@pactosigna/trace 0.1.6 → 0.1.8

package/dist/cli.js

@@ -111,7 +111,10 @@ var RiskGapCodeSchema = z.enum([
 ]);
 var RiskGapSeveritySchema = z.enum(["error", "warning"]);
 var MitigationSchema = z.object({
-  control: z.string().min(1),
+  control: z.string().min(1).regex(
+    /^[A-Z][A-Z0-9-]+(#[\w-]+)?$/,
+    "control must be a document ID reference (e.g. SRS-DOC-001, SDP-001#4-2-stage-gates), not prose"
+  ),
   iso_category: IsoCategorySchema,
   reduces: ReducesTargetSchema
 });
@@ -901,6 +904,7 @@ function detectUnitNoVerification(documents, links, deviceSafetyClass) {
   return documents.filter((d) => {
     if (d.type !== "detailed_design") return false;
     if (!isApprovedOrEffective(d)) return false;
+    if (d.frontmatter.software_item_type !== "unit") return false;
     return !verifiedDocIds.has(d.id);
   }).map(
     (d) => buildGap(
@@ -913,6 +917,8 @@ function detectUnitNoVerification(documents, links, deviceSafetyClass) {
 }
 function detectRiskControlNoVerification(documents, links) {
   const verifiedDocIds = buildVerifiedDocIds(links);
+  const docById = new Map(documents.map((d) => [d.id, d]));
+  const TESTABLE_TYPES = /* @__PURE__ */ new Set(["requirement", "architecture", "detailed_design"]);
   const gaps = [];
   for (const doc of documents) {
     if (!RISK_ENTRY_TYPES.has(doc.type)) continue;
@@ -929,7 +935,21 @@ function detectRiskControlNoVerification(documents, links) {
       }
     }
     for (const control of controls) {
-      if (!verifiedDocIds.has(extractDocumentId(control))) {
+      const controlDocId = extractDocumentId(control);
+      const controlDoc = docById.get(controlDocId);
+      if (!controlDoc) {
+        gaps.push(
+          buildGap(
+            doc,
+            "risk_control_no_verification",
+            "warning",
+            `Risk "${doc.title}" has mitigation control "${control}" referencing document "${controlDocId}" which does not exist in the document corpus.`
+          )
+        );
+        continue;
+      }
+      if (!TESTABLE_TYPES.has(controlDoc.type)) continue;
+      if (!verifiedDocIds.has(controlDocId)) {
         gaps.push(
           buildGap(
             doc,
@@ -4129,7 +4149,10 @@ var RiskGapCodeSchema2 = z33.enum([
 ]);
 var RiskGapSeveritySchema2 = z33.enum(["error", "warning"]);
 var MitigationSchema2 = z33.object({
-  control: z33.string().min(1),
+  control: z33.string().min(1).regex(
+    /^[A-Z][A-Z0-9-]+(#[\w-]+)?$/,
+    "control must be a document ID reference (e.g. SRS-DOC-001, SDP-001#4-2-stage-gates), not prose"
+  ),
   iso_category: IsoCategorySchema2,
   reduces: ReducesTargetSchema2
 });
@@ -5625,7 +5648,13 @@ function validateDocument(content, filePath) {
       }
     }
   }
-  const SKIP_UNKNOWN_SECTION_TYPES = /* @__PURE__ */ new Set(["architecture", "detailed_design"]);
+  const SKIP_UNKNOWN_SECTION_TYPES = /* @__PURE__ */ new Set([
+    "architecture",
+    "detailed_design",
+    "sop",
+    "policy",
+    "work_instruction"
+  ]);
   if (docType && !SKIP_UNKNOWN_SECTION_TYPES.has(docType)) {
     const bodyFormat = BODY_FORMAT[docType];
     const knownSections = /* @__PURE__ */ new Set();

package/dist/index.js

@@ -1077,7 +1077,10 @@ var RiskGapCodeSchema = z.enum([
 ]);
 var RiskGapSeveritySchema = z.enum(["error", "warning"]);
 var MitigationSchema = z.object({
-  control: z.string().min(1),
+  control: z.string().min(1).regex(
+    /^[A-Z][A-Z0-9-]+(#[\w-]+)?$/,
+    "control must be a document ID reference (e.g. SRS-DOC-001, SDP-001#4-2-stage-gates), not prose"
+  ),
   iso_category: IsoCategorySchema,
   reduces: ReducesTargetSchema
 });
@@ -1867,6 +1870,7 @@ function detectUnitNoVerification(documents, links, deviceSafetyClass) {
   return documents.filter((d) => {
     if (d.type !== "detailed_design") return false;
     if (!isApprovedOrEffective(d)) return false;
+    if (d.frontmatter.software_item_type !== "unit") return false;
     return !verifiedDocIds.has(d.id);
   }).map(
     (d) => buildGap(
@@ -1879,6 +1883,8 @@ function detectUnitNoVerification(documents, links, deviceSafetyClass) {
 }
 function detectRiskControlNoVerification(documents, links) {
   const verifiedDocIds = buildVerifiedDocIds(links);
+  const docById = new Map(documents.map((d) => [d.id, d]));
+  const TESTABLE_TYPES = /* @__PURE__ */ new Set(["requirement", "architecture", "detailed_design"]);
   const gaps = [];
   for (const doc of documents) {
     if (!RISK_ENTRY_TYPES.has(doc.type)) continue;
@@ -1895,7 +1901,21 @@ function detectRiskControlNoVerification(documents, links) {
       }
     }
     for (const control of controls) {
-      if (!verifiedDocIds.has(extractDocumentId(control))) {
+      const controlDocId = extractDocumentId(control);
+      const controlDoc = docById.get(controlDocId);
+      if (!controlDoc) {
+        gaps.push(
+          buildGap(
+            doc,
+            "risk_control_no_verification",
+            "warning",
+            `Risk "${doc.title}" has mitigation control "${control}" referencing document "${controlDocId}" which does not exist in the document corpus.`
+          )
+        );
+        continue;
+      }
+      if (!TESTABLE_TYPES.has(controlDoc.type)) continue;
+      if (!verifiedDocIds.has(controlDocId)) {
         gaps.push(
           buildGap(
             doc,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pactosigna/trace",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "description": "QMS traceability engine — gap detection, risk analysis, impact analysis (IEC 62304, ISO 14971)",
   "publishConfig": {