@unbrained/pm-cli 2026.10.11 → 2026.10.13

package/dist/sdk/governance/defect-recurrence.d.ts

@@ -11,232 +11,232 @@ export type DefectEscapeClass = (typeof DEFECT_ESCAPE_CLASSES)[number];
 export type DefectGateEvidenceDisposition = (typeof DEFECT_GATE_EVIDENCE_DISPOSITIONS)[number];
 /** Structured proof attached to a terminal defect item. */
 export interface DefectGateEvidence {
-    /** Whether a gate was added, strengthened, or explicitly waived. */
-    disposition: DefectGateEvidenceDisposition;
-    /** Stable gate identifier, except for an explicit waiver. */
-    gate_id?: string;
-    /** Runnable negative-control command that proves the gate can fail. */
-    negative_control?: string;
-    /** Local checks selected by the same recurrence policy as hosted checks. */
-    local_checks?: string[];
-    /** Hosted checks selected by the same recurrence policy as local checks. */
-    hosted_checks?: string[];
-    /** Accountable owner of the gate or waiver. */
-    owner: string;
-    /** Concrete reason for an explicit waiver. */
-    waiver_reason?: string;
-    /** ISO timestamp after which an explicit waiver is invalid. */
-    waiver_expires_at?: string;
+/** Whether a gate was added, strengthened, or explicitly waived. */
+disposition: DefectGateEvidenceDisposition;
+/** Stable gate identifier, except for an explicit waiver. */
+gate_id?: string;
+/** Runnable negative-control command that proves the gate can fail. */
+negative_control?: string;
+/** Local checks selected by the same recurrence policy as hosted checks. */
+local_checks?: string[];
+/** Hosted checks selected by the same recurrence policy as local checks. */
+hosted_checks?: string[];
+/** Accountable owner of the gate or waiver. */
+owner: string;
+/** Concrete reason for an explicit waiver. */
+waiver_reason?: string;
+/** ISO timestamp after which an explicit waiver is invalid. */
+waiver_expires_at?: string;
 }
 /** Signals that associate a family with source changes or PM context. */
 export interface DefectRecurrenceTriggers {
-    /** Repository-relative glob patterns. */
-    file_patterns?: string[];
-    /** Package names or workspace package paths. */
-    package_names?: string[];
-    /** Canonical PM item ids. */
-    item_ids?: string[];
-    /** PM tags. */
-    tags?: string[];
-    /** Stable error-code contracts. */
-    error_codes?: string[];
+/** Repository-relative glob patterns. */
+file_patterns?: string[];
+/** Package names or workspace package paths. */
+package_names?: string[];
+/** Canonical PM item ids. */
+item_ids?: string[];
+/** PM tags. */
+tags?: string[];
+/** Stable error-code contracts. */
+error_codes?: string[];
 }
 /** Local and hosted checks selected together for one recurrence family. */
 export interface DefectRecurrenceChecks {
-    /** Fast checks suitable for local development. */
-    local: string[];
-    /** Hosted checks that add independent or environment-specific evidence. */
-    hosted: string[];
+/** Fast checks suitable for local development. */
+local: string[];
+/** Hosted checks that add independent or environment-specific evidence. */
+hosted: string[];
 }
 /** Budget that makes an assurance family measurable over time. */
 export interface DefectRecurrenceBudget {
-    /** Maximum accepted escaped-defect rate. */
-    max_escape_rate: number;
-    /** Maximum accepted false-positive rate. */
-    max_false_positive_rate: number;
+/** Maximum accepted escaped-defect rate. */
+max_escape_rate: number;
+/** Maximum accepted false-positive rate. */
+max_false_positive_rate: number;
 }
 /** Versioned recurrence policy for one historically observed defect family. */
 export interface DefectRecurrenceFamily {
-    /** Stable family identifier. */
-    id: string;
-    /** Monotonic family contract version. */
-    version: number;
-    /** Concise human-readable title. */
-    title: string;
-    /** PM item accountable for maintaining this family. */
-    owner_item_id: string;
-    /** Escape class represented by the historical examples. */
-    escape_class: DefectEscapeClass;
-    /** Signals that select this family. */
-    triggers: DefectRecurrenceTriggers;
-    /** Shared local and hosted assurance policy. */
-    checks: DefectRecurrenceChecks;
-    /** Input that must select this family during policy validation. */
-    negative_control: DefectChangeRiskInput;
-    /** Historical items that justify the family. */
-    historical_item_ids: string[];
-    /** Quantitative escape and false-positive budgets. */
-    budget: DefectRecurrenceBudget;
+/** Stable family identifier. */
+id: string;
+/** Monotonic family contract version. */
+version: number;
+/** Concise human-readable title. */
+title: string;
+/** PM item accountable for maintaining this family. */
+owner_item_id: string;
+/** Escape class represented by the historical examples. */
+escape_class: DefectEscapeClass;
+/** Signals that select this family. */
+triggers: DefectRecurrenceTriggers;
+/** Shared local and hosted assurance policy. */
+checks: DefectRecurrenceChecks;
+/** Input that must select this family during policy validation. */
+negative_control: DefectChangeRiskInput;
+/** Historical items that justify the family. */
+historical_item_ids: string[];
+/** Quantitative escape and false-positive budgets. */
+budget: DefectRecurrenceBudget;
 }
 /** Repository recurrence policy serialized by a project or extension. */
 export interface DefectRecurrencePolicy {
-    /** Serialized policy format version. */
-    version: 1;
-    /** ISO instant after which terminal defects require structured evidence. */
-    evidence_epoch: string;
-    /** Versioned recurrence families. */
-    families: DefectRecurrenceFamily[];
+/** Serialized policy format version. */
+version: 1;
+/** ISO instant after which terminal defects require structured evidence. */
+evidence_epoch: string;
+/** Versioned recurrence families. */
+families: DefectRecurrenceFamily[];
 }
 /** Input used to explain assurance requirements for a proposed change. */
 export interface DefectChangeRiskInput {
-    /** Changed repository-relative files. */
-    files?: string[];
-    /** Changed package names or workspace package paths. */
-    package_names?: string[];
-    /** PM items in the change lineage. */
-    item_ids?: string[];
-    /** PM tags in the change lineage. */
-    tags?: string[];
-    /** Error-code contracts touched by the change. */
-    error_codes?: string[];
+/** Changed repository-relative files. */
+files?: string[];
+/** Changed package names or workspace package paths. */
+package_names?: string[];
+/** PM items in the change lineage. */
+item_ids?: string[];
+/** PM tags in the change lineage. */
+tags?: string[];
+/** Error-code contracts touched by the change. */
+error_codes?: string[];
 }
 /** Options for a full or incremental recurrence-index build. */
 export interface BuildDefectRecurrenceIndexOptions {
-    /** Previous index whose unaffected item mappings can be reused. */
-    previous_index?: DefectRecurrenceIndex;
-    /** Item ids replaced by the supplied item projection. */
-    changed_item_ids?: string[];
+/** Previous index whose unaffected item mappings can be reused. */
+previous_index?: DefectRecurrenceIndex;
+/** Item ids replaced by the supplied item projection. */
+changed_item_ids?: string[];
 }
 /** Deterministic recurrence index shared by CLI, SDK, MCP, and CI. */
 export interface DefectRecurrenceIndex {
-    /** Index format version. */
-    version: 1;
-    /** Hash of the policy used to build the index. */
-    policy_fingerprint: string;
-    /** Hash of policy plus deterministic item-to-family contributions. */
-    index_fingerprint: string;
-    /** Stable family definitions. */
-    families: DefectRecurrenceFamily[];
-    /** Sparse PM item-to-family index. */
-    item_families: Record<string, string[]>;
-    /** Direct signal matches retained separately so removing an edge removes inherited matches. */
-    direct_item_families?: Record<string, string[]>;
-    /** Sparse recurrence and linked-file evidence retained for incremental graph updates. */
-    recurrence_records?: Record<string, DefectRecurrenceRecord>;
-    /** Exact project file matches inherited from explicitly registered recurrence lineages. */
-    file_families?: Record<string, string[]>;
-    /** Build-cost receipt. */
-    build: {
-        /** Items inspected during this build. */
-        items_scanned: number;
-        /** Unchanged item mappings reused from a previous index. */
-        items_reused: number;
-        /** Items with at least one recurrence family. */
-        items_indexed: number;
-    };
+/** Index format version. */
+version: 1;
+/** Hash of the policy used to build the index. */
+policy_fingerprint: string;
+/** Hash of policy plus deterministic item-to-family contributions. */
+index_fingerprint: string;
+/** Stable family definitions. */
+families: DefectRecurrenceFamily[];
+/** Sparse PM item-to-family index. */
+item_families: Record<string, string[]>;
+/** Direct signal matches retained separately so removing an edge removes inherited matches. */
+direct_item_families?: Record<string, string[]>;
+/** Sparse recurrence and linked-file evidence retained for incremental graph updates. */
+recurrence_records?: Record<string, DefectRecurrenceRecord>;
+/** Exact project file matches inherited from explicitly registered recurrence lineages. */
+file_families?: Record<string, string[]>;
+/** Build-cost receipt. */
+build: {
+/** Items inspected during this build. */
+items_scanned: number;
+/** Unchanged item mappings reused from a previous index. */
+items_reused: number;
+/** Items with at least one recurrence family. */
+items_indexed: number;
+};
 }
 /** One explainable reason that selected an assurance family. */
 export interface DefectChangeRiskReason {
-    /** Signal category that matched. */
-    signal: "file" | "package" | "item" | "tag" | "error_code";
-    /** Submitted signal value. */
-    value: string;
-    /** Policy trigger or indexed item that matched. */
-    matched: string;
+/** Signal category that matched. */
+signal: "file" | "package" | "item" | "tag" | "error_code";
+/** Submitted signal value. */
+value: string;
+/** Policy trigger or indexed item that matched. */
+matched: string;
 }
 /** One selected recurrence family and its evidence requirements. */
 export interface DefectChangeRiskMatch {
-    /** Stable family identifier. */
-    family_id: string;
-    /** Family contract version. */
-    family_version: number;
-    /** Accountable PM item. */
-    owner_item_id: string;
-    /** Historical escape class. */
-    escape_class: DefectEscapeClass;
-    /** Exact selection reasons. */
-    reasons: DefectChangeRiskReason[];
-    /** Required local checks. */
-    local_checks: string[];
-    /** Required hosted checks. */
-    hosted_checks: string[];
-    /** Quantitative policy budget. */
-    budget: DefectRecurrenceBudget;
+/** Stable family identifier. */
+family_id: string;
+/** Family contract version. */
+family_version: number;
+/** Accountable PM item. */
+owner_item_id: string;
+/** Historical escape class. */
+escape_class: DefectEscapeClass;
+/** Exact selection reasons. */
+reasons: DefectChangeRiskReason[];
+/** Required local checks. */
+local_checks: string[];
+/** Required hosted checks. */
+hosted_checks: string[];
+/** Quantitative policy budget. */
+budget: DefectRecurrenceBudget;
 }
 /** Pagination controls for bounded change-risk output. */
 export interface AnalyzeDefectChangeRiskOptions {
-    /** Opaque cursor returned by a previous report. */
-    cursor?: string;
-    /** Maximum family rows returned, from 1 through 100. */
-    limit?: number;
+/** Opaque cursor returned by a previous report. */
+cursor?: string;
+/** Maximum family rows returned, from 1 through 100. */
+limit?: number;
 }
 /** Serialized assurance-risk request shared by CLI, SDK, and MCP transports. */
 export interface DefectChangeRiskRequest {
-    /** Project- or package-owned recurrence policy. */
-    policy: DefectRecurrencePolicy;
-    /** Proposed source and PM-context changes. */
-    change: DefectChangeRiskInput;
-    /** Opaque cursor returned by a previous report. */
-    cursor?: string;
-    /** Maximum family rows returned, from 1 through 100. */
-    limit?: number;
+/** Project- or package-owned recurrence policy. */
+policy: DefectRecurrencePolicy;
+/** Proposed source and PM-context changes. */
+change: DefectChangeRiskInput;
+/** Opaque cursor returned by a previous report. */
+cursor?: string;
+/** Maximum family rows returned, from 1 through 100. */
+limit?: number;
 }
 /** Bounded and explainable change-risk report. */
 export interface DefectChangeRiskReport {
-    /** Whether at least one historical family was selected. */
-    risk_detected: boolean;
-    /** Stable recurrence-index identity. */
-    index_fingerprint: string;
-    /** Current page of selected families. */
-    items: DefectChangeRiskMatch[];
-    /** Total selected families before pagination. */
-    total: number;
-    /** Opaque continuation cursor when rows remain. */
-    next_cursor?: string;
-    /** Deduplicated local checks across every selected family. */
-    required_local_checks: string[];
-    /** Deduplicated hosted checks across every selected family. */
-    required_hosted_checks: string[];
-    /** Deterministic analysis-cost receipt. */
-    cost: {
-        /** Families evaluated. */
-        families_evaluated: number;
-        /** Submitted signals evaluated against the policy. */
-        signals_evaluated: number;
-        /** Selected families before pagination. */
-        families_selected: number;
-        /** Approximate JSON-token cost of the bounded response. */
-        estimated_output_tokens: number;
-    };
-    /** Stable collection selector for agent consumers. */
-    row_contract: {
-        row_keys: ["items"];
-        jq_selector: ".items[]";
-    };
+/** Whether at least one historical family was selected. */
+risk_detected: boolean;
+/** Stable recurrence-index identity. */
+index_fingerprint: string;
+/** Current page of selected families. */
+items: DefectChangeRiskMatch[];
+/** Total selected families before pagination. */
+total: number;
+/** Opaque continuation cursor when rows remain. */
+next_cursor?: string;
+/** Deduplicated local checks across every selected family. */
+required_local_checks: string[];
+/** Deduplicated hosted checks across every selected family. */
+required_hosted_checks: string[];
+/** Deterministic analysis-cost receipt. */
+cost: {
+/** Families evaluated. */
+families_evaluated: number;
+/** Submitted signals evaluated against the policy. */
+signals_evaluated: number;
+/** Selected families before pagination. */
+families_selected: number;
+/** Approximate JSON-token cost of the bounded response. */
+estimated_output_tokens: number;
+};
+/** Stable collection selector for agent consumers. */
+row_contract: {
+row_keys: ["items"];
+jq_selector: ".items[]";
+};
 }
 /** One fail-closed defect-evidence finding. */
 export interface DefectGateEvidenceFinding {
-    /** PM item missing or carrying invalid evidence. */
-    item_id: string;
-    /** Stable machine-readable finding kind. */
-    kind: "missing_escape_class" | "invalid_escape_class" | "invalid_completion_timestamp" | "missing_gate_evidence" | "invalid_gate_evidence" | "expired_waiver";
-    /** Actionable explanation. */
-    detail: string;
+/** PM item missing or carrying invalid evidence. */
+item_id: string;
+/** Stable machine-readable finding kind. */
+kind: "missing_escape_class" | "invalid_escape_class" | "invalid_completion_timestamp" | "missing_gate_evidence" | "invalid_gate_evidence" | "expired_waiver";
+/** Actionable explanation. */
+detail: string;
 }
 /** Fail-closed governance report for terminal defects after the policy epoch. */
 export interface DefectGateEvidenceReport {
-    /** Whether every governed defect carried valid evidence. */
-    ok: boolean;
-    /** Terminal defect items governed by the epoch. */
-    governed_item_count: number;
-    /** Terminal defects carrying a recognized historical escape classification. */
-    classified_item_count: number;
-    /** Historical and epoch-governed counts by required escape class. */
-    class_counts: Record<DefectEscapeClass, number>;
-    /** Historical and epoch-governed counts by evidence disposition. */
-    evidence_disposition_counts: Record<DefectGateEvidenceDisposition, number>;
-    /** Stable sorted findings. */
-    findings: DefectGateEvidenceFinding[];
+/** Whether every governed defect carried valid evidence. */
+ok: boolean;
+/** Terminal defect items governed by the epoch. */
+governed_item_count: number;
+/** Terminal defects carrying a recognized historical escape classification. */
+classified_item_count: number;
+/** Historical and epoch-governed counts by required escape class. */
+class_counts: Record<DefectEscapeClass, number>;
+/** Historical and epoch-governed counts by evidence disposition. */
+evidence_disposition_counts: Record<DefectGateEvidenceDisposition, number>;
+/** Stable sorted findings. */
+findings: DefectGateEvidenceFinding[];
 }
 /** Compile deterministic policy and PM metadata into a sparse incremental index. */
 export declare function buildDefectRecurrenceIndex(policy: DefectRecurrencePolicy, items: readonly AssuranceItemRecord[], options?: BuildDefectRecurrenceIndexOptions): DefectRecurrenceIndex;
@@ -244,6 +244,11 @@ export declare function buildDefectRecurrenceIndex(policy: DefectRecurrencePolic
 export declare function analyzeDefectChangeRisk(index: DefectRecurrenceIndex, input: DefectChangeRiskInput, options?: AnalyzeDefectChangeRiskOptions): DefectChangeRiskReport;
 /** Enforce structured escape classification and gate evidence on new terminal defects. */
 export declare function evaluateDefectGateEvidence(items: readonly AssuranceItemRecord[], policy: DefectRecurrencePolicy, terminalStatuses: readonly string[], now?: Date): DefectGateEvidenceReport;
+/** A policy-stage validation failure, distinguishable from other request TypeErrors. */
+export declare class DefectRecurrencePolicyParseError extends TypeError {
+/** Stable stage identity for consumers combining different SDK entrypoints. */
+readonly code = "defect_recurrence_policy_invalid";
+}
 /** Parse an untrusted serialized policy without weakening runtime validation. */
 export declare function parseDefectRecurrencePolicy(value: unknown): DefectRecurrencePolicy;
 /** Parse an untrusted cross-transport change-risk request. */

package/dist/sdk/governance/defect-recurrence.js

@@ -1,2 +1,2 @@
-(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9088773-9fcf-5dc9-b10d-32e2490c5ba8")}catch{}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{defectRecurrenceItemSignals}from"./defect-recurrence-signals.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";const DEFECT_ESCAPE_CLASSES=["production_defect","nightly_regression","scanner_finding","review_caught_late"],DEFECT_GATE_EVIDENCE_DISPOSITIONS=["gate_added","gate_strengthened","explicit_waiver"],MAX_FILE_PATTERN_LENGTH=256,MAX_COMPILED_PATH_PATTERNS=1024,compiledPathPatterns=new Map,CHANGE_INPUT_FIELDS=["files","package_names","item_ids","tags","error_codes"];function uniqueSorted(values){return[...new Set(values.map(value=>value.trim()).filter(Boolean))].sort((left,right)=>left<right?-1:1)}function fingerprint(value){return createHash("sha256").update(stableStringify(value)).digest("hex")}function assertNonEmpty(value,field){if(typeof value!="string"||!value.trim())throw new TypeError(`${field} must be a non-empty string`)}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(entry=>typeof entry=="string")}function assertChangeInput(value,field){if(!isRecord(value))throw new TypeError(`${field} must be an object`);for(const key of CHANGE_INPUT_FIELDS)if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`${field}.${key} must be an array of strings`);return value}function assertTriggers(value,familyId){if(!isRecord(value))throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`);for(const key of["package_names","item_ids","tags","error_codes"])if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`);const filePatterns=value.file_patterns;if(filePatterns!==void 0&&!isStringArray(filePatterns))throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`);for(const pattern of filePatterns??[])if(pattern.length>MAX_FILE_PATTERN_LENGTH)throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`)}function assertFamilyIdentity(family,ids){if(assertNonEmpty(family.id,"defect recurrence family id"),ids.has(family.id))throw new TypeError(`Duplicate defect recurrence family ${family.id}`);if(ids.add(family.id),!Number.isInteger(family.version)||family.version<1)throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`);if(!DEFECT_ESCAPE_CLASSES.includes(family.escape_class))throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`);assertNonEmpty(family.title,`defect recurrence family ${family.id} title`),assertNonEmpty(family.owner_item_id,`defect recurrence family ${family.id} owner_item_id`)}function assertFamilyEvidenceContracts(family){if(!isStringArray(family.historical_item_ids)||family.historical_item_ids.length===0||family.historical_item_ids.some(itemId=>!itemId.trim()))throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`);if(assertTriggers(family.triggers,family.id),!isRecord(family.checks)||!isStringArray(family.checks.local)||!isStringArray(family.checks.hosted)||family.checks.local.length===0||family.checks.hosted.length===0||family.checks.local.some(check=>!check.trim())||family.checks.hosted.some(check=>!check.trim()))throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`)}function assertFamilyBudget(family){if(!isRecord(family.budget)||typeof family.budget.max_escape_rate!="number"||!Number.isFinite(family.budget.max_escape_rate)||typeof family.budget.max_false_positive_rate!="number"||!Number.isFinite(family.budget.max_false_positive_rate))throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`);if(family.budget.max_escape_rate<0||family.budget.max_escape_rate>1||family.budget.max_false_positive_rate<0||family.budget.max_false_positive_rate>1)throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`)}function assertFamilyNegativeControl(family){const negativeControl=assertChangeInput(family.negative_control,`defect recurrence family ${family.id} negative_control`);if(familyReasons(family,negativeControl,{}).length===0)throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`)}function validatePolicy(policy){if(policy.version!==1)throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`);if(typeof policy.evidence_epoch!="string"||!Number.isFinite(Date.parse(policy.evidence_epoch)))throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp");const ids=new Set;for(const family of policy.families){if(!isRecord(family))throw new TypeError("defect recurrence family must be an object");assertFamilyIdentity(family,ids),assertFamilyEvidenceContracts(family),assertFamilyBudget(family),assertFamilyNegativeControl(family)}}function pathMatches(pattern,value){let compiled=compiledPathPatterns.get(pattern);if(compiled===void 0){if(compiledPathPatterns.size>=MAX_COMPILED_PATH_PATTERNS){const oldest=compiledPathPatterns.keys().next().value;compiledPathPatterns.delete(oldest)}const escaped=pattern.replaceAll("**","\0").replaceAll(/[|\\{}()[\]^$+?./]/gu,"\\$&").replaceAll("*","[^/]*").replaceAll("\0",".*");compiled=new RegExp(`^${escaped}$`,"u"),compiledPathPatterns.set(pattern,compiled)}return compiled.test(value)}function fileReasons(family,input){const reasons=[],patterns=uniqueSorted(family.triggers.file_patterns??[]);for(const file of uniqueSorted(input.files??[]))for(const pattern of patterns)pathMatches(pattern,file)&&reasons.push({signal:"file",value:file,matched:pattern});return reasons}function exactReasons(family,input){const exactSignals=[{signal:"package",values:uniqueSorted(input.package_names??[]),triggers:uniqueSorted(family.triggers.package_names??[])},{signal:"tag",values:uniqueSorted(input.tags??[]),triggers:uniqueSorted(family.triggers.tags??[])},{signal:"error_code",values:uniqueSorted(input.error_codes??[]),triggers:uniqueSorted(family.triggers.error_codes??[])}],reasons=[];for(const exact of exactSignals){const triggerSet=new Set(exact.triggers);for(const value of exact.values)triggerSet.has(value)&&reasons.push({signal:exact.signal,value,matched:value})}return reasons}function itemReasons(family,input,itemFamilies){const directItemIds=new Set(family.triggers.item_ids??[]);return uniqueSorted(input.item_ids??[]).flatMap(itemId=>directItemIds.has(itemId)||Object.hasOwn(itemFamilies,itemId)&&itemFamilies[itemId].includes(family.id)?[{signal:"item",value:itemId,matched:family.id}]:[])}function familyReasons(family,input,itemFamilies){return[...fileReasons(family,input),...exactReasons(family,input),...itemReasons(family,input,itemFamilies)]}function readRiskCursorOffset(cursor,indexFingerprint){if(!cursor)return 0;let parsed;try{parsed=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("defect change-risk cursor is invalid")}if(typeof parsed!="object"||parsed===null||Array.isArray(parsed)||parsed.index_fingerprint!==indexFingerprint||!Number.isInteger(parsed.offset)||parsed.offset<0)throw new TypeError("defect change-risk cursor does not match this index");return parsed.offset}function changeSignalCount(input){return[input.files,input.package_names,input.item_ids,input.tags,input.error_codes].reduce((total,values)=>total+(values?.length??0),0)}function inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies){const graph=buildDefectRecurrenceGraph(families,recurrenceRecords),fileFamilies=new Map;for(const lineage of graph.lineages)if(lineage.family_ids.length!==0)for(const id of lineage.item_ids){itemFamilies[id]=uniqueSorted([...Object.hasOwn(itemFamilies,id)?itemFamilies[id]:[],...lineage.family_ids]);for(const file of recurrenceRecords.get(id)?.files??[]){const matched=fileFamilies.get(file)??new Set;for(const familyId of lineage.family_ids)matched.add(familyId);fileFamilies.set(file,matched)}}return fileFamilies}function refreshRecurrenceRecords(recurrenceRecords,items){for(const item of items){const record=readDefectRecurrenceRecord(item);record===void 0?recurrenceRecords.delete(item.id):recurrenceRecords.set(item.id,record)}}function compileDirectItemSeeds(families){const historical=new Map,triggers=new Map;for(const family of families)for(const[index,ids]of[[historical,family.historical_item_ids],[triggers,family.triggers.item_ids??[]]])for(const id of ids){const matches=index.get(id)??new Set;matches.add(family.id),index.set(id,matches)}return{historical,triggers}}function directItemMatches(item,families,seeds){const signals=defectRecurrenceItemSignals(item);return[signals.files,signals.package_names,signals.tags,signals.error_codes].some(values=>values&&values.length>0)?families.filter(family=>family.historical_item_ids.includes(item.id)||familyReasons(family,signals,{}).length>0).map(family=>family.id):uniqueSorted([...seeds.historical.get(item.id)??[],...seeds.triggers.get(item.id.trim())??[]])}function buildDefectRecurrenceIndex(policy,items,options={}){validatePolicy(policy);const families=[...policy.families].sort((left,right)=>left.id<right.id?-1:1),policyFingerprint=fingerprint({...policy,families}),changed=new Set(options.changed_item_ids??[]),canReuse=options.previous_index?.policy_fingerprint===policyFingerprint,itemFamilies=Object.assign(Object.create(null),canReuse?Object.fromEntries(Object.entries(options.previous_index?.direct_item_families??options.previous_index?.item_families??{}).filter(([itemId])=>!changed.has(itemId))):{}),itemsReused=canReuse?Object.keys(itemFamilies).length:0,seeds=compileDirectItemSeeds(families);for(const item of items){const matched=directItemMatches(item,families,seeds);matched.length>0?itemFamilies[item.id]=matched:delete itemFamilies[item.id]}const directItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1)),recurrenceRecords=new Map(canReuse?Object.entries(options.previous_index?.recurrence_records??{}).filter(([id])=>!changed.has(id)):[]);refreshRecurrenceRecords(recurrenceRecords,items);const fileFamilies=inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies),sortedRecords=Object.fromEntries([...recurrenceRecords].sort(([left],[right])=>left<right?-1:1)),sortedFileFamilies=Object.fromEntries([...fileFamilies].sort(([left],[right])=>left<right?-1:1).map(([file,matches])=>[file,[...matches].sort()])),sortedItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1).map(([itemId,familyIds])=>[itemId,uniqueSorted(familyIds)]));return{version:1,policy_fingerprint:policyFingerprint,index_fingerprint:fingerprint({policy_fingerprint:policyFingerprint,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies}),families,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies,build:{items_scanned:items.length,items_reused:itemsReused,items_indexed:Object.keys(sortedItemFamilies).length}}}function analyzeDefectChangeRisk(index,input,options={}){const limit=options.limit??25;if(!Number.isInteger(limit)||limit<1||limit>100)throw new TypeError("defect change-risk limit must be an integer from 1 through 100");const offset=readRiskCursorOffset(options.cursor,index.index_fingerprint),matches=index.families.flatMap(family=>{const reasons=familyReasons(family,input,index.item_families);for(const file of uniqueSorted(input.files??[]))index.file_families&&Object.hasOwn(index.file_families,file)&&index.file_families[file].includes(family.id)&&reasons.push({signal:"file",value:file,matched:`recurs_from:${family.id}`});return reasons.sort((left,right)=>left.signal!==right.signal?left.signal.localeCompare(right.signal):left.value!==right.value?left.value.localeCompare(right.value):left.matched.localeCompare(right.matched)),reasons.length===0?[]:[{family_id:family.id,family_version:family.version,owner_item_id:family.owner_item_id,escape_class:family.escape_class,reasons,local_checks:uniqueSorted(family.checks.local),hosted_checks:uniqueSorted(family.checks.hosted),budget:family.budget}]}),page=matches.slice(offset,offset+limit),nextOffset=offset+page.length,nextCursor=nextOffset<matches.length?Buffer.from(JSON.stringify({index_fingerprint:index.index_fingerprint,offset:nextOffset})).toString("base64url"):void 0,reportWithoutCost={risk_detected:matches.length>0,index_fingerprint:index.index_fingerprint,items:page,total:matches.length,...nextCursor?{next_cursor:nextCursor}:{},required_local_checks:uniqueSorted(matches.flatMap(match=>match.local_checks)),required_hosted_checks:uniqueSorted(matches.flatMap(match=>match.hosted_checks)),row_contract:{row_keys:["items"],jq_selector:".items[]"}};return{...reportWithoutCost,cost:{families_evaluated:index.families.length,signals_evaluated:changeSignalCount(input),families_selected:matches.length,estimated_output_tokens:Math.ceil(JSON.stringify(reportWithoutCost).length/4)}}}function isDefectItem(item){return typeof item.type=="string"&&item.type.toLowerCase()==="issue"||(Array.isArray(item.tags)?item.tags:[]).some(tag=>typeof tag=="string"&&["bug","defect","security"].includes(tag.toLowerCase()))}function nonEmptyString(value){return typeof value=="string"&&value.trim().length>0}function nonEmptyStringArray(value){return Array.isArray(value)&&value.length>0&&value.every(nonEmptyString)}function validEvidence(value,nowMs){if(typeof value!="object"||value===null||Array.isArray(value))return{valid:!1,expired:!1};const evidence=value;if(!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition)||typeof evidence.owner!="string"||!evidence.owner.trim())return{valid:!1,expired:!1};if(evidence.disposition==="explicit_waiver"){const expiry=Date.parse(evidence.waiver_expires_at??"");return{valid:nonEmptyString(evidence.waiver_reason)&&Number.isFinite(expiry)&&expiry>=nowMs,expired:Number.isFinite(expiry)&&expiry<nowMs}}return{valid:nonEmptyString(evidence.gate_id)&&nonEmptyString(evidence.negative_control)&&nonEmptyStringArray(evidence.local_checks)&&nonEmptyStringArray(evidence.hosted_checks),expired:!1}}function evidenceFindings(item,nowMs){const findings=[];if(!Number.isFinite(Date.parse(typeof item.completed_at=="string"?item.completed_at:""))&&!Number.isFinite(Date.parse(typeof item.closed_at=="string"?item.closed_at:""))&&findings.push({item_id:item.id,kind:"invalid_completion_timestamp",detail:`${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`}),typeof item.escape_class!="string"?findings.push({item_id:item.id,kind:"missing_escape_class",detail:`${item.id} requires escape_class after the defect-evidence epoch.`}):DEFECT_ESCAPE_CLASSES.includes(item.escape_class)||findings.push({item_id:item.id,kind:"invalid_escape_class",detail:`${item.id} has unsupported escape_class ${item.escape_class}.`}),item.gate_evidence===void 0)return findings.push({item_id:item.id,kind:"missing_gate_evidence",detail:`${item.id} requires structured gate_evidence after the defect-evidence epoch.`}),findings;const result=validEvidence(item.gate_evidence,nowMs);return result.valid||findings.push({item_id:item.id,kind:result.expired?"expired_waiver":"invalid_gate_evidence",detail:result.expired?`${item.id} carries an expired gate-evidence waiver.`:`${item.id} gate_evidence does not prove a gate or explicit waiver.`}),findings}function evaluateDefectGateEvidence(items,policy,terminalStatuses,now=new Date){validatePolicy(policy);const epochMs=Date.parse(policy.evidence_epoch),terminal=new Set(terminalStatuses),terminalDefects=items.filter(item=>terminal.has(item.status)&&isDefectItem(item)),governed=terminalDefects.filter(item=>{const completedAt=Date.parse(typeof item.completed_at=="string"?item.completed_at:"");if(Number.isFinite(completedAt))return completedAt>=epochMs;const closedAt=Date.parse(typeof item.closed_at=="string"?item.closed_at:"");if(Number.isFinite(closedAt))return closedAt>=epochMs;const createdAt=Date.parse(typeof item.created_at=="string"?item.created_at:"");return!Number.isFinite(createdAt)||createdAt>=epochMs}),classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(escapeClass=>[escapeClass,0])),evidenceDispositionCounts=Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map(disposition=>[disposition,0])),classified=terminalDefects.filter(item=>typeof item.escape_class=="string"&&DEFECT_ESCAPE_CLASSES.includes(item.escape_class));for(const item of classified)if(classCounts[item.escape_class]+=1,typeof item.gate_evidence=="object"&&item.gate_evidence!==null&&!Array.isArray(item.gate_evidence)){const disposition=item.gate_evidence.disposition;typeof disposition=="string"&&DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)&&(evidenceDispositionCounts[disposition]+=1)}const findings=governed.flatMap(item=>evidenceFindings(item,now.getTime()));return findings.sort((left,right)=>left.item_id!==right.item_id?left.item_id.localeCompare(right.item_id):left.kind.localeCompare(right.kind)),{ok:findings.length===0,governed_item_count:governed.length,classified_item_count:classified.length,class_counts:classCounts,evidence_disposition_counts:evidenceDispositionCounts,findings}}function parseDefectRecurrencePolicy(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect recurrence policy must be an object");const policy=value;if(!Array.isArray(policy.families))throw new TypeError("defect recurrence policy families must be an array");return validatePolicy(policy),policy}function parseDefectChangeRiskRequest(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect change-risk request must be an object");const request=value,change=assertChangeInput(request.change,"defect change-risk request.change");if(request.cursor!==void 0&&typeof request.cursor!="string")throw new TypeError("defect change-risk request.cursor must be a string");if(request.limit!==void 0&&!Number.isInteger(request.limit))throw new TypeError("defect change-risk request.limit must be an integer");return{policy:parseDefectRecurrencePolicy(request.policy),change,...request.cursor===void 0?{}:{cursor:request.cursor},...request.limit===void 0?{}:{limit:request.limit}}}export{DEFECT_ESCAPE_CLASSES,DEFECT_GATE_EVIDENCE_DISPOSITIONS,analyzeDefectChangeRisk,buildDefectRecurrenceIndex,evaluateDefectGateEvidence,parseDefectChangeRiskRequest,parseDefectRecurrencePolicy};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7c2b78e7-57ce-56de-b827-8896e38cfb60")}catch{}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{defectRecurrenceItemSignals}from"./defect-recurrence-signals.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";const DEFECT_ESCAPE_CLASSES=["production_defect","nightly_regression","scanner_finding","review_caught_late"],DEFECT_GATE_EVIDENCE_DISPOSITIONS=["gate_added","gate_strengthened","explicit_waiver"],MAX_FILE_PATTERN_LENGTH=256,MAX_COMPILED_PATH_PATTERNS=1024,compiledPathPatterns=new Map,CHANGE_INPUT_FIELDS=["files","package_names","item_ids","tags","error_codes"];function uniqueSorted(values){return[...new Set(values.map(value=>value.trim()).filter(Boolean))].sort((left,right)=>left<right?-1:1)}function fingerprint(value){return createHash("sha256").update(stableStringify(value)).digest("hex")}function assertNonEmpty(value,field){if(typeof value!="string"||!value.trim())throw new TypeError(`${field} must be a non-empty string`)}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(entry=>typeof entry=="string")}function assertChangeInput(value,field){if(!isRecord(value))throw new TypeError(`${field} must be an object`);for(const key of CHANGE_INPUT_FIELDS)if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`${field}.${key} must be an array of strings`);return value}function assertTriggers(value,familyId){if(!isRecord(value))throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`);for(const key of["package_names","item_ids","tags","error_codes"])if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`);const filePatterns=value.file_patterns;if(filePatterns!==void 0&&!isStringArray(filePatterns))throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`);for(const pattern of filePatterns??[])if(pattern.length>MAX_FILE_PATTERN_LENGTH)throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`)}function assertFamilyIdentity(family,ids){if(assertNonEmpty(family.id,"defect recurrence family id"),ids.has(family.id))throw new TypeError(`Duplicate defect recurrence family ${family.id}`);if(ids.add(family.id),!Number.isInteger(family.version)||family.version<1)throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`);if(!DEFECT_ESCAPE_CLASSES.includes(family.escape_class))throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`);assertNonEmpty(family.title,`defect recurrence family ${family.id} title`),assertNonEmpty(family.owner_item_id,`defect recurrence family ${family.id} owner_item_id`)}function assertFamilyEvidenceContracts(family){if(!isStringArray(family.historical_item_ids)||family.historical_item_ids.length===0||family.historical_item_ids.some(itemId=>!itemId.trim()))throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`);if(assertTriggers(family.triggers,family.id),!isRecord(family.checks)||!isStringArray(family.checks.local)||!isStringArray(family.checks.hosted)||family.checks.local.length===0||family.checks.hosted.length===0||family.checks.local.some(check=>!check.trim())||family.checks.hosted.some(check=>!check.trim()))throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`)}function assertFamilyBudget(family){if(!isRecord(family.budget)||typeof family.budget.max_escape_rate!="number"||!Number.isFinite(family.budget.max_escape_rate)||typeof family.budget.max_false_positive_rate!="number"||!Number.isFinite(family.budget.max_false_positive_rate))throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`);if(family.budget.max_escape_rate<0||family.budget.max_escape_rate>1||family.budget.max_false_positive_rate<0||family.budget.max_false_positive_rate>1)throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`)}function assertFamilyNegativeControl(family){const negativeControl=assertChangeInput(family.negative_control,`defect recurrence family ${family.id} negative_control`);if(familyReasons(family,negativeControl,{}).length===0)throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`)}function validatePolicy(policy){if(policy.version!==1)throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`);if(typeof policy.evidence_epoch!="string"||!Number.isFinite(Date.parse(policy.evidence_epoch)))throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp");const ids=new Set;for(const family of policy.families){if(!isRecord(family))throw new TypeError("defect recurrence family must be an object");assertFamilyIdentity(family,ids),assertFamilyEvidenceContracts(family),assertFamilyBudget(family),assertFamilyNegativeControl(family)}}function pathMatches(pattern,value){let compiled=compiledPathPatterns.get(pattern);if(compiled===void 0){if(compiledPathPatterns.size>=MAX_COMPILED_PATH_PATTERNS){const oldest=compiledPathPatterns.keys().next().value;compiledPathPatterns.delete(oldest)}const escaped=pattern.replaceAll("**","\0").replaceAll(/[|\\{}()[\]^$+?./]/gu,"\\$&").replaceAll("*","[^/]*").replaceAll("\0",".*");compiled=new RegExp(`^${escaped}$`,"u"),compiledPathPatterns.set(pattern,compiled)}return compiled.test(value)}function fileReasons(family,input){const reasons=[],patterns=uniqueSorted(family.triggers.file_patterns??[]);for(const file of uniqueSorted(input.files??[]))for(const pattern of patterns)pathMatches(pattern,file)&&reasons.push({signal:"file",value:file,matched:pattern});return reasons}function exactReasons(family,input){const exactSignals=[{signal:"package",values:uniqueSorted(input.package_names??[]),triggers:uniqueSorted(family.triggers.package_names??[])},{signal:"tag",values:uniqueSorted(input.tags??[]),triggers:uniqueSorted(family.triggers.tags??[])},{signal:"error_code",values:uniqueSorted(input.error_codes??[]),triggers:uniqueSorted(family.triggers.error_codes??[])}],reasons=[];for(const exact of exactSignals){const triggerSet=new Set(exact.triggers);for(const value of exact.values)triggerSet.has(value)&&reasons.push({signal:exact.signal,value,matched:value})}return reasons}function itemReasons(family,input,itemFamilies){const directItemIds=new Set(family.triggers.item_ids??[]);return uniqueSorted(input.item_ids??[]).flatMap(itemId=>directItemIds.has(itemId)||Object.hasOwn(itemFamilies,itemId)&&itemFamilies[itemId].includes(family.id)?[{signal:"item",value:itemId,matched:family.id}]:[])}function familyReasons(family,input,itemFamilies){return[...fileReasons(family,input),...exactReasons(family,input),...itemReasons(family,input,itemFamilies)]}function readRiskCursorOffset(cursor,indexFingerprint){if(!cursor)return 0;let parsed;try{parsed=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("defect change-risk cursor is invalid")}if(typeof parsed!="object"||parsed===null||Array.isArray(parsed)||parsed.index_fingerprint!==indexFingerprint||!Number.isInteger(parsed.offset)||parsed.offset<0)throw new TypeError("defect change-risk cursor does not match this index");return parsed.offset}function changeSignalCount(input){return[input.files,input.package_names,input.item_ids,input.tags,input.error_codes].reduce((total,values)=>total+(values?.length??0),0)}function inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies){const graph=buildDefectRecurrenceGraph(families,recurrenceRecords),fileFamilies=new Map;for(const lineage of graph.lineages)if(lineage.family_ids.length!==0)for(const id of lineage.item_ids){itemFamilies[id]=uniqueSorted([...Object.hasOwn(itemFamilies,id)?itemFamilies[id]:[],...lineage.family_ids]);for(const file of recurrenceRecords.get(id)?.files??[]){const matched=fileFamilies.get(file)??new Set;for(const familyId of lineage.family_ids)matched.add(familyId);fileFamilies.set(file,matched)}}return fileFamilies}function refreshRecurrenceRecords(recurrenceRecords,items){for(const item of items){const record=readDefectRecurrenceRecord(item);record===void 0?recurrenceRecords.delete(item.id):recurrenceRecords.set(item.id,record)}}function compileDirectItemSeeds(families){const historical=new Map,triggers=new Map;for(const family of families)for(const[index,ids]of[[historical,family.historical_item_ids],[triggers,family.triggers.item_ids??[]]])for(const id of ids){const matches=index.get(id)??new Set;matches.add(family.id),index.set(id,matches)}return{historical,triggers}}function directItemMatches(item,families,seeds){const signals=defectRecurrenceItemSignals(item);return[signals.files,signals.package_names,signals.tags,signals.error_codes].some(values=>values&&values.length>0)?families.filter(family=>family.historical_item_ids.includes(item.id)||familyReasons(family,signals,{}).length>0).map(family=>family.id):uniqueSorted([...seeds.historical.get(item.id)??[],...seeds.triggers.get(item.id.trim())??[]])}function buildDefectRecurrenceIndex(policy,items,options={}){validatePolicy(policy);const families=[...policy.families].sort((left,right)=>left.id<right.id?-1:1),policyFingerprint=fingerprint({...policy,families}),changed=new Set(options.changed_item_ids??[]),canReuse=options.previous_index?.policy_fingerprint===policyFingerprint,itemFamilies=Object.assign(Object.create(null),canReuse?Object.fromEntries(Object.entries(options.previous_index?.direct_item_families??options.previous_index?.item_families??{}).filter(([itemId])=>!changed.has(itemId))):{}),itemsReused=canReuse?Object.keys(itemFamilies).length:0,seeds=compileDirectItemSeeds(families);for(const item of items){const matched=directItemMatches(item,families,seeds);matched.length>0?itemFamilies[item.id]=matched:delete itemFamilies[item.id]}const directItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1)),recurrenceRecords=new Map(canReuse?Object.entries(options.previous_index?.recurrence_records??{}).filter(([id])=>!changed.has(id)):[]);refreshRecurrenceRecords(recurrenceRecords,items);const fileFamilies=inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies),sortedRecords=Object.fromEntries([...recurrenceRecords].sort(([left],[right])=>left<right?-1:1)),sortedFileFamilies=Object.fromEntries([...fileFamilies].sort(([left],[right])=>left<right?-1:1).map(([file,matches])=>[file,[...matches].sort()])),sortedItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1).map(([itemId,familyIds])=>[itemId,uniqueSorted(familyIds)]));return{version:1,policy_fingerprint:policyFingerprint,index_fingerprint:fingerprint({policy_fingerprint:policyFingerprint,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies}),families,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies,build:{items_scanned:items.length,items_reused:itemsReused,items_indexed:Object.keys(sortedItemFamilies).length}}}function analyzeDefectChangeRisk(index,input,options={}){const limit=options.limit??25;if(!Number.isInteger(limit)||limit<1||limit>100)throw new TypeError("defect change-risk limit must be an integer from 1 through 100");const offset=readRiskCursorOffset(options.cursor,index.index_fingerprint),matches=index.families.flatMap(family=>{const reasons=familyReasons(family,input,index.item_families);for(const file of uniqueSorted(input.files??[]))index.file_families&&Object.hasOwn(index.file_families,file)&&index.file_families[file].includes(family.id)&&reasons.push({signal:"file",value:file,matched:`recurs_from:${family.id}`});return reasons.sort((left,right)=>left.signal!==right.signal?left.signal.localeCompare(right.signal):left.value!==right.value?left.value.localeCompare(right.value):left.matched.localeCompare(right.matched)),reasons.length===0?[]:[{family_id:family.id,family_version:family.version,owner_item_id:family.owner_item_id,escape_class:family.escape_class,reasons,local_checks:uniqueSorted(family.checks.local),hosted_checks:uniqueSorted(family.checks.hosted),budget:family.budget}]}),page=matches.slice(offset,offset+limit),nextOffset=offset+page.length,nextCursor=nextOffset<matches.length?Buffer.from(JSON.stringify({index_fingerprint:index.index_fingerprint,offset:nextOffset})).toString("base64url"):void 0,reportWithoutCost={risk_detected:matches.length>0,index_fingerprint:index.index_fingerprint,items:page,total:matches.length,...nextCursor?{next_cursor:nextCursor}:{},required_local_checks:uniqueSorted(matches.flatMap(match=>match.local_checks)),required_hosted_checks:uniqueSorted(matches.flatMap(match=>match.hosted_checks)),row_contract:{row_keys:["items"],jq_selector:".items[]"}};return{...reportWithoutCost,cost:{families_evaluated:index.families.length,signals_evaluated:changeSignalCount(input),families_selected:matches.length,estimated_output_tokens:Math.ceil(JSON.stringify(reportWithoutCost).length/4)}}}function isDefectItem(item){return typeof item.type=="string"&&item.type.toLowerCase()==="issue"||(Array.isArray(item.tags)?item.tags:[]).some(tag=>typeof tag=="string"&&["bug","defect","security"].includes(tag.toLowerCase()))}function nonEmptyString(value){return typeof value=="string"&&value.trim().length>0}function nonEmptyStringArray(value){return Array.isArray(value)&&value.length>0&&value.every(nonEmptyString)}function validEvidence(value,nowMs){if(typeof value!="object"||value===null||Array.isArray(value))return{valid:!1,expired:!1};const evidence=value;if(!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition)||typeof evidence.owner!="string"||!evidence.owner.trim())return{valid:!1,expired:!1};if(evidence.disposition==="explicit_waiver"){const expiry=Date.parse(evidence.waiver_expires_at??"");return{valid:nonEmptyString(evidence.waiver_reason)&&Number.isFinite(expiry)&&expiry>=nowMs,expired:Number.isFinite(expiry)&&expiry<nowMs}}return{valid:nonEmptyString(evidence.gate_id)&&nonEmptyString(evidence.negative_control)&&nonEmptyStringArray(evidence.local_checks)&&nonEmptyStringArray(evidence.hosted_checks),expired:!1}}function evidenceFindings(item,nowMs){const findings=[];if(!Number.isFinite(Date.parse(typeof item.completed_at=="string"?item.completed_at:""))&&!Number.isFinite(Date.parse(typeof item.closed_at=="string"?item.closed_at:""))&&findings.push({item_id:item.id,kind:"invalid_completion_timestamp",detail:`${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`}),typeof item.escape_class!="string"?findings.push({item_id:item.id,kind:"missing_escape_class",detail:`${item.id} requires escape_class after the defect-evidence epoch.`}):DEFECT_ESCAPE_CLASSES.includes(item.escape_class)||findings.push({item_id:item.id,kind:"invalid_escape_class",detail:`${item.id} has unsupported escape_class ${item.escape_class}.`}),item.gate_evidence===void 0)return findings.push({item_id:item.id,kind:"missing_gate_evidence",detail:`${item.id} requires structured gate_evidence after the defect-evidence epoch.`}),findings;const result=validEvidence(item.gate_evidence,nowMs);return result.valid||findings.push({item_id:item.id,kind:result.expired?"expired_waiver":"invalid_gate_evidence",detail:result.expired?`${item.id} carries an expired gate-evidence waiver.`:`${item.id} gate_evidence does not prove a gate or explicit waiver.`}),findings}function evaluateDefectGateEvidence(items,policy,terminalStatuses,now=new Date){validatePolicy(policy);const epochMs=Date.parse(policy.evidence_epoch),terminal=new Set(terminalStatuses),terminalDefects=items.filter(item=>terminal.has(item.status)&&isDefectItem(item)),governed=terminalDefects.filter(item=>{const completedAt=Date.parse(typeof item.completed_at=="string"?item.completed_at:"");if(Number.isFinite(completedAt))return completedAt>=epochMs;const closedAt=Date.parse(typeof item.closed_at=="string"?item.closed_at:"");if(Number.isFinite(closedAt))return closedAt>=epochMs;const createdAt=Date.parse(typeof item.created_at=="string"?item.created_at:"");return!Number.isFinite(createdAt)||createdAt>=epochMs}),classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(escapeClass=>[escapeClass,0])),evidenceDispositionCounts=Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map(disposition=>[disposition,0])),classified=terminalDefects.filter(item=>typeof item.escape_class=="string"&&DEFECT_ESCAPE_CLASSES.includes(item.escape_class));for(const item of classified)if(classCounts[item.escape_class]+=1,typeof item.gate_evidence=="object"&&item.gate_evidence!==null&&!Array.isArray(item.gate_evidence)){const disposition=item.gate_evidence.disposition;typeof disposition=="string"&&DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)&&(evidenceDispositionCounts[disposition]+=1)}const findings=governed.flatMap(item=>evidenceFindings(item,now.getTime()));return findings.sort((left,right)=>left.item_id!==right.item_id?left.item_id.localeCompare(right.item_id):left.kind.localeCompare(right.kind)),{ok:findings.length===0,governed_item_count:governed.length,classified_item_count:classified.length,class_counts:classCounts,evidence_disposition_counts:evidenceDispositionCounts,findings}}class DefectRecurrencePolicyParseError extends TypeError{code="defect_recurrence_policy_invalid"}function parseDefectRecurrencePolicy(value){try{if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect recurrence policy must be an object");const policy=value;if(!Array.isArray(policy.families))throw new TypeError("defect recurrence policy families must be an array");return validatePolicy(policy),policy}catch(error){throw error instanceof TypeError?new DefectRecurrencePolicyParseError(error.message,{cause:error}):error}}function parseDefectChangeRiskRequest(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect change-risk request must be an object");const request=value,change=assertChangeInput(request.change,"defect change-risk request.change");if(request.cursor!==void 0&&typeof request.cursor!="string")throw new TypeError("defect change-risk request.cursor must be a string");if(request.limit!==void 0&&!Number.isInteger(request.limit))throw new TypeError("defect change-risk request.limit must be an integer");return{policy:parseDefectRecurrencePolicy(request.policy),change,...request.cursor===void 0?{}:{cursor:request.cursor},...request.limit===void 0?{}:{limit:request.limit}}}export{DEFECT_ESCAPE_CLASSES,DEFECT_GATE_EVIDENCE_DISPOSITIONS,DefectRecurrencePolicyParseError,analyzeDefectChangeRisk,buildDefectRecurrenceIndex,evaluateDefectGateEvidence,parseDefectChangeRiskRequest,parseDefectRecurrencePolicy};
 //# sourceMappingURL=defect-recurrence.js.map

package/dist/sdk/governance/extension-host-version.d.ts

@@ -1,25 +1,25 @@
 import type { LoadedExtension } from "../../core/extensions/loader.js";
 /** One distinct resolvable pm-cli installation and its extension consumers. */
 export interface ExtensionHostVersionCopy {
-    /** Installed pm-cli version. */
-    version: string;
-    /** Privacy-safe workspace-relative package manifest location. */
-    path: string;
-    /** Dependency layout that exposed this copy. */
-    layout: "host" | "npm" | "pnpm" | "other";
-    /** Loaded extensions resolving this copy. */
-    consumers: string[];
+/** Installed pm-cli version. */
+version: string;
+/** Privacy-safe workspace-relative package manifest location. */
+path: string;
+/** Dependency layout that exposed this copy. */
+layout: "host" | "npm" | "pnpm" | "other";
+/** Loaded extensions resolving this copy. */
+consumers: string[];
 }
 /** Extension/host version census returned by the health SDK. */
 export interface ExtensionHostVersionCensus {
-    /** Version of the process-hosting pm-cli package. */
-    host_version: string | null;
-    /** Every distinct relevant copy resolved by the host or an extension. */
-    copies: ExtensionHostVersionCopy[];
-    /** Copies whose version differs from the process host. */
-    mismatches: ExtensionHostVersionCopy[];
-    /** Stable health warning tokens for mismatched copies. */
-    warnings: string[];
+/** Version of the process-hosting pm-cli package. */
+host_version: string | null;
+/** Every distinct relevant copy resolved by the host or an extension. */
+copies: ExtensionHostVersionCopy[];
+/** Copies whose version differs from the process host. */
+mismatches: ExtensionHostVersionCopy[];
+/** Stable health warning tokens for mismatched copies. */
+warnings: string[];
 }
 /** Scan the host plus the nearest pm-cli package resolvable by every loaded extension. */
 export declare function scanExtensionHostVersions(loadedExtensions: readonly LoadedExtension[], workspaceRoot: string, hostPackageRoot?: string): Promise<ExtensionHostVersionCensus>;