@poetic-ai/poetic 1.42.0

package/dist/chunk-BZU2O43F.js

@@ -0,0 +1,1125 @@
+import {
+  LocalFileBackend,
+  checkVersion
+} from "./chunk-CTLUBNCW.js";
+import {
+  createWorkItemFile
+} from "./chunk-6MFRHTRI.js";
+import {
+  DEFAULT_LEASE_TTL_MS,
+  HumanReviewRequiredError,
+  InvalidTransitionError,
+  LeaseExpiredError
+} from "./chunk-Y55LZN5U.js";
+import {
+  StaleVersionError
+} from "./chunk-TDSEX5CF.js";
+import {
+  generateId
+} from "./chunk-VNSYKC25.js";
+import {
+  withIndexRegeneration
+} from "./chunk-OPYFYTWQ.js";
+import {
+  getBucketPathByKind
+} from "./chunk-HOYBYAOA.js";
+import {
+  listMarkdownFiles,
+  parseMarkdownFile,
+  writeMarkdownFile
+} from "./chunk-OIS7J26S.js";
+import {
+  assertSafePathComponent
+} from "./chunk-S2VQCZO4.js";
+import {
+  emitWarning
+} from "./chunk-EJGCZGUF.js";
+
+// src/planning/issue-fingerprint.ts
+import { createHash } from "crypto";
+function normalizeSnippet(snippet) {
+  return snippet.split("\n").map((line) => line.trim()).filter((line, i, arr) => !(line === "" && arr[i - 1] === "")).join("\n").replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").trim();
+}
+function normalizePath(filepath) {
+  return filepath.replace(/\\/g, "/").replace(/^\.\//, "").toLowerCase();
+}
+function sha256(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex");
+}
+function generateFingerprint(input) {
+  const normalizedSnippet = normalizeSnippet(input.snippet);
+  const normalizedPath = normalizePath(input.path);
+  const snippetHash = sha256(normalizedSnippet);
+  const compositeInput = [input.ruleId, snippetHash, input.symbolName ?? "", normalizedPath].join(
+    "\0"
+  );
+  const compositeHash = sha256(compositeInput);
+  return {
+    ruleId: input.ruleId,
+    snippetHash,
+    symbolName: input.symbolName,
+    path: normalizedPath,
+    compositeHash
+  };
+}
+function matchFingerprint(candidate, existing) {
+  if (candidate.compositeHash === existing.compositeHash) {
+    return "exact";
+  }
+  if (candidate.ruleId === existing.ruleId && candidate.symbolName && existing.symbolName && candidate.symbolName === existing.symbolName) {
+    return "fuzzy";
+  }
+  return "none";
+}
+function findDuplicate(candidate, existingFingerprints) {
+  let bestExact = null;
+  let bestFuzzy = null;
+  for (const existing of existingFingerprints) {
+    const strength = matchFingerprint(candidate, existing.fingerprint);
+    if (strength === "exact") {
+      if (!bestExact || existing.findingId < bestExact.existingFindingId) {
+        bestExact = {
+          strength: "exact",
+          existingFindingId: existing.findingId,
+          fingerprint: existing.fingerprint
+        };
+      }
+      continue;
+    }
+    if (strength === "fuzzy") {
+      const confidence = computeFuzzyConfidence(candidate, existing.fingerprint);
+      const reason = describeFuzzyMatch(candidate, existing.fingerprint);
+      if (!bestFuzzy || confidence > (bestFuzzy.confidence ?? 0) || Math.abs(confidence - (bestFuzzy.confidence ?? 0)) < Number.EPSILON && existing.findingId < bestFuzzy.existingFindingId) {
+        bestFuzzy = {
+          strength: "fuzzy",
+          existingFindingId: existing.findingId,
+          fingerprint: existing.fingerprint,
+          confidence,
+          reason
+        };
+      }
+    }
+  }
+  if (bestExact) return bestExact;
+  return bestFuzzy;
+}
+function computeFuzzyConfidence(candidate, existing) {
+  let confidence = 0.55;
+  if (candidate.snippetHash === existing.snippetHash) confidence += 0.25;
+  if (candidate.path === existing.path) confidence += 0.2;
+  return Math.min(1, confidence);
+}
+function describeFuzzyMatch(candidate, existing) {
+  const details = ["matched ruleId + symbolName"];
+  details.push(
+    candidate.snippetHash === existing.snippetHash ? "same snippet hash" : "different snippet hash"
+  );
+  details.push(candidate.path === existing.path ? "same path" : "different path");
+  return details.join("; ");
+}
+function trackOccurrence(currentCount, now = /* @__PURE__ */ new Date()) {
+  return {
+    lastSeenAt: now.toISOString(),
+    occurrenceCount: currentCount + 1
+  };
+}
+
+// src/planning/issue-manager.ts
+import * as path from "path";
+
+// src/planning/coordination/lease.ts
+var DEFAULT_LEASE_TTL_MS2 = 15 * 60 * 1e3;
+var DEFAULT_GRACE_MS = 5 * 60 * 1e3;
+function isExpiryLive(expiresAtIso, nowIso) {
+  if (!expiresAtIso) return false;
+  const expiryMs = Date.parse(expiresAtIso);
+  const nowMs = Date.parse(nowIso);
+  if (Number.isNaN(expiryMs) || Number.isNaN(nowMs)) return false;
+  return expiryMs > nowMs;
+}
+
+// src/planning/issue-state-machine.ts
+var FINDING_TRANSITIONS = {
+  raw: ["open", "closed"],
+  open: ["closed"],
+  closed: []
+};
+var ISSUE_TRANSITIONS = {
+  open: ["claimed", "investigating", "wontfix", "duplicate"],
+  claimed: ["claimed", "resolved", "open", "wontfix", "duplicate", "investigating"],
+  investigating: ["open", "resolved", "wontfix", "duplicate"],
+  resolved: [],
+  // terminal
+  wontfix: [],
+  // terminal
+  duplicate: []
+  // terminal
+};
+function requiresHumanActorForIssue(toStatus, category, severity) {
+  if (toStatus === "wontfix" && (category === "security" || severity === "critical")) {
+    return true;
+  }
+  return false;
+}
+function requiresHumanActorForFinding(finding, toStatus) {
+  return finding.status === "raw" && toStatus === "open" && finding.requiresHumanReview;
+}
+function isEffectivelyClaimed(entity, now = /* @__PURE__ */ new Date()) {
+  if (!entity.claimedBy || !entity.expiresAt) return false;
+  return isExpiryLive(entity.expiresAt, now.toISOString());
+}
+function transitionFinding(input) {
+  const { finding, toStatus, actor, expectedVersion, closedReason, fixCommit, deferredNote } = input;
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const nowISO = now.toISOString();
+  checkVersion(finding.id, finding.version, expectedVersion);
+  const allowed = FINDING_TRANSITIONS[finding.status];
+  if (!allowed.includes(toStatus)) {
+    throw new InvalidTransitionError(finding.id, finding.status, toStatus);
+  }
+  if (requiresHumanActorForFinding(finding, toStatus) && actor.actorType !== "human") {
+    throw new HumanReviewRequiredError(
+      finding.id,
+      `${finding.status} \u2192 ${toStatus}`,
+      finding.category,
+      finding.severity
+    );
+  }
+  if (toStatus === "closed" && !closedReason) {
+    throw new InvalidTransitionError(
+      finding.id,
+      finding.status,
+      toStatus,
+      "closedReason is required when closing a finding"
+    );
+  }
+  const updated = {
+    ...finding,
+    status: toStatus,
+    version: finding.version + 1,
+    updatedAt: nowISO
+  };
+  if (toStatus === "closed") {
+    updated.closedReason = closedReason;
+    updated.closedBy = actor;
+    updated.closedAt = nowISO;
+    if (fixCommit) updated.fixCommit = fixCommit;
+    if (deferredNote) updated.deferredNote = deferredNote;
+  }
+  return updated;
+}
+function transitionIssue(input) {
+  const { issue, toStatus, actor, expectedVersion, resolution, leaseTtlMs } = input;
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const nowISO = now.toISOString();
+  checkVersion(issue.id, issue.version, expectedVersion);
+  const allowed = ISSUE_TRANSITIONS[issue.status];
+  if (!allowed.includes(toStatus)) {
+    throw new InvalidTransitionError(issue.id, issue.status, toStatus);
+  }
+  if (requiresHumanActorForIssue(toStatus, issue.category, issue.severity)) {
+    if (actor.actorType !== "human") {
+      throw new HumanReviewRequiredError(
+        issue.id,
+        `${issue.status} \u2192 ${toStatus}`,
+        issue.category,
+        issue.severity
+      );
+    }
+  }
+  const updated = {
+    ...issue,
+    status: toStatus,
+    version: issue.version + 1,
+    updatedAt: nowISO
+  };
+  switch (toStatus) {
+    case "claimed": {
+      if (isEffectivelyClaimed(issue, now) && issue.claimedBy !== actor.actorId) {
+        throw new InvalidTransitionError(
+          issue.id,
+          issue.status,
+          toStatus,
+          `Already claimed by ${issue.claimedBy}`
+        );
+      }
+      const ttl = getValidLeaseTtlMs(leaseTtlMs, issue.id, issue.status, toStatus);
+      updated.claimedBy = actor.actorId;
+      updated.claimedAt = nowISO;
+      updated.expiresAt = new Date(now.getTime() + ttl).toISOString();
+      break;
+    }
+    case "resolved":
+      if (issue.status === "claimed") {
+        if (issue.claimedBy !== actor.actorId) {
+          throw new InvalidTransitionError(
+            issue.id,
+            issue.status,
+            toStatus,
+            "Only the claimant can resolve"
+          );
+        }
+        if (!isEffectivelyClaimed(issue, now)) {
+          throw new LeaseExpiredError(issue.id, issue.expiresAt ?? "unknown");
+        }
+      }
+      if (!resolution) {
+        throw new InvalidTransitionError(
+          issue.id,
+          issue.status,
+          toStatus,
+          "Resolution required when resolving"
+        );
+      }
+      updated.resolution = resolution;
+      updated.resolvedBy = actor;
+      updated.resolvedAt = nowISO;
+      if (input.fixCommit !== void 0) {
+        const fixCommit = input.fixCommit.trim();
+        if (fixCommit.length === 0) {
+          throw new InvalidTransitionError(
+            issue.id,
+            issue.status,
+            toStatus,
+            "fixCommit must be a non-empty string when provided"
+          );
+        }
+        updated.fixCommit = fixCommit;
+      }
+      if (input.fixPr !== void 0) {
+        if (!Number.isInteger(input.fixPr) || input.fixPr <= 0) {
+          throw new InvalidTransitionError(
+            issue.id,
+            issue.status,
+            toStatus,
+            "fixPr must be a positive integer when provided"
+          );
+        }
+        updated.fixPr = input.fixPr;
+      }
+      updated.claimedBy = void 0;
+      updated.claimedAt = void 0;
+      updated.expiresAt = void 0;
+      break;
+    case "open":
+      if (issue.status === "claimed" && issue.claimedBy !== actor.actorId) {
+        throw new InvalidTransitionError(
+          issue.id,
+          issue.status,
+          toStatus,
+          "Only the claimant can release the claim"
+        );
+      }
+      updated.claimedBy = void 0;
+      updated.claimedAt = void 0;
+      updated.expiresAt = void 0;
+      break;
+    case "investigating":
+      break;
+  }
+  return updated;
+}
+function promoteFinding(input) {
+  const { finding, issueId, actor, expectedVersion } = input;
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const nowISO = now.toISOString();
+  const updatedFinding = transitionFinding({
+    finding,
+    toStatus: "closed",
+    actor,
+    expectedVersion,
+    now,
+    closedReason: "promoted"
+  });
+  const newIssue = {
+    id: issueId,
+    kind: "issue",
+    title: finding.title,
+    status: "open",
+    version: 1,
+    severity: finding.severity ?? "medium",
+    category: finding.category,
+    findingIds: [finding.id],
+    originProvenance: { ...finding.reportedBy },
+    relatedIssues: [],
+    createdAt: nowISO,
+    updatedAt: nowISO
+  };
+  return { updatedFinding, newIssue };
+}
+function renewLease(input) {
+  const { entity, actor, expectedVersion, leaseTtlMs } = input;
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  checkVersion(entity.id, entity.version, expectedVersion);
+  if (entity.claimedBy !== actor.actorId) {
+    throw new InvalidTransitionError(
+      entity.id,
+      entity.status,
+      entity.status,
+      "Only the claimant can renew the lease"
+    );
+  }
+  if (!isEffectivelyClaimed(entity, now)) {
+    throw new LeaseExpiredError(entity.id, entity.expiresAt ?? "unknown");
+  }
+  const ttl = getValidLeaseTtlMs(leaseTtlMs, entity.id, entity.status, entity.status);
+  return {
+    ...entity,
+    version: entity.version + 1,
+    expiresAt: new Date(now.getTime() + ttl).toISOString(),
+    updatedAt: now.toISOString()
+  };
+}
+function getValidLeaseTtlMs(leaseTtlMs, entityId, fromStatus, toStatus) {
+  const ttl = leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
+  if (!Number.isFinite(ttl) || ttl <= 0) {
+    throw new InvalidTransitionError(
+      entityId,
+      fromStatus,
+      toStatus,
+      "Lease TTL must be a positive finite number"
+    );
+  }
+  return ttl;
+}
+function matchesSuppression(finding, suppressions, now = /* @__PURE__ */ new Date()) {
+  for (const s of suppressions) {
+    if (s.expiresAt && new Date(s.expiresAt) <= now) continue;
+    const ruleMatch = !s.ruleId || s.ruleId === finding.fingerprint.ruleId;
+    const pathMatch = !s.pathGlob || matchGlob(s.pathGlob, finding.fingerprint.path);
+    if (ruleMatch && pathMatch) return s;
+  }
+  return null;
+}
+function matchGlob(pattern, filepath) {
+  const GLOBSTAR = "\0GLOBSTAR\0";
+  const GLOB = "\0GLOB\0";
+  const QMARK = "\0QMARK\0";
+  const tokenized = pattern.replace(/\*\*/g, GLOBSTAR).replace(/\*/g, GLOB).replace(/\?/g, QMARK);
+  const escaped = tokenized.replace(/[-/\\^$+?.()|[\]{}]/g, "\\$&");
+  const regexStr = escaped.replaceAll(GLOBSTAR, ".*").replaceAll(GLOB, "[^/]*").replaceAll(QMARK, "[^/]");
+  return new RegExp(`^${regexStr}$`).test(filepath);
+}
+function evaluateIngest(finding, suppressions, now = /* @__PURE__ */ new Date()) {
+  const matched = matchesSuppression(finding, suppressions, now);
+  if (matched) {
+    return {
+      status: "closed",
+      requiresHumanReview: false,
+      matchedSuppression: matched,
+      closedReason: "dismissed",
+      closedBy: {
+        actorType: "system",
+        actorId: `suppression:${matched.id}`
+      },
+      closedAt: now.toISOString()
+    };
+  }
+  const needsHuman = finding.category === "security" || finding.severity === "critical";
+  return { status: "raw", requiresHumanReview: needsHuman };
+}
+
+// src/planning/issue-validation.ts
+var DEFAULT_CONSENSUS_CONFIG = {
+  minValidations: 2,
+  confirmedThreshold: 0.67,
+  rejectedThreshold: 0.67,
+  minAverageConfidence: 0.7
+};
+function appendValidation(input) {
+  const { finding, validation, expectedVersion } = input;
+  if (finding.version !== expectedVersion) {
+    throw new StaleVersionError(finding.version, expectedVersion, finding.id);
+  }
+  const updatedValidations = [...finding.validations, validation];
+  const validatorConfidence = updatedValidations.length > 0 ? updatedValidations.reduce((sum, v) => sum + v.confidence, 0) / updatedValidations.length : void 0;
+  return {
+    ...finding,
+    validations: updatedValidations,
+    validatorConfidence,
+    version: finding.version + 1,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function appendObservation(input) {
+  const { finding, observation, expectedVersion } = input;
+  if (finding.version !== expectedVersion) {
+    throw new StaleVersionError(finding.version, expectedVersion, finding.id);
+  }
+  const observations = getObservations(finding);
+  return {
+    ...finding,
+    observations: [...observations, observation],
+    version: finding.version + 1,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function getObservations(finding) {
+  if (Array.isArray(finding.observations) && finding.observations.length > 0) {
+    return finding.observations;
+  }
+  return [
+    createObservation(
+      finding.reportedBy,
+      finding.reporterConfidence,
+      finding.severity,
+      finding.codeLocations,
+      new Date(finding.reportedAt)
+    )
+  ];
+}
+function computeAgreement(finding) {
+  const identities = new Set(
+    getObservations(finding).map((observation) => observationIdentity(observation.reporter))
+  );
+  return identities.size;
+}
+function computeConsensus(finding, config = DEFAULT_CONSENSUS_CONFIG) {
+  const validations = finding.validations;
+  const count = validations.length;
+  if (count < config.minValidations) {
+    return {
+      outcome: "insufficient",
+      validationCount: count,
+      confirmedCount: validations.filter((v) => v.verdict === "confirmed").length,
+      rejectedCount: validations.filter((v) => v.verdict === "rejected").length,
+      uncertainCount: validations.filter((v) => v.verdict === "uncertain").length,
+      averageConfidence: count > 0 ? validations.reduce((s, v) => s + v.confidence, 0) / count : 0,
+      autoTriageRecommended: false
+    };
+  }
+  const confirmedCount = validations.filter((v) => v.verdict === "confirmed").length;
+  const rejectedCount = validations.filter((v) => v.verdict === "rejected").length;
+  const uncertainCount = validations.filter((v) => v.verdict === "uncertain").length;
+  const avgConfidence = validations.reduce((s, v) => s + v.confidence, 0) / count;
+  const confirmedRatio = confirmedCount / count;
+  const rejectedRatio = rejectedCount / count;
+  let outcome;
+  if (confirmedRatio >= config.confirmedThreshold) {
+    outcome = "confirmed";
+  } else if (rejectedRatio >= config.rejectedThreshold) {
+    outcome = "rejected";
+  } else {
+    outcome = "uncertain";
+  }
+  const isGated = finding.category === "security" || finding.severity === "critical";
+  const meetsConfidence = avgConfidence >= config.minAverageConfidence;
+  const autoTriageRecommended = !isGated && meetsConfidence && outcome !== "uncertain";
+  let recommendedStatus;
+  if (autoTriageRecommended) {
+    recommendedStatus = outcome === "confirmed" ? "triaged" : "rejected";
+  }
+  return {
+    outcome,
+    validationCount: count,
+    confirmedCount,
+    rejectedCount,
+    uncertainCount,
+    averageConfidence: avgConfidence,
+    autoTriageRecommended,
+    recommendedStatus
+  };
+}
+function createValidation(validator, verdict, confidence, reasoning, now = /* @__PURE__ */ new Date()) {
+  if (!Number.isFinite(confidence)) {
+    throw new Error(
+      `Validation confidence must be a finite number, received: ${String(confidence)}`
+    );
+  }
+  return {
+    validator,
+    verdict,
+    confidence: Math.max(0, Math.min(1, confidence)),
+    reasoning,
+    validatedAt: now.toISOString()
+  };
+}
+function createObservation(reporter, confidence, severity, codeLocations, now = /* @__PURE__ */ new Date()) {
+  if (!Number.isFinite(confidence)) {
+    throw new Error(
+      `Observation confidence must be a finite number, received: ${String(confidence)}`
+    );
+  }
+  return {
+    reporter,
+    confidence: Math.max(0, Math.min(1, confidence)),
+    ...severity ? { severity } : {},
+    codeLocations,
+    observedAt: Number.isNaN(now.getTime()) ? (/* @__PURE__ */ new Date()).toISOString() : now.toISOString()
+  };
+}
+function observationIdentity(reporter) {
+  return `${reporter.provider}:${reporter.model}:${reporter.harness}`;
+}
+
+// src/planning/issue-manager.ts
+function getCoordBackend(repoRoot) {
+  return new LocalFileBackend(path.join(repoRoot, ".poetic", "planning", "coordination"));
+}
+async function withEntityLock(repoRoot, entityId, fn) {
+  const backend = getCoordBackend(repoRoot);
+  const DELAYS_MS = [0, 100, 200, 400, 800, 1600, 2400, 2500];
+  let handle = null;
+  for (let attempt = 0; attempt < DELAYS_MS.length; attempt++) {
+    const delay = DELAYS_MS[attempt] ?? 0;
+    if (delay > 0) {
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+    handle = await backend.acquireLock(entityId);
+    if (handle !== null) break;
+  }
+  if (handle === null) {
+    const lockPath = path.join(
+      repoRoot,
+      ".poetic",
+      "planning",
+      "coordination",
+      "locks",
+      `${entityId.replace(/[/\\]/g, "_")}.lock`
+    );
+    throw new Error(
+      `Could not acquire lock for entity ${entityId} after retries. Lock path: ${lockPath}. Another process may be writing to this entity.`
+    );
+  }
+  try {
+    return await fn();
+  } finally {
+    await backend.releaseLock(handle);
+  }
+}
+var warnedMalformedFindingFiles = /* @__PURE__ */ new Set();
+var warnedMalformedIssueFiles = /* @__PURE__ */ new Set();
+async function createFinding(repoRoot, options) {
+  return withIndexRegeneration(repoRoot, async () => {
+    const now = /* @__PURE__ */ new Date();
+    const nowISO = now.toISOString();
+    const fp = generateFingerprint(options.fingerprint);
+    const observation = createObservation(
+      options.reportedBy,
+      options.reporterConfidence,
+      options.severity,
+      options.codeLocations,
+      now
+    );
+    const ingest = evaluateIngest(
+      { fingerprint: fp, category: options.category, severity: options.severity },
+      options.suppressions ?? [],
+      now
+    );
+    const findingMeta = {
+      kind: "finding",
+      title: options.title,
+      status: ingest.status,
+      version: 1,
+      reportedBy: options.reportedBy,
+      reportedAt: nowISO,
+      observations: [observation],
+      reporterConfidence: options.reporterConfidence,
+      severity: options.severity,
+      category: options.category,
+      fingerprint: fp,
+      codeLocations: options.codeLocations,
+      validations: [],
+      firstSeenAt: nowISO,
+      lastSeenAt: nowISO,
+      occurrenceCount: 1,
+      requiresHumanReview: ingest.requiresHumanReview,
+      detectionRunId: options.detectionRunId,
+      traceId: options.traceId,
+      spanId: options.spanId,
+      createdAt: nowISO,
+      updatedAt: nowISO,
+      closedReason: ingest.closedReason,
+      closedBy: ingest.closedBy,
+      closedAt: ingest.closedAt
+    };
+    const result = await createWorkItemFile({
+      repoRoot,
+      bucket: "finding",
+      title: options.title,
+      description: options.body?.trim() || "",
+      metadata: stripUndefined(findingMeta)
+    });
+    const finding = { ...findingMeta, id: result.id };
+    return {
+      id: result.id,
+      filePath: result.path,
+      finding,
+      suppressed: ingest.status === "closed"
+    };
+  });
+}
+async function readFinding(repoRoot, findingId) {
+  const findingDir = getBucketPathByKind("finding", repoRoot);
+  const safeFindingId = assertSafePathComponent(findingId, "findingId");
+  const filePath = path.join(findingDir, `${safeFindingId}.md`);
+  let finding;
+  let body;
+  try {
+    ({ yaml: finding, body } = await parseMarkdownFile(filePath));
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`Finding not found: ${findingId}`);
+    }
+    throw error;
+  }
+  return { finding: normalizeFindingForRead(finding), body, filePath };
+}
+async function updateFinding(repoRoot, findingId, expectedVersion, updates, bodyOverride) {
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, findingId, async () => {
+      const { finding, body, filePath } = await readFinding(repoRoot, findingId);
+      if (finding.version !== expectedVersion) {
+        throw new StaleVersionError(finding.version, expectedVersion, findingId);
+      }
+      const updated = {
+        ...finding,
+        ...updates,
+        version: finding.version + 1,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const nextBody = typeof bodyOverride === "string" ? bodyOverride : body;
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        nextBody
+      );
+      return updated;
+    })
+  );
+}
+async function transitionFindingStatus(repoRoot, findingId, input) {
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, findingId, async () => {
+      const { finding, body, filePath } = await readFinding(repoRoot, findingId);
+      const updated = transitionFinding({ ...input, finding });
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        body
+      );
+      return updated;
+    })
+  );
+}
+async function listFindings(repoRoot, statusFilter, closedReasonFilter) {
+  const findingDir = getBucketPathByKind("finding", repoRoot);
+  const files = await listMarkdownFiles(findingDir);
+  const results = [];
+  for (const file of files) {
+    try {
+      const { yaml: finding } = await parseMarkdownFile(file);
+      if (statusFilter && finding.status !== statusFilter) continue;
+      if (closedReasonFilter && finding.closedReason !== closedReasonFilter) continue;
+      results.push({
+        id: finding.id,
+        title: finding.title,
+        status: finding.status,
+        severity: finding.severity,
+        category: finding.category,
+        version: finding.version,
+        closedReason: finding.closedReason
+      });
+    } catch (error) {
+      warnMalformedFile(repoRoot, file, "finding", error, warnedMalformedFindingFiles);
+    }
+  }
+  return results;
+}
+async function readIssue(repoRoot, issueId) {
+  const issueDir = getBucketPathByKind("issue", repoRoot);
+  const safeIssueId = assertSafePathComponent(issueId, "issueId");
+  const filePath = path.join(issueDir, `${safeIssueId}.md`);
+  let issue;
+  let body;
+  try {
+    ({ yaml: issue, body } = await parseMarkdownFile(filePath));
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`Issue not found: ${issueId}`);
+    }
+    throw error;
+  }
+  return { issue, body, filePath };
+}
+async function transitionIssueStatus(repoRoot, issueId, input) {
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, issueId, async () => {
+      const { issue, body, filePath } = await readIssue(repoRoot, issueId);
+      const updated = transitionIssue({ ...input, issue });
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        body
+      );
+      return updated;
+    })
+  );
+}
+async function listIssues(repoRoot, statusFilter) {
+  const issueDir = getBucketPathByKind("issue", repoRoot);
+  const files = await listMarkdownFiles(issueDir);
+  const results = [];
+  for (const file of files) {
+    try {
+      const { yaml: issue } = await parseMarkdownFile(file);
+      if (statusFilter && issue.status !== statusFilter) continue;
+      results.push({
+        id: issue.id,
+        title: issue.title,
+        status: issue.status,
+        severity: issue.severity,
+        category: issue.category,
+        version: issue.version,
+        claimed: isEffectivelyClaimed(issue),
+        findingIds: issue.findingIds ?? []
+      });
+    } catch (error) {
+      warnMalformedFile(repoRoot, file, "issue", error, warnedMalformedIssueFiles);
+    }
+  }
+  return results;
+}
+var FindingPublishConsentError = class extends Error {
+  constructor(findingId) {
+    super(
+      `Refusing to promote finding ${findingId}: promotion creates a TRACKED issue whose body is copied verbatim from this local-only finding (file paths, code snippets, scanner detail) and is then committed and pushed. Re-run with explicit publish consent (--yes-publish-issue) to cross the local\u2192published boundary.`
+    );
+    this.name = "FindingPublishConsentError";
+  }
+};
+async function promoteFindingToIssue(repoRoot, findingId, actor, options = {}) {
+  if (!options.publishIssue) {
+    throw new FindingPublishConsentError(findingId);
+  }
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, findingId, async () => {
+      const { finding, body, filePath } = await readFinding(repoRoot, findingId);
+      const now = /* @__PURE__ */ new Date();
+      const issueId = generateId(now);
+      const { updatedFinding, newIssue } = promoteFinding({
+        finding,
+        issueId,
+        actor,
+        expectedVersion: finding.version,
+        now
+      });
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updatedFinding),
+        body
+      );
+      const issueDir = getBucketPathByKind("issue", repoRoot);
+      const issueFilePath = path.join(issueDir, `${issueId}.md`);
+      await writeMarkdownFile(
+        issueFilePath,
+        stripUndefined(newIssue),
+        body
+      );
+      return { finding: updatedFinding, issue: newIssue, issueFilePath };
+    })
+  );
+}
+async function renewEntityLease(repoRoot, entityId, actor, expectedVersion, leaseTtlMs) {
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, entityId, async () => {
+      const { issue, body, filePath } = await readIssue(repoRoot, entityId);
+      const updated = renewLease({
+        entity: issue,
+        actor,
+        expectedVersion,
+        leaseTtlMs
+      });
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        body
+      );
+    })
+  );
+}
+async function validateFinding(repoRoot, findingId, input, consensusConfig) {
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, findingId, async () => {
+      const { finding, body, filePath } = await readFinding(repoRoot, findingId);
+      const validation = createValidation(
+        input.validator,
+        input.verdict,
+        input.confidence,
+        input.reasoning
+      );
+      const updated = appendValidation({
+        finding,
+        validation,
+        expectedVersion: input.expectedVersion
+      });
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        body
+      );
+      const consensus = computeConsensus(updated, consensusConfig);
+      return { finding: updated, consensus };
+    })
+  );
+}
+async function getConsensus(repoRoot, findingId, consensusConfig) {
+  const { finding } = await readFinding(repoRoot, findingId);
+  return computeConsensus(finding, consensusConfig);
+}
+async function spawnTaskFromIssue(repoRoot, issueId, sprintId, actor, expectedVersion, taskOptions = {}) {
+  const { createTask } = await import("./task-manager-XAT7GOWB.js");
+  return withIndexRegeneration(
+    repoRoot,
+    () => withEntityLock(repoRoot, issueId, async () => {
+      const { issue, body, filePath } = await readIssue(repoRoot, issueId);
+      const now = /* @__PURE__ */ new Date();
+      if (issue.spawnedTask) {
+        throw new Error(`Issue ${issueId} already has spawned task: ${issue.spawnedTask}`);
+      }
+      if (issue.status !== "open" && issue.status !== "claimed") {
+        throw new Error(
+          `Cannot spawn task from issue in '${issue.status}' status (must be open or claimed)`
+        );
+      }
+      if (issue.status === "claimed") {
+        if (issue.claimedBy !== actor.actorId) {
+          throw new Error(
+            `Cannot spawn task from claimed issue ${issueId}: only claimant ${issue.claimedBy} can spawn`
+          );
+        }
+        if (!isEffectivelyClaimed(issue, now)) {
+          const expiredAt = issue.expiresAt ?? "unknown";
+          throw new Error(
+            `Cannot spawn task from claimed issue ${issueId}: lease expired at ${expiredAt}`
+          );
+        }
+      }
+      if (issue.version !== expectedVersion) {
+        throw new StaleVersionError(issue.version, expectedVersion, issueId);
+      }
+      const task = await createTask(
+        `[Issue] ${issue.title}`,
+        sprintId,
+        {
+          priority: taskOptions.priority,
+          assignee: taskOptions.assignee,
+          description: taskOptions.description || `Spawned from issue ${issueId} (${issue.category}/${issue.severity})`
+        },
+        repoRoot
+      );
+      const updated = {
+        ...issue,
+        spawnedTask: task.id,
+        spawnedTaskBy: actor,
+        spawnedTaskAt: now.toISOString(),
+        version: issue.version + 1,
+        updatedAt: now.toISOString()
+      };
+      await writeMarkdownFile(
+        filePath,
+        stripUndefined(updated),
+        body
+      );
+      return {
+        taskId: task.id,
+        issueId: issue.id,
+        issueVersion: updated.version
+      };
+    })
+  );
+}
+async function auditMalformedIssueFiles(repoRoot) {
+  const results = [];
+  const buckets = [
+    { kind: "finding", dir: getBucketPathByKind("finding", repoRoot) },
+    { kind: "issue", dir: getBucketPathByKind("issue", repoRoot) }
+  ];
+  for (const bucket of buckets) {
+    const files = await listMarkdownFiles(bucket.dir);
+    for (const file of files) {
+      try {
+        await parseMarkdownFile(file);
+      } catch (error) {
+        results.push({
+          bucket: bucket.kind,
+          filePath: path.relative(repoRoot, file),
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  return results;
+}
+function stripUndefined(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== void 0) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function normalizeFindingForRead(finding) {
+  if (Array.isArray(finding.observations) && finding.observations.length > 0) {
+    return finding;
+  }
+  return {
+    ...finding,
+    observations: getObservations(finding)
+  };
+}
+function warnMalformedFile(repoRoot, filePath, bucket, error, warnedSet) {
+  const relativePath = path.relative(repoRoot, filePath);
+  if (warnedSet.has(relativePath)) return;
+  warnedSet.add(relativePath);
+  emitWarning(
+    "CFG-002",
+    {
+      taskId: "issue-manager",
+      subsystem: "planning",
+      executionPhase: "execution"
+    },
+    {
+      severity: "WARN" /* WARN */,
+      metadata: {
+        operation: "parse-planning-item",
+        bucket,
+        file: relativePath,
+        error: error instanceof Error ? error.message : String(error)
+      }
+    }
+  );
+}
+
+// src/planning/issue-policy.ts
+import * as fs from "fs";
+import * as path2 from "path";
+import yaml from "js-yaml";
+var DEFAULT_ISSUE_POLICY = {
+  consensus: {
+    minValidations: 2,
+    confirmedThreshold: 0.67,
+    rejectedThreshold: 0.67,
+    minAverageConfidence: 0.7
+  },
+  autoPromote: {
+    enabled: true,
+    minPromotionConfidence: 0.8,
+    maxPromotesPerRun: 50,
+    gatedCategories: ["security"],
+    gatedSeverities: ["critical"]
+  },
+  ingest: {
+    maxFindingsPerBatch: 500,
+    maxOccurrencesBeforeReview: 10
+  },
+  severityPriority: {
+    critical: "P0",
+    high: "P1",
+    medium: "P2",
+    low: "P3"
+  },
+  scannerWeights: {}
+};
+function loadIssuePolicy(repoRoot = process.cwd()) {
+  const configPath = path2.join(repoRoot, ".poetic", "config", "issue-policy.yaml");
+  if (!fs.existsSync(configPath)) {
+    return { ...DEFAULT_ISSUE_POLICY };
+  }
+  try {
+    const raw = fs.readFileSync(configPath, "utf8");
+    const parsed = yaml.load(raw);
+    if (!parsed || typeof parsed !== "object") {
+      return { ...DEFAULT_ISSUE_POLICY };
+    }
+    return mergePolicy(DEFAULT_ISSUE_POLICY, parsed);
+  } catch {
+    return { ...DEFAULT_ISSUE_POLICY };
+  }
+}
+function mergePolicy(defaults, overrides) {
+  return {
+    consensus: {
+      ...defaults.consensus,
+      ...overrides.consensus ?? {}
+    },
+    autoPromote: {
+      ...defaults.autoPromote,
+      ...overrides.autoPromote ?? {}
+    },
+    ingest: {
+      ...defaults.ingest,
+      ...overrides.ingest ?? {}
+    },
+    severityPriority: {
+      ...defaults.severityPriority,
+      ...overrides.severityPriority ?? {}
+    },
+    scannerWeights: {
+      ...defaults.scannerWeights,
+      ...overrides.scannerWeights ?? {}
+    }
+  };
+}
+function isCategoryGated(category, policy = DEFAULT_ISSUE_POLICY) {
+  return policy.autoPromote.gatedCategories.includes(category);
+}
+function isSeverityGated(severity, policy = DEFAULT_ISSUE_POLICY) {
+  if (!severity) return false;
+  return policy.autoPromote.gatedSeverities.includes(severity);
+}
+function severityToPriority(severity, policy = DEFAULT_ISSUE_POLICY) {
+  if (!severity) return null;
+  return policy.severityPriority[severity] ?? null;
+}
+function applyWeight(confidence, provider, policy = DEFAULT_ISSUE_POLICY) {
+  if (!Number.isFinite(confidence)) {
+    throw new Error(`Confidence must be a finite number, received: ${String(confidence)}`);
+  }
+  const rawWeight = policy.scannerWeights[provider];
+  const weight = Number.isFinite(rawWeight) && rawWeight >= 0 ? rawWeight : 1;
+  return Math.max(0, Math.min(1, confidence * weight));
+}
+function exceedsBatchBudget(candidateCount, policy = DEFAULT_ISSUE_POLICY) {
+  return candidateCount > policy.ingest.maxFindingsPerBatch;
+}
+
+export {
+  normalizePath,
+  generateFingerprint,
+  findDuplicate,
+  trackOccurrence,
+  appendObservation,
+  getObservations,
+  computeAgreement,
+  computeConsensus,
+  createObservation,
+  createFinding,
+  readFinding,
+  updateFinding,
+  transitionFindingStatus,
+  listFindings,
+  readIssue,
+  transitionIssueStatus,
+  listIssues,
+  promoteFindingToIssue,
+  renewEntityLease,
+  validateFinding,
+  getConsensus,
+  spawnTaskFromIssue,
+  auditMalformedIssueFiles,
+  loadIssuePolicy,
+  isCategoryGated,
+  isSeverityGated,
+  severityToPriority,
+  applyWeight,
+  exceedsBatchBudget
+};
+//# sourceMappingURL=chunk-BZU2O43F.js.map