@luckychen1993/pm-mcp 0.1.1

package/dist/polyglot-ast.js

@@ -0,0 +1,329 @@
+import { parse, registerDynamicLanguage } from "@ast-grep/napi";
+import csharpGrammar from "@ast-grep/lang-csharp";
+import goGrammar from "@ast-grep/lang-go";
+import javaGrammar from "@ast-grep/lang-java";
+import kotlinGrammar from "@ast-grep/lang-kotlin";
+import pythonGrammar from "@ast-grep/lang-python";
+import rustGrammar from "@ast-grep/lang-rust";
+export const POLYGLOT_AST_LANGUAGES = ["python", "go", "rust", "java", "kotlin", "csharp"];
+const NAPI_VERSION = "0.45.3";
+const GRAMMAR_VERSIONS = {
+    python: "0.0.6",
+    go: "0.0.6",
+    rust: "0.0.7",
+    java: "0.0.7",
+    kotlin: "0.0.7",
+    csharp: "0.0.6",
+};
+// ast-grep requires one process-wide registration call. ESM module evaluation is
+// cached, so importing this provider repeatedly cannot re-register the grammars.
+registerDynamicLanguage({
+    python: pythonGrammar,
+    go: goGrammar,
+    rust: rustGrammar,
+    java: javaGrammar,
+    kotlin: kotlinGrammar,
+    csharp: csharpGrammar,
+});
+const STRING_KINDS = new Set([
+    "string", "string_literal", "interpreted_string_literal", "raw_string_literal",
+]);
+function isSupportedLanguage(value) {
+    return POLYGLOT_AST_LANGUAGES.includes(value);
+}
+export function supportsPolyglotAstLanguage(value) {
+    return isSupportedLanguage(value);
+}
+function analyzerFor(language) {
+    const grammarVersion = GRAMMAR_VERSIONS[language];
+    return {
+        id: `tree-sitter:${language}@${grammarVersion}`,
+        family: "structured-parser",
+        assurance: "ast",
+        engine: "ast-grep Tree-sitter",
+        version: `${NAPI_VERSION}+grammar-${grammarVersion}`,
+        capabilities: ["imports", "calls", "contracts", "ffi"],
+    };
+}
+function allNodes(root) {
+    const nodes = [];
+    const visit = (node) => {
+        nodes.push(node);
+        for (const child of node.children())
+            visit(child);
+    };
+    visit(root);
+    return nodes;
+}
+function syntaxDiagnostics(root) {
+    const diagnostics = [];
+    for (const node of allNodes(root).slice(1)) {
+        if (node.kind() !== "ERROR" && node.text().length > 0)
+            continue;
+        const start = node.range().start;
+        const label = node.kind() === "ERROR" ? "syntax error" : `missing ${node.kind()}`;
+        diagnostics.push(`${start.line + 1}:${start.column + 1} ${label}`);
+    }
+    return [...new Set(diagnostics)];
+}
+function stringValue(text) {
+    const trimmed = text.trim();
+    const prefixed = trimmed.match(/^(?:[rubf]+|@)?("""|'''|"|'|`)([\s\S]*)(?:\1)$/i);
+    if (!prefixed)
+        return null;
+    const quote = prefixed[1];
+    const body = prefixed[2];
+    if (quote === '"') {
+        try {
+            return JSON.parse(`"${body}"`);
+        }
+        catch {
+            return body;
+        }
+    }
+    return body.replace(/\\(['`\\])/g, "$1");
+}
+function firstString(node) {
+    if (STRING_KINDS.has(String(node.kind())))
+        return stringValue(node.text());
+    for (const child of node.children()) {
+        const value = firstString(child);
+        if (value !== null)
+            return value;
+    }
+    return null;
+}
+function contractSpecifier(value) {
+    const clean = value.trim();
+    const pathPart = clean.split("#", 1)[0].replace(/\\/g, "/");
+    const basename = pathPart.split("/").at(-1) ?? "";
+    if (/^[^.\s][^/\s]*\.(?:proto|graphql|gql)$/i.test(basename))
+        return clean;
+    const structured = basename.match(/^([^/\s]+)\.(?:ya?ml|json)$/i);
+    if (structured && /(?:^|[-_.])(?:openapi|swagger|asyncapi|contracts?|schemas?)(?:$|[-_.])/i.test(structured[1]))
+        return clean;
+    return null;
+}
+function pythonImports(text) {
+    const from = text.match(/^\s*from\s+([.\w]+)\s+import\s+([\s\S]+)$/);
+    if (from) {
+        let specifier = from[1];
+        if (/^\.+$/.test(specifier)) {
+            const imported = from[2].replace(/[()]/g, "").split(",", 1)[0].trim().split(/\s+as\s+/, 1)[0];
+            if (imported && imported !== "*")
+                specifier += imported;
+        }
+        return [specifier];
+    }
+    const direct = text.match(/^\s*import\s+([\s\S]+)$/);
+    return direct
+        ? direct[1].replace(/[()]/g, "").split(",").map((item) => item.trim().split(/\s+as\s+/, 1)[0]).filter(Boolean)
+        : [];
+}
+function importSpecifiers(language, node) {
+    const text = node.text().trim();
+    if (language === "python" && (node.kind() === "import_statement" || node.kind() === "import_from_statement")) {
+        return pythonImports(text).map((value) => ({ value, forceLocal: value.startsWith(".") }));
+    }
+    if (language === "go" && node.kind() === "import_spec") {
+        const value = firstString(node);
+        return value && value !== "C" ? [{ value, forceLocal: false }] : [];
+    }
+    if (language === "rust" && node.kind() === "use_declaration") {
+        const value = text.replace(/^use\s+/, "").replace(/;\s*$/, "").replace(/\s+as\s+[A-Za-z_]\w*\s*$/, "").trim();
+        return value ? [{ value, forceLocal: /^(?:crate|self|super)::/.test(value) }] : [];
+    }
+    if (language === "rust" && node.kind() === "mod_item" && /;\s*$/.test(text)) {
+        const value = text.match(/^mod\s+([A-Za-z_]\w*)\s*;/)?.[1];
+        return value ? [{ value, forceLocal: true }] : [];
+    }
+    if (language === "java" && node.kind() === "import_declaration") {
+        const value = text.replace(/^import\s+/, "").replace(/^static\s+/, "").replace(/;\s*$/, "").trim();
+        return value ? [{ value, forceLocal: false }] : [];
+    }
+    if (language === "kotlin" && node.kind() === "import_header") {
+        const value = text.replace(/^import\s+/, "").replace(/\s+as\s+\w+\s*$/, "").trim();
+        return value ? [{ value, forceLocal: false }] : [];
+    }
+    if (language === "csharp" && node.kind() === "using_directive") {
+        const body = text.replace(/^global\s+/, "").replace(/^using\s+/, "").replace(/^static\s+/, "").replace(/;\s*$/, "").trim();
+        const value = body.includes("=") ? body.slice(body.indexOf("=") + 1).trim() : body;
+        return value ? [{ value, forceLocal: false }] : [];
+    }
+    return [];
+}
+function pythonBindings(text) {
+    const from = text.match(/^\s*from\s+([.\w]+)\s+import\s+([\s\S]+)$/);
+    if (from) {
+        const base = from[1];
+        return from[2].replace(/[()]/g, "").split(",").flatMap((raw) => {
+            const parts = raw.trim().split(/\s+as\s+/);
+            const imported = parts[0]?.trim() ?? "";
+            if (!imported || imported === "*")
+                return [];
+            const local = (parts[1] ?? imported.split(".").at(-1) ?? "").trim();
+            const specifier = /^\.+$/.test(base) ? `${base}${imported}` : base;
+            return local ? [{ local, specifier, symbol: imported }] : [];
+        });
+    }
+    const direct = text.match(/^\s*import\s+([\s\S]+)$/);
+    if (!direct)
+        return [];
+    return direct[1].replace(/[()]/g, "").split(",").flatMap((raw) => {
+        const parts = raw.trim().split(/\s+as\s+/);
+        const specifier = parts[0]?.trim() ?? "";
+        const local = (parts[1] ?? specifier.split(".")[0] ?? "").trim();
+        return specifier && local ? [{ local, specifier, symbol: "*" }] : [];
+    });
+}
+function importedBindings(language, node) {
+    const kind = String(node.kind());
+    const text = node.text().trim();
+    if (language === "python" && (kind === "import_statement" || kind === "import_from_statement"))
+        return pythonBindings(text);
+    if (language === "go" && kind === "import_spec") {
+        const specifier = firstString(node);
+        if (!specifier || specifier === "C")
+            return [];
+        const quote = text.search(/["`]/);
+        const explicit = quote < 0 ? "" : text.slice(0, quote).trim().split(/\s+/).at(-1) ?? "";
+        if (explicit === "_" || explicit === ".")
+            return [];
+        const local = explicit || (specifier.replace(/\/$/, "").split("/").at(-1) ?? "");
+        return local ? [{ local, specifier, symbol: "*" }] : [];
+    }
+    if (language === "rust" && kind === "use_declaration") {
+        const body = text.replace(/^use\s+/, "").replace(/;\s*$/, "").trim();
+        if (!body || /[{}*]/.test(body))
+            return [];
+        const alias = body.match(/\s+as\s+([A-Za-z_]\w*)\s*$/)?.[1];
+        const specifier = body.replace(/\s+as\s+[A-Za-z_]\w*\s*$/, "");
+        const symbol = specifier.split("::").at(-1) ?? "";
+        const local = alias ?? symbol;
+        return local ? [{ local, specifier, symbol }] : [];
+    }
+    if (language === "java" && kind === "import_declaration") {
+        const specifier = importSpecifiers(language, node)[0]?.value ?? "";
+        if (!specifier || specifier.endsWith(".*"))
+            return [];
+        const local = specifier.split(".").at(-1) ?? "";
+        return local ? [{ local, specifier, symbol: local }] : [];
+    }
+    if (language === "kotlin" && kind === "import_header") {
+        const specifier = importSpecifiers(language, node)[0]?.value ?? "";
+        const alias = text.match(/\s+as\s+([A-Za-z_]\w*)\s*$/)?.[1];
+        const symbol = specifier.split(".").at(-1) ?? "";
+        const local = alias ?? symbol;
+        return local ? [{ local, specifier, symbol }] : [];
+    }
+    if (language === "csharp" && kind === "using_directive" && text.includes("=")) {
+        const body = text.replace(/^global\s+/, "").replace(/^using\s+/, "").replace(/;\s*$/, "").trim();
+        const equal = body.indexOf("=");
+        const local = body.slice(0, equal).trim();
+        const specifier = body.slice(equal + 1).trim();
+        return /^[A-Za-z_]\w*$/.test(local) && specifier ? [{ local, specifier, symbol: "*" }] : [];
+    }
+    return [];
+}
+function callBindingName(language, node) {
+    const callKinds = {
+        python: "call",
+        go: "call_expression",
+        rust: "call_expression",
+        java: "method_invocation",
+        kotlin: "call_expression",
+        csharp: "invocation_expression",
+    };
+    if (String(node.kind()) !== callKinds[language])
+        return null;
+    const callee = node.text().split("(", 1)[0].trim();
+    return callee.match(/^([A-Za-z_]\w*)/)?.[1] ?? null;
+}
+function ffiSpecifier(language, node) {
+    const kind = node.kind();
+    const text = node.text().trim();
+    if (language === "go" && kind === "import_spec" && firstString(node) === "C")
+        return "C ABI";
+    if (language === "rust" && kind === "foreign_mod_item" && /^extern\s+"C"/.test(text))
+        return "C ABI";
+    if (language === "python" && kind === "call" && /^(?:ctypes\.(?:CDLL|PyDLL)|(?:cffi\.)?dlopen)\s*\(/.test(text))
+        return firstString(node);
+    if (language === "rust" && kind === "call_expression" && /(?:\bdlopen|libloading::Library::new)\s*\(/.test(text))
+        return firstString(node);
+    if (language === "java" && kind === "method_invocation" && /(?:System|Runtime)\.(?:load|loadLibrary)\s*\(/.test(text))
+        return firstString(node);
+    if (language === "kotlin" && kind === "call_expression" && /(?:System|Runtime)\.(?:load|loadLibrary)\s*\(/.test(text))
+        return firstString(node);
+    if (language === "csharp" && kind === "attribute" && /(?:^|\.)DllImport\s*\(/.test(text))
+        return firstString(node);
+    if (language === "csharp" && kind === "invocation_expression" && /NativeLibrary\.Load\s*\(/.test(text))
+        return firstString(node);
+    return null;
+}
+/**
+ * Parses a single non-TS source file with a bundled Tree-sitter grammar.
+ * Syntax recovery is deliberately rejected: an ERROR/missing node makes the
+ * result partial and suppresses every edge from the recovered tree.
+ */
+export function analyzePolyglotAstSource(rel, language, content) {
+    if (!isSupportedLanguage(language))
+        throw new Error(`Unsupported polyglot AST language: ${language}`);
+    const analyzer = analyzerFor(language);
+    const root = parse(language, content).root();
+    const diagnostics = syntaxDiagnostics(root);
+    if (diagnostics.length > 0) {
+        return {
+            references: [], exports: [], analyzer, status: "partial", diagnostics,
+            limitations: ["Tree-sitter recovered from invalid syntax; fail-closed mode discarded all recovered relations."],
+        };
+    }
+    const references = [];
+    const add = (node, kind, specifier, confidence, forceLocal = false, symbol) => {
+        if (!specifier.trim())
+            return;
+        references.push({
+            kind, specifier: specifier.trim(), line: node.range().start.line + 1,
+            parser: analyzer.id, confidence, forceLocal, offset: node.range().start.index, symbol,
+        });
+    };
+    const nodes = allNodes(root);
+    const bindings = new Map();
+    for (const node of nodes) {
+        for (const binding of importedBindings(language, node)) {
+            const previous = bindings.get(binding.local);
+            bindings.set(binding.local, previous === undefined || (previous && previous.specifier === binding.specifier && previous.symbol === binding.symbol) ? binding : null);
+        }
+    }
+    for (const node of nodes) {
+        for (const item of importSpecifiers(language, node))
+            add(node, "import", item.value, 0.98, item.forceLocal);
+        const bindingName = callBindingName(language, node);
+        const binding = bindingName ? bindings.get(bindingName) : undefined;
+        if (binding)
+            add(node, "call", binding.specifier, 0.96, binding.specifier.startsWith("."), binding.symbol);
+        if (STRING_KINDS.has(String(node.kind()))) {
+            const value = stringValue(node.text());
+            const contract = value === null ? null : contractSpecifier(value);
+            if (contract)
+                add(node, "contract", contract, 0.98, true);
+        }
+        const ffi = ffiSpecifier(language, node);
+        if (ffi)
+            add(node, "ffi", ffi, 0.98, ffi !== "C ABI" && /[\\/]/.test(ffi));
+    }
+    const unique = [...new Map(references.map((reference) => [
+            `${reference.kind}|${reference.line}|${reference.specifier}|${reference.offset ?? ""}`,
+            reference,
+        ])).values()].sort((a, b) => a.line - b.line || a.kind.localeCompare(b.kind) || a.specifier.localeCompare(b.specifier));
+    return {
+        references: unique,
+        exports: [],
+        analyzer,
+        status: "complete",
+        diagnostics: [],
+        limitations: [
+            "Tree-sitter AST proves source syntax, not compiler symbol resolution or runtime execution.",
+            `Source identity (${rel}) and content hash are bound by the semantic evidence layer when results are imported.`,
+        ],
+    };
+}

package/dist/portfolio.js

@@ -0,0 +1,349 @@
+import fs from "node:fs";
+import path from "node:path";
+import { GovernanceSchema, loadGovernance } from "./governance-model.js";
+import { pmPath, registryFile, snapshotsDir } from "./paths.js";
+import { loadProject, loadRoadmap, loadSecurity, loadTasks } from "./store.js";
+import { RegistrySchema, SnapshotSchema } from "./types.js";
+const SEMVER_SOURCE = "(?:v)?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-([0-9A-Za-z.-]+))?(?:\\+[0-9A-Za-z.-]+)?";
+const SEMVER_RE = new RegExp(`^${SEMVER_SOURCE}$`);
+const CONSTRAINT_RE = new RegExp(`^(\\^|~|>=|<=|>|<)?\\s*(${SEMVER_SOURCE})$`);
+function parseSemVer(value) {
+    const match = value.trim().match(SEMVER_RE);
+    if (!match)
+        return null;
+    const prerelease = [];
+    if (match[4]) {
+        for (const identifier of match[4].split(".")) {
+            if (!identifier || (/^\d+$/.test(identifier) && identifier.length > 1 && identifier.startsWith("0")))
+                return null;
+            prerelease.push(/^\d+$/.test(identifier) ? Number(identifier) : identifier);
+        }
+    }
+    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), prerelease };
+}
+function compareSemVer(left, right) {
+    for (const field of ["major", "minor", "patch"]) {
+        if (left[field] !== right[field])
+            return left[field] < right[field] ? -1 : 1;
+    }
+    if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+        return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length === 0 ? 1 : -1;
+    }
+    const length = Math.max(left.prerelease.length, right.prerelease.length);
+    for (let index = 0; index < length; index += 1) {
+        const a = left.prerelease[index];
+        const b = right.prerelease[index];
+        if (a === undefined || b === undefined)
+            return a === undefined ? -1 : 1;
+        if (a === b)
+            continue;
+        if (typeof a === "number" && typeof b === "string")
+            return -1;
+        if (typeof a === "string" && typeof b === "number")
+            return 1;
+        return a < b ? -1 : 1;
+    }
+    return 0;
+}
+function upperBound(operator, base) {
+    if (operator === "~")
+        return { major: base.major, minor: base.minor + 1, patch: 0, prerelease: [] };
+    if (base.major > 0)
+        return { major: base.major + 1, minor: 0, patch: 0, prerelease: [] };
+    if (base.minor > 0)
+        return { major: 0, minor: base.minor + 1, patch: 0, prerelease: [] };
+    return { major: 0, minor: 0, patch: base.patch + 1, prerelease: [] };
+}
+/** Evaluate the deliberately small, deterministic semver constraint subset. */
+export function checkVersionConstraint(version, constraint) {
+    const normalizedConstraint = constraint.trim();
+    if (normalizedConstraint === "*")
+        return { status: "satisfied", version, constraint: normalizedConstraint };
+    const target = parseSemVer(version);
+    if (!target) {
+        return { status: "unresolved", version, constraint: normalizedConstraint, reason: `目标版本不是完整 semver: ${version}` };
+    }
+    const match = normalizedConstraint.match(CONSTRAINT_RE);
+    if (!match) {
+        return { status: "unresolved", version, constraint: normalizedConstraint, reason: `不支持的版本约束: ${constraint}` };
+    }
+    const operator = (match[1] || "exact");
+    const base = parseSemVer(match[2]);
+    if (!base) {
+        return { status: "unresolved", version, constraint: normalizedConstraint, reason: `约束版本不是完整 semver: ${match[2]}` };
+    }
+    const compared = compareSemVer(target, base);
+    let satisfied;
+    switch (operator) {
+        case "exact":
+            satisfied = compared === 0;
+            break;
+        case ">=":
+            satisfied = compared >= 0;
+            break;
+        case "<=":
+            satisfied = compared <= 0;
+            break;
+        case ">":
+            satisfied = compared > 0;
+            break;
+        case "<":
+            satisfied = compared < 0;
+            break;
+        case "^":
+            satisfied = compared >= 0 && compareSemVer(target, upperBound("^", base)) < 0;
+            break;
+        case "~":
+            satisfied = compared >= 0 && compareSemVer(target, upperBound("~", base)) < 0;
+            break;
+    }
+    return { status: satisfied ? "satisfied" : "mismatch", version, constraint: normalizedConstraint };
+}
+function canonicalCycle(cycle) {
+    const body = cycle.slice(0, -1);
+    if (body.length === 0)
+        return "";
+    const rotations = body.map((_, index) => [...body.slice(index), ...body.slice(0, index)]);
+    rotations.sort((a, b) => a.join("\0").localeCompare(b.join("\0")));
+    return [...rotations[0], rotations[0][0]].join(" -> ");
+}
+function findCycles(ids, adjacency) {
+    const state = new Map();
+    const stack = [];
+    const cycles = new Map();
+    const visit = (id) => {
+        state.set(id, 1);
+        stack.push(id);
+        for (const target of adjacency.get(id) ?? []) {
+            if ((state.get(target) ?? 0) === 0)
+                visit(target);
+            else if (state.get(target) === 1) {
+                const start = stack.lastIndexOf(target);
+                const cycle = [...stack.slice(start), target];
+                cycles.set(canonicalCycle(cycle), cycle);
+            }
+        }
+        stack.pop();
+        state.set(id, 2);
+    };
+    for (const id of [...ids].sort())
+        if ((state.get(id) ?? 0) === 0)
+            visit(id);
+    return [...cycles.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, cycle]) => cycle);
+}
+export function buildRepositoryGraph(governances) {
+    const violations = [];
+    const sources = [];
+    governances.forEach((governance, index) => {
+        const parsed = GovernanceSchema.safeParse(governance);
+        if (!parsed.success) {
+            violations.push({
+                code: "governance-invalid",
+                severity: "error",
+                message: `治理模型 ${index + 1} 无效: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`,
+            });
+        }
+        else {
+            sources.push({ governance: parsed.data, source: `governance:${index + 1}` });
+        }
+    });
+    const repositories = [];
+    const specs = new Map();
+    for (const source of sources) {
+        for (const repository of source.governance.repositories) {
+            repositories.push({
+                id: repository.id,
+                name: repository.name,
+                root: repository.root,
+                version: repository.version,
+                source: source.source,
+            });
+            const entries = specs.get(repository.id) ?? [];
+            entries.push({ source, repository });
+            specs.set(repository.id, entries);
+        }
+    }
+    repositories.sort((a, b) => a.id.localeCompare(b.id) || a.source.localeCompare(b.source));
+    for (const [id, entries] of specs) {
+        if (entries.length > 1) {
+            violations.push({ code: "duplicate-repository-id", severity: "error", repository: id, message: `跨治理文件重复 repository ID "${id}"（${entries.length} 处）` });
+        }
+    }
+    const dependencies = [];
+    const adjacency = new Map();
+    for (const entries of specs.values()) {
+        for (const { source, repository } of entries) {
+            for (const dependency of repository.dependencies) {
+                const targets = specs.get(dependency.repository) ?? [];
+                if (targets.length === 0) {
+                    dependencies.push({ from: repository.id, to: dependency.repository, constraint: dependency.constraint, status: "missing" });
+                    violations.push({ code: "missing-repository-target", severity: "error", repository: repository.id, target: dependency.repository, constraint: dependency.constraint, message: `仓库 "${repository.id}" 依赖的目标 "${dependency.repository}" 不存在` });
+                    continue;
+                }
+                if (targets.length > 1) {
+                    dependencies.push({ from: repository.id, to: dependency.repository, constraint: dependency.constraint, status: "ambiguous" });
+                    continue;
+                }
+                const target = targets[0].repository;
+                const checked = checkVersionConstraint(target.version, dependency.constraint);
+                dependencies.push({ from: repository.id, to: target.id, constraint: dependency.constraint, target_version: target.version, status: checked.status });
+                const adjacent = adjacency.get(repository.id) ?? [];
+                adjacent.push(target.id);
+                adjacency.set(repository.id, adjacent);
+                if (checked.status === "unresolved") {
+                    const fail = source.governance.policies.fail_on_unresolved;
+                    violations.push({ code: "version-constraint-unresolved", severity: fail ? "error" : "warning", repository: repository.id, target: target.id, constraint: dependency.constraint, target_version: target.version, message: `仓库 "${repository.id}" → "${target.id}" 版本约束无法解析: ${checked.reason}` });
+                }
+                else if (checked.status === "mismatch") {
+                    violations.push({ code: "version-constraint-mismatch", severity: "error", repository: repository.id, target: target.id, constraint: dependency.constraint, target_version: target.version, message: `仓库 "${repository.id}" 要求 ${dependency.constraint}，目标 "${target.id}" 当前为 ${target.version}` });
+                }
+            }
+        }
+    }
+    dependencies.sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to));
+    const uniqueIds = [...specs].filter(([, entries]) => entries.length === 1).map(([id]) => id);
+    const cycles = findCycles(uniqueIds, adjacency);
+    for (const cycle of cycles) {
+        violations.push({ code: "repository-cycle", severity: "error", repository: cycle[0], message: `仓库依赖循环: ${cycle.join(" -> ")}` });
+    }
+    return { repositories, dependencies, cycles, violations };
+}
+function countByStatus(items, status) {
+    return items.filter((item) => item.status === status).length;
+}
+export function buildPortfolioReport(input) {
+    const projects = [...(input.projects ?? [])];
+    const projectFailures = [...(input.projectFailures ?? [])];
+    const governances = [...(input.governanceFiles ?? [])];
+    const seenGovernance = new Set(governances);
+    for (const project of projects) {
+        if (!seenGovernance.has(project.governance)) {
+            governances.push(project.governance);
+            seenGovernance.add(project.governance);
+        }
+    }
+    const graph = buildRepositoryGraph(governances);
+    const summaries = [];
+    const risks = [];
+    for (const project of projects) {
+        const openTasks = project.tasks.filter((task) => task.status !== "done" && task.status !== "cancelled");
+        const openFindings = project.findings.filter((finding) => finding.status === "open");
+        const languages = [...new Set(project.governance.modules.flatMap((module) => module.languages))].sort();
+        const debtOpen = openTasks.filter((task) => task.type === "debt").length;
+        const blocked = countByStatus(project.tasks, "blocked");
+        const high = openFindings.filter((finding) => finding.severity === "high").length;
+        const medium = openFindings.filter((finding) => finding.severity === "medium").length;
+        const low = openFindings.filter((finding) => finding.severity === "low").length;
+        summaries.push({
+            id: project.id,
+            name: project.name,
+            root: project.root,
+            phase: project.phase,
+            milestones: { total: project.milestones.length, planned: countByStatus(project.milestones, "planned"), active: countByStatus(project.milestones, "active"), done: countByStatus(project.milestones, "done"), paused: countByStatus(project.milestones, "paused") },
+            tasks: { total: project.tasks.length, open: openTasks.length, done: countByStatus(project.tasks, "done"), blocked, debt_open: debtOpen },
+            security: { open: openFindings.length, high, medium, low },
+            modules: project.governance.modules.length,
+            languages,
+            code_snapshot: project.code_snapshot,
+        });
+        if (debtOpen > 0)
+            risks.push({ code: "open-debt", severity: "warning", project: project.id, count: debtOpen, message: `${debtOpen} 个未完成债务任务` });
+        if (blocked > 0)
+            risks.push({ code: "blocked-tasks", severity: "warning", project: project.id, count: blocked, message: `${blocked} 个阻塞任务` });
+        if (openFindings.length > 0)
+            risks.push({ code: "open-security", severity: high > 0 ? "error" : "warning", project: project.id, count: openFindings.length, message: `${openFindings.length} 个未关闭安全发现（高危 ${high}）` });
+        if (!project.code_snapshot)
+            risks.push({ code: "missing-code-snapshot", severity: "warning", project: project.id, count: 1, message: "缺少代码快照" });
+        const missingLanguage = project.governance.modules.filter((module) => module.languages.length === 0).length;
+        if (missingLanguage > 0)
+            risks.push({ code: "module-language-missing", severity: "warning", project: project.id, count: missingLanguage, message: `${missingLanguage} 个模块未声明语言` });
+    }
+    summaries.sort((a, b) => a.id.localeCompare(b.id));
+    const languageCounts = new Map();
+    const modules = governances.flatMap((governance) => governance.modules);
+    for (const module of modules)
+        for (const language of new Set(module.languages))
+            languageCounts.set(language, (languageCounts.get(language) ?? 0) + 1);
+    const projectFailureViolations = projectFailures.map((failure) => ({ code: "project-load-failed", severity: "error", message: `项目 "${failure.name}" 加载失败 (${failure.root}): ${failure.error}` }));
+    const violations = [...projectFailureViolations, ...graph.violations];
+    const coverage = {
+        projects_requested: input.projectsRequested ?? projects.length + projectFailures.length,
+        projects_loaded: projects.length,
+        projects_failed: projectFailures.length,
+        governance_files: governances.length,
+        code_snapshots: projects.filter((project) => project.code_snapshot !== null).length,
+        modules: modules.length,
+        modules_with_owners: modules.filter((module) => module.owners.length > 0).length,
+        languages: [...languageCounts].sort(([a], [b]) => a.localeCompare(b)).map(([language, count]) => ({ language, modules: count })),
+        repositories: graph.repositories.length,
+        repository_dependencies: graph.dependencies.length,
+        resolved_repository_dependencies: graph.dependencies.filter((dependency) => dependency.status !== "missing" && dependency.status !== "ambiguous" && dependency.status !== "unresolved").length,
+    };
+    const ok = violations.every((violation) => violation.severity !== "error") && risks.every((risk) => risk.severity !== "error");
+    return { generated_at: new Date().toISOString(), ok, projects: summaries, projectFailures, repository_graph: graph, coverage, risks, violations };
+}
+function latestSnapshotStrict(root) {
+    const dir = snapshotsDir(root);
+    if (!fs.existsSync(dir))
+        return null;
+    const names = fs.readdirSync(dir).filter((name) => name.startsWith("snap-") && name.endsWith(".json")).sort();
+    if (names.length === 0)
+        return null;
+    const file = path.join(dir, names[names.length - 1]);
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`代码快照 JSON 解析失败: ${file}: ${error.message}`);
+    }
+    const parsed = SnapshotSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new Error(`代码快照数据校验失败: ${file}: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
+    }
+    return parsed.data;
+}
+export function loadPortfolioProject(root) {
+    const absoluteRoot = path.resolve(root);
+    const required = ["project.json", "roadmap.json", "tasks.json", "security.json", "governance.json"];
+    const missing = required.filter((file) => !fs.existsSync(pmPath(absoluteRoot, file)));
+    if (missing.length > 0)
+        throw new Error(`项目账本缺失: ${missing.map((file) => `.pm/${file}`).join(", ")}`);
+    const project = loadProject(absoluteRoot);
+    const governance = loadGovernance(absoluteRoot);
+    const localRepository = governance.repositories.find((repository) => path.resolve(absoluteRoot, repository.root) === absoluteRoot);
+    return {
+        id: localRepository?.id ?? `${project.name}@${path.basename(absoluteRoot)}`,
+        name: project.name,
+        root: absoluteRoot,
+        phase: project.phase,
+        milestones: loadRoadmap(absoluteRoot).milestones,
+        tasks: loadTasks(absoluteRoot).tasks,
+        findings: loadSecurity(absoluteRoot).findings,
+        code_snapshot: latestSnapshotStrict(absoluteRoot),
+        governance,
+    };
+}
+export function buildPortfolioFromRegistry(file = registryFile()) {
+    if (!fs.existsSync(file)) {
+        return buildPortfolioReport({ projectFailures: [{ name: "全局注册表", root: file, error: "注册表文件不存在" }], projectsRequested: 1 });
+    }
+    let registry;
+    try {
+        registry = RegistrySchema.parse(JSON.parse(fs.readFileSync(file, "utf8")));
+    }
+    catch (error) {
+        return buildPortfolioReport({ projectFailures: [{ name: "全局注册表", root: file, error: `注册表损坏: ${error.message}` }], projectsRequested: 1 });
+    }
+    const projects = [];
+    const failures = [];
+    for (const entry of registry.projects) {
+        try {
+            projects.push(loadPortfolioProject(entry.root));
+        }
+        catch (error) {
+            failures.push({ name: entry.name, root: entry.root, error: error.message });
+        }
+    }
+    return buildPortfolioReport({ projects, projectFailures: failures, projectsRequested: registry.projects.length });
+}