+        for (const directive of scan.directives) {
+            const key = locationKey(directive.path, directive.line);
+            const waiver = waiversByLocation.get(key);
+            const prohibited = classifyProhibited(directive, input.policy);
+            if (prohibited !== undefined) {
+                diagnostics.push(prohibited);
+                continue;
+            }
+            if (!waiverable(directive.kind)) {
+                continue;
+            }
+            if (waiver === undefined) {
+                diagnostics.push(diagnostic({
+                    rule: SUPPRESSION_GOVERNANCE_RULES.unregisteredSuppression,
+                    subject: key,
+                    message: `Suppression has no registered waiver: ${directive.kind}.`,
+                    path: directive.path,
+                    line: directive.line,
+                    column: directive.column,
+                    evidence: directive.rules.map((value) => ({ kind: "rule", value }))
+                }));
+                continue;
+            }
+            consumedWaivers.add(waiver.id);
+            if (waiver.directive !== directive.kind || !exactRules(waiver.rules, directive.rules)) {
+                diagnostics.push(diagnostic({
+                    rule: SUPPRESSION_GOVERNANCE_RULES.waiverMismatch,
+                    subject: waiver.id,
+                    message: `Waiver ${waiver.id} does not match the source directive.`,
+                    path: directive.path,
+                    line: directive.line,
+                    column: directive.column,
+                    evidence: [{ kind: "waiver-id", value: waiver.id }]
+                }));
+                continue;
+            }
+            diagnostics.push(...waiverTimeDiagnostics(waiver, input.today));
+        }
+    }
+    for (const waiver of input.policy.waivers) {
+        if (!consumedWaivers.has(waiver.id)) {
+            diagnostics.push(diagnostic({
+                rule: SUPPRESSION_GOVERNANCE_RULES.staleWaiver,
+                subject: waiver.id,
+                message: `Waiver ${waiver.id} does not match one allowed suppression.`,
+                path: waiver.path,
+                line: waiver.line,
+                evidence: [{ kind: "waiver-id", value: waiver.id }]
+            }));
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=evaluate-suppression-governance.js.map

package/dist/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-suppression-governance.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/policies/evaluate-suppression-governance.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQzD,OAAO,EACL,4BAA4B,EAE7B,MAAM,aAAa,CAAC;AAErB,MAAM,gCAAgC,GAAG;IACvC,WAAW;IACX,UAAU;IACV,mBAAmB;CACX,CAAC;AACX,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,SAAS,UAAU,CAAC,KAQnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE;SACvD;QACD,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAwB;IACnE,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAkC;IACpD,OAAO,CACL,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,0BAA0B;QACnC,IAAI,KAAK,yBAAyB,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,SAA+B,EAC/B,MAAmC;IAEnC,MAAM,QAAQ,GAAG;QACf,GAAG,gCAAgC;QACnC,GAAG,MAAM,CAAC,uBAAuB;KAClC,CAAC;IACF,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAA+B,EAC/B,MAAmC;IAEnC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;QACpD,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC;YAChB,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,iBAAiB;YACpD,OAAO,EAAE,+CAA+C,SAAS,CAAC,IAAI,GAAG;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,SAAS,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACtF,OAAO,UAAU,CAAC;YAChB,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,+BAA+B;YAClE,OAAO,EAAE,mDAAmD,SAAS,CAAC,IAAI,GAAG;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;YAChB,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,gBAAgB;YACnD,OAAO,EAAE,8CAA8C,SAAS,CAAC,IAAI,GAAG;SACzE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC;YAChB,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,mBAAmB;YACtD,OAAO,EAAE,sDAAsD,SAAS,CAAC,IAAI,GAAG;SACjF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC;YAChB,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,wBAAwB;YAC3D,OAAO,EAAE,6CAA6C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChF,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyB,EACzB,KAAa;IAEb,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;KACpD,CAAC;IACF,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,YAAY;YAC/C,OAAO,EAAE,UAAU,MAAM,CAAC,EAAE,yBAAyB,MAAM,CAAC,SAAS,GAAG;SACzE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,aAAa;YAChD,OAAO,EAAE,UAAU,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,SAAS,GAAG;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,OAAO,GAAG,4BAA4B,EAAE,CAAC;QACrD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,GAAG,IAAI;YACP,IAAI,EAAE,4BAA4B,CAAC,iBAAiB;YACpD,OAAO,EAAE,UAAU,MAAM,CAAC,EAAE,YAAY,4BAA4B,QAAQ;SAC7E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CACtF,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,4BAA4B,CAAC,gBAAgB;gBACnD,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,0BAA0B,IAAI,CAAC,eAAe,YAAY;gBACnE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,CAAC;aACR,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,4BAA4B,CAAC,uBAAuB;oBAC1D,OAAO,EAAE,GAAG;oBACZ,OAAO,EAAE,yCAAyC,SAAS,CAAC,IAAI,GAAG;oBACnE,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;iBACpE,CAAC,CACH,CAAC;gBACF,SAAS;YACX,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtF,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,4BAA4B,CAAC,cAAc;oBACjD,OAAO,EAAE,MAAM,CAAC,EAAE;oBAClB,OAAO,EAAE,UAAU,MAAM,CAAC,EAAE,uCAAuC;oBACnE,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBACpD,CAAC,CACH,CAAC;gBACF,SAAS;YACX,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,4BAA4B,CAAC,WAAW;gBAC9C,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,OAAO,EAAE,UAAU,MAAM,CAAC,EAAE,0CAA0C;gBACtE,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACpD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/capabilities/suppression-governance/application/ports/calendar-clock.d.ts

@@ -0,0 +1,4 @@
+export interface CalendarClock {
+    today(): string;
+}
+//# sourceMappingURL=calendar-clock.d.ts.map

package/dist/capabilities/suppression-governance/application/ports/calendar-clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar-clock.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/ports/calendar-clock.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,KAAK,IAAI,MAAM,CAAC;CACjB"}

package/dist/capabilities/suppression-governance/application/ports/calendar-clock.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=calendar-clock.js.map

package/dist/capabilities/suppression-governance/application/ports/calendar-clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar-clock.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/ports/calendar-clock.ts"],"names":[],"mappings":""}

package/dist/capabilities/suppression-governance/application/ports/suppression-scanner.d.ts

@@ -0,0 +1,6 @@
+import type { SourceFileSnapshot } from "../../../../source-inventory/application/model/source-file-snapshot.js";
+import type { SuppressionScan } from "../model/suppression-governance.js";
+export interface SuppressionScanner {
+    scan(file: SourceFileSnapshot): SuppressionScan;
+}
+//# sourceMappingURL=suppression-scanner.d.ts.map

package/dist/capabilities/suppression-governance/application/ports/suppression-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-scanner.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/ports/suppression-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wEAAwE,CAAC;AACjH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAC;CACjD"}

package/dist/capabilities/suppression-governance/application/ports/suppression-scanner.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=suppression-scanner.js.map

package/dist/capabilities/suppression-governance/application/ports/suppression-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-scanner.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/ports/suppression-scanner.ts"],"names":[],"mappings":""}

package/dist/capabilities/suppression-governance/application/rules.d.ts

@@ -0,0 +1,25 @@
+import type { DiagnosticSeverity } from "../../../check-contract.js";
+export interface SuppressionGovernanceRuleMetadata {
+    readonly id: string;
+    readonly severity: DiagnosticSeverity;
+    readonly rationale: string;
+    readonly remediation: string;
+    readonly documentation: string;
+    readonly requiresArchitectureReview: boolean;
+}
+export declare const SUPPRESSION_GOVERNANCE_RULES: Readonly<{
+    broadSuppression: SuppressionGovernanceRuleMetadata;
+    excessiveLifetime: SuppressionGovernanceRuleMetadata;
+    expiredWaiver: SuppressionGovernanceRuleMetadata;
+    futureWaiver: SuppressionGovernanceRuleMetadata;
+    legacySuppression: SuppressionGovernanceRuleMetadata;
+    prohibitedTypeScriptSuppression: SuppressionGovernanceRuleMetadata;
+    protectedRuleSuppression: SuppressionGovernanceRuleMetadata;
+    sourceParseError: SuppressionGovernanceRuleMetadata;
+    staleWaiver: SuppressionGovernanceRuleMetadata;
+    unregisteredSuppression: SuppressionGovernanceRuleMetadata;
+    unscopedSuppression: SuppressionGovernanceRuleMetadata;
+    waiverMismatch: SuppressionGovernanceRuleMetadata;
+}>;
+export declare const SUPPRESSION_GOVERNANCE_RULES_BY_ID: ReadonlyMap<string, SuppressionGovernanceRuleMetadata>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/capabilities/suppression-governance/application/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/suppression-governance/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAkBD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;EA8DvC,CAAC;AAEH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAC1D,MAAM,EACN,iCAAiC,CAGlC,CAAC"}

package/dist/capabilities/suppression-governance/application/rules.js

@@ -0,0 +1,26 @@
+function rule(suffix, rationale, remediation, requiresArchitectureReview = false) {
+    return Object.freeze({
+        id: `quality.suppression-governance.${suffix}`,
+        severity: "error",
+        rationale,
+        remediation,
+        documentation: "docs/architecture/suppression-governance.md",
+        requiresArchitectureReview
+    });
+}
+export const SUPPRESSION_GOVERNANCE_RULES = Object.freeze({
+    broadSuppression: rule("broad-suppression", "File and region suppressions hide unrelated future diagnostics.", "Replace the directive with an exact line-scoped suppression and waiver."),
+    excessiveLifetime: rule("excessive-waiver-lifetime", "A temporary waiver must not silently become permanent technical debt.", "Shorten the waiver lifetime to at most 90 calendar days."),
+    expiredWaiver: rule("expired-waiver", "Expired exceptions must be removed or explicitly reconsidered.", "Remove the suppression or approve a new bounded waiver."),
+    futureWaiver: rule("future-waiver", "A waiver cannot be created in the future relative to the build clock.", "Correct createdOn using the current UTC calendar date."),
+    legacySuppression: rule("legacy-suppression", "ESLint compatibility directives create a second suppression vocabulary.", "Use an Oxlint directive and register an exact waiver."),
+    prohibitedTypeScriptSuppression: rule("prohibited-typescript-suppression", "TypeScript ignore and nocheck directives can hide unrelated compiler failures.", "Remove the directive; use a line-scoped @ts-expect-error waiver only when necessary."),
+    protectedRuleSuppression: rule("protected-rule-suppression", "Security and tenant-isolation rules are not waivable.", "Fix the violation or change the governing architecture through an accepted decision.", true),
+    sourceParseError: rule("source-parse-error", "Suppression evidence is incomplete when governed source does not parse.", "Fix the source syntax before evaluating suppression governance."),
+    staleWaiver: rule("stale-waiver", "A waiver without one exact suppression is stale or incorrectly scoped.", "Remove the waiver or align its path, line, directive, and rules with the source."),
+    unregisteredSuppression: rule("unregistered-suppression", "Every allowed suppression needs accountable, expiring ownership.", "Register an exact waiver with owner, reason, expiry, and decision reference."),
+    unscopedSuppression: rule("unscoped-suppression", "A suppression without explicit rule IDs can hide arbitrary diagnostics.", "List every suppressed rule explicitly."),
+    waiverMismatch: rule("waiver-mismatch", "A waiver must describe the exact directive and exact rule set at its location.", "Update the waiver or suppression so their directive and rules match exactly.")
+});
+export const SUPPRESSION_GOVERNANCE_RULES_BY_ID = new Map(Object.values(SUPPRESSION_GOVERNANCE_RULES).map((metadata) => [metadata.id, metadata]));
+//# sourceMappingURL=rules.js.map

package/dist/capabilities/suppression-governance/application/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/capabilities/suppression-governance/application/rules.ts"],"names":[],"mappings":"AAWA,SAAS,IAAI,CACX,MAAc,EACd,SAAiB,EACjB,WAAmB,EACnB,0BAA0B,GAAG,KAAK;IAElC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,kCAAkC,MAAM,EAAE;QAC9C,QAAQ,EAAE,OAAO;QACjB,SAAS;QACT,WAAW;QACX,aAAa,EAAE,6CAA6C;QAC5D,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,gBAAgB,EAAE,IAAI,CACpB,mBAAmB,EACnB,iEAAiE,EACjE,yEAAyE,CAC1E;IACD,iBAAiB,EAAE,IAAI,CACrB,2BAA2B,EAC3B,uEAAuE,EACvE,0DAA0D,CAC3D;IACD,aAAa,EAAE,IAAI,CACjB,gBAAgB,EAChB,gEAAgE,EAChE,yDAAyD,CAC1D;IACD,YAAY,EAAE,IAAI,CAChB,eAAe,EACf,uEAAuE,EACvE,wDAAwD,CACzD;IACD,iBAAiB,EAAE,IAAI,CACrB,oBAAoB,EACpB,yEAAyE,EACzE,uDAAuD,CACxD;IACD,+BAA+B,EAAE,IAAI,CACnC,mCAAmC,EACnC,gFAAgF,EAChF,sFAAsF,CACvF;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,uDAAuD,EACvD,sFAAsF,EACtF,IAAI,CACL;IACD,gBAAgB,EAAE,IAAI,CACpB,oBAAoB,EACpB,yEAAyE,EACzE,iEAAiE,CAClE;IACD,WAAW,EAAE,IAAI,CACf,cAAc,EACd,wEAAwE,EACxE,kFAAkF,CACnF;IACD,uBAAuB,EAAE,IAAI,CAC3B,0BAA0B,EAC1B,kEAAkE,EAClE,8EAA8E,CAC/E;IACD,mBAAmB,EAAE,IAAI,CACvB,sBAAsB,EACtB,yEAAyE,EACzE,wCAAwC,CACzC;IACD,cAAc,EAAE,IAAI,CAClB,iBAAiB,EACjB,gFAAgF,EAChF,8EAA8E,CAC/E;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAG3C,IAAI,GAAG,CACT,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACvF,CAAC"}

package/dist/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.d.ts

@@ -0,0 +1,15 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { SourceTreeReader } from "../../../../source-inventory/application/ports/source-tree-reader.js";
+import type { SuppressionGovernancePolicy } from "../model/suppression-governance.js";
+import type { CalendarClock } from "../ports/calendar-clock.js";
+import type { SuppressionScanner } from "../ports/suppression-scanner.js";
+export declare function analyzeSuppressionGovernance(input: {
+    readonly consumerRoot: string;
+    readonly policy: SuppressionGovernancePolicy;
+    readonly signal?: AbortSignal;
+}, dependencies: {
+    readonly clock: CalendarClock;
+    readonly scanner: SuppressionScanner;
+    readonly sourceReader: SourceTreeReader;
+}): Promise<readonly FoundationDiagnostic[]>;
+//# sourceMappingURL=analyze-suppression-governance.d.ts.map

package/dist/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-suppression-governance.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sEAAsE,CAAC;AAE7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,wBAAsB,4BAA4B,CAChD,KAAK,EAAE;IACL,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,EACD,YAAY,EAAE;IACZ,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC,GACA,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAe1C"}

package/dist/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.js

@@ -0,0 +1,15 @@
+import { assertNotCancelled } from "../../../../strict-yaml.js";
+import { evaluateSuppressionGovernance } from "../policies/evaluate-suppression-governance.js";
+export async function analyzeSuppressionGovernance(input, dependencies) {
+    const files = await dependencies.sourceReader.read(input.consumerRoot, input.policy.governedRoots, input.signal);
+    const scans = files.map((file) => {
+        assertNotCancelled(input.signal);
+        return dependencies.scanner.scan(file);
+    });
+    return evaluateSuppressionGovernance({
+        policy: input.policy,
+        scans,
+        today: dependencies.clock.today()
+    });
+}
+//# sourceMappingURL=analyze-suppression-governance.js.map

package/dist/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-suppression-governance.js","sourceRoot":"","sources":["../../../../../src/capabilities/suppression-governance/application/use-cases/analyze-suppression-governance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAIC,EACD,YAIC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,IAAI,CAChD,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,MAAM,CAAC,aAAa,EAC1B,KAAK,CAAC,MAAM,CACb,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,OAAO,6BAA6B,CAAC;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE;KAClC,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/suppression-governance/contract/config.d.ts

@@ -0,0 +1,5 @@
+import type { SuppressionGovernancePolicy } from "../application/model/suppression-governance.js";
+export declare const CAPABILITY_ID: "quality.suppression-governance";
+export declare const CAPABILITY_CONFIG_SCHEMA_VERSION: 1;
+export declare function loadCapabilityConfig(consumerRoot: string, configPath: string, signal?: AbortSignal): Promise<SuppressionGovernancePolicy>;
+//# sourceMappingURL=config.d.ts.map

package/dist/capabilities/suppression-governance/contract/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/suppression-governance/contract/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,2BAA2B,EAG5B,MAAM,gDAAgD,CAAC;AAExD,eAAO,MAAM,aAAa,EAAG,gCAAyC,CAAC;AACvE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AA2F3D,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,2BAA2B,CAAC,CA8BtC"}

package/dist/capabilities/suppression-governance/contract/config.js

@@ -0,0 +1,108 @@
+import { CapabilityInputError } from "../../../capability-runtime.js";
+import { assertSchema } from "../../../schema-catalog.js";
+import { assertRepositoryRelativePath, loadStrictYamlFile } from "../../../strict-yaml.js";
+import { isoDateToEpochDay } from "../application/model/iso-date.js";
+export const CAPABILITY_ID = "quality.suppression-governance";
+export const CAPABILITY_CONFIG_SCHEMA_VERSION = 1;
+function inputError(message) {
+    throw new CapabilityInputError({
+        code: "SUPPRESSION_GOVERNANCE_CONFIG_INVALID",
+        message,
+        phase: "suppression-governance-config",
+        retryable: false
+    });
+}
+function record(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        inputError(`${field} must be an object.`);
+    }
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== "string") {
+        inputError(`${field} must be a string.`);
+    }
+    return value;
+}
+function integer(value, field) {
+    if (!Number.isInteger(value)) {
+        inputError(`${field} must be an integer.`);
+    }
+    return value;
+}
+function strings(value, field) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        inputError(`${field} must be an array of strings.`);
+    }
+    return Object.freeze(value);
+}
+function pathInside(path, root) {
+    return path === root || path.startsWith(`${root}/`);
+}
+function mapWaiver(value, index) {
+    const field = `waivers[${index}]`;
+    const waiver = record(value, field);
+    const path = string(waiver["path"], `${field}.path`);
+    assertRepositoryRelativePath(path, "suppression-governance-config");
+    const createdOn = string(waiver["createdOn"], `${field}.createdOn`);
+    const expiresOn = string(waiver["expiresOn"], `${field}.expiresOn`);
+    const createdDay = isoDateToEpochDay(createdOn);
+    const expiryDay = isoDateToEpochDay(expiresOn);
+    if (createdDay === undefined || expiryDay === undefined) {
+        inputError(`${field} contains an invalid calendar date.`);
+    }
+    if (createdDay > expiryDay) {
+        inputError(`${field}.createdOn must not be after expiresOn.`);
+    }
+    return Object.freeze({
+        id: string(waiver["id"], `${field}.id`),
+        path,
+        line: integer(waiver["line"], `${field}.line`),
+        directive: string(waiver["directive"], `${field}.directive`),
+        rules: Object.freeze(strings(waiver["rules"], `${field}.rules`).toSorted()),
+        owner: string(waiver["owner"], `${field}.owner`),
+        reason: string(waiver["reason"], `${field}.reason`),
+        createdOn,
+        expiresOn,
+        decisionRef: string(waiver["decisionRef"], `${field}.decisionRef`)
+    });
+}
+function validatePolicy(policy) {
+    const waiverIds = new Set();
+    const waiverLocations = new Set();
+    for (const waiver of policy.waivers) {
+        if (waiverIds.has(waiver.id)) {
+            inputError(`Waiver ID is duplicated: ${waiver.id}.`);
+        }
+        waiverIds.add(waiver.id);
+        const location = `${waiver.path}:${waiver.line}`;
+        if (waiverLocations.has(location)) {
+            inputError(`Only one waiver may own a source line: ${location}.`);
+        }
+        waiverLocations.add(location);
+        if (!policy.governedRoots.some((root) => pathInside(waiver.path, root))) {
+            inputError(`Waiver path is outside governed roots: ${waiver.path}.`);
+        }
+    }
+}
+export async function loadCapabilityConfig(consumerRoot, configPath, signal) {
+    const input = await loadStrictYamlFile(consumerRoot, configPath, "suppression-governance-config", signal);
+    await assertSchema("quality-suppression-governance/v1", input, "suppression-governance-config");
+    const root = record(input, "suppression governance config");
+    const governedRoots = strings(root["governedRoots"], "governedRoots");
+    for (const governedRoot of governedRoots) {
+        assertRepositoryRelativePath(governedRoot, "suppression-governance-config");
+    }
+    const waiverInputs = root["waivers"];
+    if (!Array.isArray(waiverInputs)) {
+        inputError("waivers must be an array.");
+    }
+    const policy = Object.freeze({
+        governedRoots: Object.freeze([...governedRoots]),
+        nonWaivableRulePrefixes: Object.freeze(strings(root["nonWaivableRulePrefixes"], "nonWaivableRulePrefixes")),
+        waivers: Object.freeze(waiverInputs.map(mapWaiver))
+    });
+    validatePolicy(policy);
+    return policy;
+}
+//# sourceMappingURL=config.js.map

package/dist/capabilities/suppression-governance/contract/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/suppression-governance/contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAOrE,MAAM,CAAC,MAAM,aAAa,GAAG,gCAAyC,CAAC;AACvE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAE3D,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI,EAAE,uCAAuC;QAC7C,OAAO;QACP,KAAK,EAAE,+BAA+B;QACtC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,UAAU,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACrD,4BAA4B,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACxD,UAAU,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;QAC3B,UAAU,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,CAAC;QACvC,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,YAAY,CAAwB;QACnF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QACnD,SAAS;QACT,SAAS;QACT,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAmC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,4BAA4B,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,0CAA0C,QAAQ,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,UAAU,CAAC,0CAA0C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,YAAY,EACZ,UAAU,EACV,+BAA+B,EAC/B,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAChB,mCAAmC,EACnC,KAAK,EACL,+BAA+B,CAChC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;IACtE,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,4BAA4B,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAgC,MAAM,CAAC,MAAM,CAAC;QACxD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;QAChD,uBAAuB,EAAE,MAAM,CAAC,MAAM,CACpC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CACpE;QACD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/capabilities/suppression-governance/module.d.ts

@@ -0,0 +1,5 @@
+import { type CapabilityDefinition } from "../../capability-runtime.js";
+import { SUPPRESSION_GOVERNANCE_RULES_BY_ID } from "./application/rules.js";
+export { SUPPRESSION_GOVERNANCE_RULES_BY_ID };
+export declare function createSuppressionGovernanceCapability(): CapabilityDefinition;
+//# sourceMappingURL=module.d.ts.map

package/dist/capabilities/suppression-governance/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/suppression-governance/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAQ5E,OAAO,EAAE,kCAAkC,EAAE,CAAC;AAE9C,wBAAgB,qCAAqC,IAAI,oBAAoB,CAsD5E"}