@unbrained/pm-cli 2026.10.4 → 2026.10.6

package/dist/sdk/governance/assurance.js

@@ -1,5 +1,5 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="00ad9b34-4feb-5812-8755-801869cce3ad")}catch(e2){}})();import{createHash}from"node:crypto";import path from"node:path";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{appendWorkspaceAuditEvent,mutateWorkspaceJsonWithHistory,readFileIfExists,readHistoryEntries,readSettings,resolveAuthor,stableStringify,WORKSPACE_HISTORY_ID,getWorkspaceHistoryPath}from"../runtime-primitives.js";import{resolveCanonicalRelationshipKind}from"../relationships.js";import{MAX_ASSURANCE_VERDICT_LIMIT}from"./assurance-limits.js";import{AssuranceEvaluationRefusalError,AssuranceMutationRefusalError,AssuranceSourceResolutionError}from"./assurance-mutation-error.js";const ASSURANCE_DOCUMENT_VERSION=1;const ASSURANCE_GATE_TRIGGERS=["pre-commit","pre-push","pre-merge","ci","pre-release","post-release","scheduled","on-claim","on-close"];const ASSURANCE_MEASUREMENT_SOURCE_KINDS=["items","dependency_kind","prose_edge_gap","graph","validate","health","history","links","provider","derived"];const POLARITY_KEYS=["ceiling","floor","equals","zero","monotone_nondecreasing","monotone_nonincreasing","subset_of"];const ID_PATTERN=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;const LOCK_TTL_SECONDS=30;const LOCK_WAIT_MS=5e3;const EVALUATION_CONCURRENCY=4;const DEFAULT_VERDICT_LIMIT=50;function requireStableId(value,field){if(!ID_PATTERN.test(value)){throw new AssuranceMutationRefusalError(`${field} must be a stable lowercase id`)}}function requireFiniteNonNegative(value,field){if(!Number.isFinite(value)||value<0){throw new AssuranceMutationRefusalError(`${field} must be a finite non-negative number`)}}function boundFor(assertion){const present=POLARITY_KEYS.filter(key=>assertion[key]!==void 0);if(present.length!==1){throw new AssuranceMutationRefusalError(`assertion ${assertion.id} must declare exactly one polarity`)}const polarity=present[0];const raw=assertion[polarity];return{polarity,value:polarity==="zero"?0:raw}}function valuesEqual(left,right){return stableStringify(left)===stableStringify(right)}function compareBound(observed,bound){if(bound.polarity==="equals")return valuesEqual(observed,bound.value);if(bound.polarity==="subset_of"){if(!Array.isArray(observed)||!Array.isArray(bound.value))return false;const allowed=bound.value;return observed.every(entry=>allowed.includes(entry))}if(typeof observed!=="number"){return false}const numericBound=bound.value;if(bound.polarity==="ceiling"||bound.polarity==="monotone_nonincreasing"){return observed<=numericBound}if(bound.polarity==="floor"||bound.polarity==="monotone_nondecreasing"){return observed>=numericBound}return observed===0}function proveNegativeControl(assertion){const bound=boundFor(assertion);const cases=assertion.negative_control.cases;return cases.some(entry=>entry.expected==="pass")&&cases.some(entry=>entry.expected==="fail")&&cases.every(entry=>compareBound(entry.observed,bound)===(entry.expected==="pass"))}function boundUpdateIsLoosening(beforeBound,afterBound){if(beforeBound.polarity!==afterBound.polarity)return true;if(typeof beforeBound.value==="number"&&typeof afterBound.value==="number"){return beforeBound.polarity==="ceiling"||beforeBound.polarity==="monotone_nonincreasing"?afterBound.value>beforeBound.value:beforeBound.polarity==="floor"||beforeBound.polarity==="monotone_nondecreasing"?afterBound.value<beforeBound.value:afterBound.value!==beforeBound.value}if(beforeBound.polarity==="subset_of"){const beforeValues=beforeBound.value;const afterValues=afterBound.value;return!Array.isArray(beforeValues)||!Array.isArray(afterValues)||afterValues.some(entry=>!beforeValues.includes(entry))}return!valuesEqual(beforeBound.value,afterBound.value)}function assuranceAssertionUpdateIsLoosening(before,after){if(before.measurement_id!==after.measurement_id||before.owner_item_id!==after.owner_item_id||stableStringify(before.scope)!==stableStringify(after.scope)){return true}const enforcementRank={observe:0,warn:1,block:2};const lifetimeLoosened=(before.lifetime??"hold")==="hold"&&(after.lifetime??"hold")==="retire";return boundUpdateIsLoosening(boundFor(before),boundFor(after))||enforcementRank[after.enforcement]<enforcementRank[before.enforcement]||lifetimeLoosened}function validateItemsMeasurementSource(source){if(source.state!==void 0&&!(source.state==="present"||source.state==="missing")){throw new AssuranceMutationRefusalError("items source state must be present or missing")}const hasEquals=Object.hasOwn(source,"equals");const hasState=source.state!==void 0;const predicateCount=Number(hasEquals)+Number(hasState);if(source.field!==void 0&&predicateCount!==1){throw new AssuranceMutationRefusalError("items source with field requires exactly one of equals or state")}if(source.field===void 0&&predicateCount!==0){throw new AssuranceMutationRefusalError("items source equals/state requires field")}}function validateDependencyKindMeasurementSource(source){if(typeof source.dependency_kind!=="string"||source.dependency_kind.trim().length===0){throw new AssuranceMutationRefusalError("dependency_kind source requires dependency_kind")}const provenancePredicateCount=[source.source_kind,source.source_kind_prefix,source.source_kind_state].filter(value=>value!==void 0).length;if(provenancePredicateCount>1){throw new AssuranceMutationRefusalError("dependency_kind source accepts at most one source_kind predicate")}if(source.source_kind!==void 0&&source.source_kind.trim().length===0||source.source_kind_prefix!==void 0&&source.source_kind_prefix.trim().length===0){throw new AssuranceMutationRefusalError("dependency_kind source provenance values must not be empty")}if(source.source_kind_state!==void 0&&source.source_kind_state!=="present"&&source.source_kind_state!=="missing"){throw new AssuranceMutationRefusalError("dependency_kind source source_kind_state must be present or missing")}}function validateProseEdgeGapSource(source){if(source.sample_limit!==void 0&&(!Number.isInteger(source.sample_limit)||source.sample_limit<1)){throw new AssuranceMutationRefusalError("prose_edge_gap sample_limit must be a positive integer")}for(const exemption of source.exemptions??[]){if(typeof exemption.holder_id!=="string"||exemption.holder_id.trim().length===0||typeof exemption.reason!=="string"||exemption.reason.trim().length===0){throw new AssuranceMutationRefusalError("prose_edge_gap exemptions require holder_id and reason")}if(exemption.target_id!==void 0&&exemption.target_id.trim().length===0||exemption.text_contains!==void 0&&exemption.text_contains.trim().length===0){throw new AssuranceMutationRefusalError("prose_edge_gap exemption selectors must not be empty")}}}function validateMeasurementDefinition(definition){requireStableId(definition.id,"measurement.id");if(definition.max_cost!==void 0){requireFiniteNonNegative(definition.max_cost,"measurement.max_cost")}const candidateSource=definition.source;if(Object.prototype.toString.call(candidateSource)!=="[object Object]"){throw new AssuranceMutationRefusalError(`measurement.source.kind must be one of ${ASSURANCE_MEASUREMENT_SOURCE_KINDS.join(", ")}`)}const sourceKind=Reflect.get(candidateSource,"kind");if(!ASSURANCE_MEASUREMENT_SOURCE_KINDS.includes(sourceKind)){throw new AssuranceMutationRefusalError(`measurement.source.kind must be one of ${ASSURANCE_MEASUREMENT_SOURCE_KINDS.join(", ")}`)}const source=candidateSource;if(source.kind==="items"){validateItemsMeasurementSource(source)}if(source.kind==="dependency_kind")validateDependencyKindMeasurementSource(source);if(source.kind==="prose_edge_gap")validateProseEdgeGapSource(source);if((source.kind==="graph"||source.kind==="validate"||source.kind==="health")&&(typeof source.field!=="string"||source.field.trim().length===0)){throw new AssuranceMutationRefusalError(`${source.kind} source requires field`)}if(source.kind==="provider"){requireStableId(source.provider,"provider source provider");requireStableId(source.key,"provider source key")}return definition}function validateAssertionDefinition(definition){requireStableId(definition.id,"assertion.id");requireStableId(definition.measurement_id,"assertion.measurement_id");if(typeof definition.owner_item_id!=="string"||definition.owner_item_id.trim().length===0){throw new AssuranceMutationRefusalError("assertion.owner_item_id is required")}const bound=boundFor(definition);if(typeof bound.value==="number"&&!Number.isFinite(bound.value)){throw new AssuranceMutationRefusalError(`assertion.${bound.polarity} must be a finite number`)}if(definition.lifetime==="retire"&&(typeof definition.retire_reason!=="string"||definition.retire_reason.trim().length===0)){throw new AssuranceMutationRefusalError("retired assertion requires retire_reason")}if(definition.scope.kind==="filter"){requireStableId(definition.scope.measurement_id,"assertion.scope.measurement_id")}const cases=definition.negative_control?.cases;if(!Array.isArray(cases)||!cases.some(entry=>entry.expected==="pass")||!cases.some(entry=>entry.expected==="fail")){throw new AssuranceMutationRefusalError("assertion negative control requires pass and fail cases")}if(!proveNegativeControl(definition)){throw new AssuranceMutationRefusalError(`assertion ${definition.id} negative control does not prove its bound`)}return definition}function validateGateProviderPolicy(policy){if(!Array.isArray(policy.allowed_providers)){throw new AssuranceMutationRefusalError("gate provider_policy.allowed_providers must be an array")}for(const provider of policy.allowed_providers){requireStableId(provider,"gate.provider_policy.allowed_provider")}if(typeof policy.triggers!=="object"||policy.triggers===null||Array.isArray(policy.triggers)){throw new AssuranceMutationRefusalError("gate provider_policy.triggers must be an object")}for(const[trigger,rule]of Object.entries(policy.triggers)){if(!ASSURANCE_GATE_TRIGGERS.includes(trigger)){throw new AssuranceMutationRefusalError(`gate provider policy has unknown trigger ${trigger}`)}if(typeof rule!=="object"||rule===null||!["low","medium","high"].includes(rule.max_cost_class)||typeof rule.allow_network!=="boolean"){throw new AssuranceMutationRefusalError(`gate provider policy trigger ${trigger} is invalid`)}}}function validateGateDefinition(definition){requireStableId(definition.id,"gate.id");if(!Array.isArray(definition.assertion_ids)){throw new AssuranceMutationRefusalError("gate.assertion_ids is required and must be an array")}if(definition.assertion_ids.length===0){throw new AssuranceMutationRefusalError("gate requires at least one assertion")}for(const id of definition.assertion_ids)requireStableId(id,"gate.assertion_id");if(!Array.isArray(definition.triggers)){throw new AssuranceMutationRefusalError(`gate.triggers is required and must be an array of ${ASSURANCE_GATE_TRIGGERS.join(", ")}`)}if(definition.triggers.length===0){throw new AssuranceMutationRefusalError("gate requires at least one trigger")}for(const trigger of definition.triggers){if(!ASSURANCE_GATE_TRIGGERS.includes(trigger)){throw new AssuranceMutationRefusalError(`gate trigger must be one of ${ASSURANCE_GATE_TRIGGERS.join(", ")}`)}}if(definition.provider_policy){validateGateProviderPolicy(definition.provider_policy)}return definition}function validateAssuranceDocument(document){if(document.version!==ASSURANCE_DOCUMENT_VERSION){throw new AssuranceMutationRefusalError(`unsupported assurance document version ${String(document.version)}`)}const ids=new Set;for(const definition of document.measurements){validateMeasurementDefinition(definition);if(ids.has(`measurement:${definition.id}`)){throw new AssuranceMutationRefusalError(`duplicate measurement ${definition.id}`)}ids.add(`measurement:${definition.id}`)}for(const definition of document.assertions){validateAssertionDefinition(definition);if(ids.has(`assertion:${definition.id}`)){throw new AssuranceMutationRefusalError(`duplicate assertion ${definition.id}`)}ids.add(`assertion:${definition.id}`)}for(const definition of document.gates){validateGateDefinition(definition);const missing=definition.assertion_ids.filter(id=>!document.assertions.some(assertionDefinition=>assertionDefinition.id===id));if(missing.length>0){throw new AssuranceMutationRefusalError(`gate ${definition.id} references missing assertions: ${missing.join(", ")}`)}if(ids.has(`gate:${definition.id}`)){throw new AssuranceMutationRefusalError(`duplicate gate ${definition.id}`)}ids.add(`gate:${definition.id}`)}const measurementIds=new Set(document.measurements.map(entry=>entry.id));for(const[measurementId,consumers]of collectMeasurementReferences(document)){if(!measurementIds.has(measurementId)){throw new AssuranceMutationRefusalError(`${consumers.join(", ")} references missing measurement ${measurementId}`)}}return document}function collectExpressionMeasurementReferences(expression,references){if("measurement"in expression){references.push(expression.measurement);return}if("operator"in expression){for(const operand of expression.operands){collectExpressionMeasurementReferences(operand,references)}}}function collectMeasurementReferences(document){const references=new Map;const add=(measurementId,consumer)=>{const consumers=references.get(measurementId)??[];consumers.push(consumer);references.set(measurementId,consumers)};for(const assertionDefinition of document.assertions){add(assertionDefinition.measurement_id,`assertion ${assertionDefinition.id}`);if(assertionDefinition.scope.kind==="filter"){add(assertionDefinition.scope.measurement_id,`assertion ${assertionDefinition.id} scope`)}}for(const measurementDefinition of document.measurements){if(measurementDefinition.source.kind!=="derived")continue;const derivedReferences=[];collectExpressionMeasurementReferences(measurementDefinition.source.expression,derivedReferences);for(const measurementId of derivedReferences){add(measurementId,`derived measurement ${measurementDefinition.id}`)}}return references}function collectGateProviderIds(gate,document){const pending=gate.assertion_ids.flatMap(assertionId=>{const assertion=document.assertions.find(entry=>entry.id===assertionId);return[assertion.measurement_id,...assertion.scope.kind==="filter"?[assertion.scope.measurement_id]:[]]});const visited=new Set;const providers=new Set;while(pending.length>0){const measurementId=pending.pop();if(visited.has(measurementId))continue;visited.add(measurementId);const measurement=document.measurements.find(entry=>entry.id===measurementId);if(measurement.source.kind==="provider"){providers.add(measurement.source.provider)}else if(measurement.source.kind==="derived"){collectExpressionMeasurementReferences(measurement.source.expression,pending)}}return providers}function createEmptyAssuranceDocument(){return{version:ASSURANCE_DOCUMENT_VERSION,measurements:[],assertions:[],gates:[]}}function itemsSourceResult(source,context){const matches=context.items.filter(item=>(source.statuses===void 0||source.statuses.includes(item.status))&&(source.types===void 0||source.types.includes(item.type))&&(source.tags===void 0||source.tags.every(tag=>item.tags?.includes(tag)))&&(source.field===void 0||(()=>{const value=item[source.field];if(source.state!==void 0){const missing=value===void 0||value===null||value===""||Array.isArray(value)&&value.length===0;return source.state==="missing"?missing:!missing}return valuesEqual(value,source.equals)})()));return{value:matches.length,population_size:context.items.length,cost:context.items.length,contributors:matches.map(item=>item.id)}}function dependencyProvenanceMatches(source,sourceKind){if(source.source_kind!==void 0){return sourceKind?.toLowerCase()===source.source_kind.trim().toLowerCase()}if(source.source_kind_prefix!==void 0){return sourceKind?.toLowerCase().startsWith(source.source_kind_prefix.trim().toLowerCase())===true}if(source.source_kind_state==="present"){return sourceKind!==void 0&&sourceKind.length>0}if(source.source_kind_state==="missing"){return sourceKind===void 0||sourceKind.length===0}return true}function dependencyKindSourceResult(source,context){const contributors=[];const requestedKind=resolveCanonicalRelationshipKind(source.dependency_kind)??source.dependency_kind.trim().toLowerCase();for(const item of context.items){for(const dependency of item.dependencies??[]){const dependencyKind=resolveCanonicalRelationshipKind(dependency.kind)??dependency.kind.trim().toLowerCase();const sourceKind=dependency.source_kind?.trim();if(dependencyKind===requestedKind&&dependencyProvenanceMatches(source,sourceKind))contributors.push(`${item.id}->${dependency.id}${sourceKind?`@${sourceKind}`:""}`)}}return{value:contributors.length,population_size:context.items.length,cost:context.items.length,contributors}}function assuranceItemProseSegments(item){const segments=[item.description,item.body].filter(value=>typeof value==="string").map(value=>value.trim()).filter(Boolean);for(const key of["comments","notes","learnings"]){const entries=item[key];if(!Array.isArray(entries))continue;for(const entry of entries){if(typeof entry==="string")segments.push(entry);else if(typeof entry==="object"&&entry!==null){const text=Reflect.get(entry,"text");if(typeof text==="string")segments.push(text)}}}return segments}function proseReferenceIsExempt(exemptions,holderId,targetId,segment){return exemptions.some(exemption=>exemption.holder_id.trim().toLowerCase()===holderId.toLowerCase()&&(exemption.target_id===void 0||exemption.target_id.trim().toLowerCase()===targetId.toLowerCase())&&(exemption.text_contains===void 0||segment.toLowerCase().includes(exemption.text_contains.trim().toLowerCase())))}function prosePairKey(left,right){return[left.toLowerCase(),right.toLowerCase()].sort().join("\0")}function collectProseEdgeCensusInputs(items){const canonicalIds=new Map;const linkedPairs=new Set;const proseMentions=[];const mentionPattern=/\b[a-z][a-z0-9]*-[a-z0-9]+\b/giu;let mentionCount=0;for(const item of items){canonicalIds.set(item.id.toLowerCase(),item.id);for(const dependency of item.dependencies??[])linkedPairs.add(prosePairKey(item.id,dependency.id));for(const scalar of[item.parent,item.blocked_by])if(typeof scalar==="string")linkedPairs.add(prosePairKey(item.id,scalar));for(const segment of assuranceItemProseSegments(item)){const mentionedIds=[...segment.matchAll(mentionPattern)].map(match=>match[0]);mentionCount+=mentionedIds.length;proseMentions.push({holder_id:item.id,segment,mentioned_ids:mentionedIds})}}return{canonical_ids:canonicalIds,linked_pairs:linkedPairs,prose_mentions:proseMentions,mention_count:mentionCount}}function proseEdgeGapSourceResult(source,context){const census=collectProseEdgeCensusInputs(context.items);const gaps=new Map;for(const proseMention of census.prose_mentions){const mentions=proseMention.mentioned_ids.map(id=>census.canonical_ids.get(id.toLowerCase())).filter(id=>id!==void 0&&id!==proseMention.holder_id);const distinctMentions=[...new Set(mentions)];for(const targetId of distinctMentions){const key=prosePairKey(proseMention.holder_id,targetId);if(census.linked_pairs.has(key)||proseReferenceIsExempt(source.exemptions??[],proseMention.holder_id,targetId,proseMention.segment))continue;const explicit=distinctMentions.some(candidate=>candidate!==targetId);if(gaps.get(key)?.explicit===true&&!explicit)continue;gaps.set(key,{contributor:`${proseMention.holder_id}->${targetId}|subject=${explicit?"explicit":"implicit"}`,explicit})}}const gapRows=[...gaps.values()];const contributors=gapRows.map(entry=>entry.contributor).sort();return{value:contributors.length,population_size:census.canonical_ids.size,cost:context.items.length+census.linked_pairs.size+census.mention_count,contributors:contributors.slice(0,source.sample_limit??25),partitions:{explicit_subject:gapRows.filter(entry=>entry.explicit).length,implicit_subject:gapRows.filter(entry=>!entry.explicit).length}}}function historySourceResult(source,context){const matches=context.history.filter(entry=>(source.op===void 0||entry.op===source.op)&&(source.author===void 0||entry.author===source.author)&&(source.harness===void 0||entry.agent_harness===source.harness)&&(source.model===void 0||entry.agent_model===source.model));return{value:matches.length,population_size:context.history.length,cost:context.history.length}}function linksSourceResult(source,context){const matches=context.items.filter(item=>{const links=item[source.link];const present=Array.isArray(links)&&links.length>0;return source.state==="present"?present:!present});return{value:matches.length,population_size:context.items.length,cost:context.items.length,contributors:matches.map(item=>item.id)}}function sourceResult(definition,context){const source=definition.source;if(source.kind==="items")return itemsSourceResult(source,context);if(source.kind==="dependency_kind"){return dependencyKindSourceResult(source,context)}if(source.kind==="prose_edge_gap")return proseEdgeGapSourceResult(source,context);if(source.kind==="history")return historySourceResult(source,context);if(source.kind==="links")return linksSourceResult(source,context);return null}function sumCosts(costs,durationMs){return costs.reduce((total,cost)=>({units:total.units+cost.units,items_scanned:total.items_scanned+cost.items_scanned,history_entries:total.history_entries+cost.history_entries,provider_calls:total.provider_calls+cost.provider_calls,duration_ms:durationMs}),{units:0,items_scanned:0,history_entries:0,provider_calls:0,duration_ms:durationMs})}function arithmeticValue(operator,values){if(values.length===0)throw new TypeError(`derived ${operator} requires operands`);if(operator==="add")return values.reduce((sum,value)=>sum+value,0);if(operator==="subtract")return values.slice(1).reduce((result,value)=>result-value,values[0]);if(operator==="multiply")return values.reduce((result,value)=>result*value,1);if(operator==="divide"){if(values.slice(1).includes(0))throw new TypeError("derived divide cannot divide by zero");return values.slice(1).reduce((result,value)=>result/value,values[0])}return operator==="min"?Math.min(...values):Math.max(...values)}async function mapWithConcurrency(values,limit,transform){const results=new Array(values.length);let nextIndex=0;const workers=Array.from({length:Math.min(limit,values.length)},async()=>{while(nextIndex<values.length){const index=nextIndex;nextIndex+=1;results[index]=await transform(values[index],index)}});await Promise.all(workers);return results}async function evaluateExpression(expression,context,definitions,stack,state){if("literal"in expression)return{value:expression.literal,costs:[],population_size:0,contributors:[]};if("measurement"in expression){const definition=definitions.find(entry=>entry.id===expression.measurement);if(!definition)throw new TypeError(`derived measurement references missing ${expression.measurement}`);const result=await evaluateMeasurementCached(definition,context,definitions,stack,state);if(typeof result.value!=="number")throw new TypeError(`derived measurement ${definition.id} is not numeric`);const costs=state.charged.has(definition.id)?[]:[result.cost];state.charged.add(definition.id);return{value:result.value,costs,population_size:result.population_size,contributors:result.contributors}}const operands=await mapWithConcurrency(expression.operands,EVALUATION_CONCURRENCY,operand=>evaluateExpression(operand,context,definitions,stack,state));return{value:arithmeticValue(expression.operator,operands.map(entry=>entry.value)),costs:operands.flatMap(entry=>entry.costs),population_size:Math.max(0,...operands.map(entry=>entry.population_size)),contributors:[...new Set(operands.flatMap(entry=>entry.contributors))]}}async function evaluateMeasurementInternal(definition,context,definitions,stack,state){validateMeasurementDefinition(definition);const startedAt=Date.now();let result;let nestedCosts=[];let providerCalls=0;if(definition.source.kind==="derived"){const derived=await evaluateExpression(definition.source.expression,context,definitions,[...stack,definition.id],state);result={value:derived.value,population_size:derived.population_size,cost:0,contributors:derived.contributors};nestedCosts=derived.costs}else{const builtin=sourceResult(definition,context);if(builtin!==null){result=builtin}else{result=await context.external(definition.source);providerCalls=1}}const ownCost={units:result.cost,items_scanned:definition.source.kind==="items"||definition.source.kind==="dependency_kind"||definition.source.kind==="prose_edge_gap"||definition.source.kind==="links"?context.items.length:0,history_entries:definition.source.kind==="history"?context.history.length:0,provider_calls:providerCalls,duration_ms:Date.now()-startedAt};const cost=sumCosts([...nestedCosts,ownCost],Date.now()-startedAt);if(definition.max_cost!==void 0&&cost.units>definition.max_cost){throw new AssuranceEvaluationRefusalError(`measurement ${definition.id} exceeded cost ceiling ${definition.max_cost} with ${cost.units}`)}return{id:definition.id,definition_fingerprint:`sha256:${createHash("sha256").update(stableStringify(definition)).digest("hex")}`,value:result.value,population_size:result.population_size,cost,contributors:result.contributors??[],...result.partitions?{partitions:result.partitions}:{}}}function evaluateMeasurementCached(definition,context,definitions,stack,state){if(stack.includes(definition.id)){throw new TypeError(`derived measurement cycle: ${[...stack,definition.id].join(" -> ")}`)}const cached=state.cache.get(definition.id);if(cached)return cached;const evaluation=evaluateMeasurementInternal(definition,context,definitions,stack,state).catch(error=>{if(error instanceof AssuranceSourceResolutionError&&error.measurement_id===void 0){const sourceContext={measurement_id:definition.id,source_kind:error.source_kind,field:error.field,...error.check?{check:error.check}:{}};const sourceError=new AssuranceSourceResolutionError(error.message,sourceContext);sourceError.cause=error;throw sourceError}throw error});state.cache.set(definition.id,evaluation);return evaluation}async function evaluateMeasurement(definition,context,definitions=[definition]){return evaluateMeasurementCached(definition,context,definitions,[],{cache:new Map,charged:new Set})}function assertionDistance(observed,bound){if(typeof observed!=="number"||typeof bound.value!=="number")return null;if(bound.polarity==="ceiling"||bound.polarity==="monotone_nonincreasing")return bound.value-observed;if(bound.polarity==="floor"||bound.polarity==="monotone_nondecreasing")return observed-bound.value;return observed-bound.value}function evaluateAssuranceAssertion(definition,measurement,options={}){validateAssertionDefinition(definition);const bound=boundFor(definition);const retired=definition.lifetime==="retire"&&options.owner_terminal===true;return{assertion_id:definition.id,measurement_id:definition.measurement_id,measurement_definition_fingerprint:measurement.definition_fingerprint,scope:definition.scope,population_size:measurement.population_size,observed:measurement.value,bound,distance:assertionDistance(measurement.value,bound),verdict:retired?"retired":compareBound(measurement.value,bound)?"pass":"fail",enforcement:definition.enforcement,negative_control_proven:proveNegativeControl(definition),cost:measurement.cost,contributors:measurement.contributors,...measurement.partitions?{partitions:measurement.partitions}:{}}}function enforceGateProviderPolicy(gate,document,context,trigger){const providerIds=collectGateProviderIds(gate,document);if(providerIds.size===0)return;const policy=gate.provider_policy;const triggerPolicy=policy?.triggers[trigger];if(!policy||!triggerPolicy){throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider execution at trigger ${trigger} without an explicit provider policy`)}const allowedProviders=new Set(policy.allowed_providers);const costRank={low:0,medium:1,high:2};for(const providerId of providerIds){if(!allowedProviders.has(providerId)){throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider ${providerId}`)}const capability=context.provider_capabilities?.[providerId];if(!capability){throw new AssuranceEvaluationRefusalError(`assurance provider ${providerId} has no declared capabilities`)}if(costRank[capability.cost_class]>costRank[triggerPolicy.max_cost_class]){throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses ${capability.cost_class}-cost provider ${providerId} at trigger ${trigger}`)}if(capability.network&&!triggerPolicy.allow_network){throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses network provider ${providerId} at trigger ${trigger}`)}}}async function evaluateGateMeasurement(gateId,assertionId,definition,context,definitions){try{return await evaluateMeasurement(definition,context,definitions)}catch(error){if(error instanceof AssuranceSourceResolutionError){const checkLocation=error.check?` check ${error.check}`:"";const measurementId=error.measurement_id??definition.id;const refusal=new AssuranceEvaluationRefusalError(`assurance gate ${gateId} assertion ${assertionId} measurement ${measurementId} source ${error.source_kind}${checkLocation} field ${error.field} could not resolve: ${error.message}`,{gate_id:gateId,assertion_id:assertionId,measurement_id:measurementId,source_kind:error.source_kind,field:error.field,...error.check?{check:error.check}:{}});refusal.cause=error;throw refusal}throw error}}async function evaluateAssuranceGate(gateId,document,context,options){validateAssuranceDocument(document);const gateDefinition=document.gates.find(entry=>entry.id===gateId);if(!gateDefinition)throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} not found`);if(!gateDefinition.triggers.includes(options.trigger)){throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} does not declare trigger ${options.trigger}`)}enforceGateProviderPolicy(gateDefinition,document,context,options.trigger);const assertions=await mapWithConcurrency(gateDefinition.assertion_ids,EVALUATION_CONCURRENCY,async id=>{const assertionDefinition=document.assertions.find(entry=>entry.id===id);const measurementDefinition=document.measurements.find(entry=>entry.id===assertionDefinition.measurement_id);let scopedContext=context;if(assertionDefinition.scope.kind==="active"){const terminalStatuses=new Set(context.terminal_statuses??["closed","canceled"]);scopedContext={...context,items:context.items.filter(item=>!terminalStatuses.has(item.status))}}else if(assertionDefinition.scope.kind==="filter"){const scopeMeasurementId=assertionDefinition.scope.measurement_id;const scopeDefinition=document.measurements.find(entry=>entry.id===scopeMeasurementId);const scope=await evaluateGateMeasurement(gateDefinition.id,assertionDefinition.id,scopeDefinition,context,document.measurements);const contributorIds=new Set(scope.contributors);scopedContext={...context,items:context.items.filter(item=>contributorIds.has(item.id))}}const owner=context.items.find(item=>item.id===assertionDefinition.owner_item_id);const ownerTerminal=owner!==void 0&&new Set(context.terminal_statuses??["closed","canceled"]).has(owner.status);return evaluateAssuranceAssertion(assertionDefinition,await evaluateGateMeasurement(gateDefinition.id,assertionDefinition.id,measurementDefinition,scopedContext,document.measurements),{owner_terminal:ownerTerminal})});const blocking=assertions.some(entry=>entry.verdict==="fail"&&entry.enforcement==="block");const warning=assertions.some(entry=>entry.verdict==="fail"&&entry.enforcement==="warn");return{gate_id:gateDefinition.id,tree_id:context.tree_id,trigger:options.trigger,dry_run:options.dry_run===true,evaluated_at:new Date().toISOString(),verdict:blocking?"block":warning?"warn":"pass",exit_code:blocking?1:0,assertions,assertions_total:assertions.length,row_contract:{row_keys:["assertions"],jq_selector:".assertions[]"},cost:sumCosts(assertions.map(entry=>entry.cost),Math.max(0,...assertions.map(entry=>entry.cost.duration_ms)))}}function assurancePath(pmRoot){return path.join(pmRoot,"assurance.json")}async function readDocument(pmRoot){const raw=await readFileIfExists(assurancePath(pmRoot));if(raw===null)return createEmptyAssuranceDocument();return parseAssuranceDocument(raw)}function parseAssuranceDocument(raw){try{return validateAssuranceDocument(JSON.parse(raw))}catch(error){throw new PmCliError("The assurance registry is invalid. Repair or restore .agents/pm/assurance.json and retry.",EXIT_CODE.GENERIC_FAILURE,{code:"assurance_registry_invalid",reason:String(error),nextSteps:["Restore a valid assurance.json from version control or repair its declaration references.","Run pm assurance list measurement after the repair."]})}}function collectionFor(document,kind){if(kind==="measurement")return document.measurements;if(kind==="assertion")return document.assertions;return document.gates}function validateForKind(kind,definition){if(kind==="measurement")validateMeasurementDefinition(definition);else if(kind==="assertion")validateAssertionDefinition(definition);else validateGateDefinition(definition)}async function listAssuranceDeclarations(pmRoot,kind){const items=structuredClone(collectionFor(await readDocument(pmRoot),kind));return{items,count:items.length,row_contract:{row_keys:["items"],jq_selector:".items[]"}}}async function getAssuranceDeclaration(pmRoot,kind,id){const found=collectionFor(await readDocument(pmRoot),kind).find(entry=>entry.id===id);if(!found)throw new TypeError(`assurance ${kind} ${id} not found`);return structuredClone(found)}async function putAssuranceDeclaration(pmRoot,kind,definition,options={}){validateForKind(kind,definition);const settings=await readSettings(pmRoot);const author=resolveAuthor(options.author,settings.author_default);const mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:`assurance:${kind}:put`,author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw);const collection=collectionFor(document,kind);const index=collection.findIndex(entry=>entry.id===definition.id);const action=index<0?"created":"updated";if(kind==="assertion"&&index>=0&&assuranceAssertionUpdateIsLoosening(collection[index],definition)){const decision=definition.authorization_decision;if(!decision||!options.authorized_decision_ids?.includes(decision)){throw new AssuranceMutationRefusalError(`loosening assertion ${definition.id} requires a verified authorization_decision`)}}if(index<0)collection.push(structuredClone(definition));else collection[index]=structuredClone(definition);validateAssuranceDocument(document);return{raw:`${JSON.stringify(document,null,2)}
-`,result:{changed:true,action,kind,id:definition.id}}}});return{...mutation.result,changed:mutation.changed}}async function putAssuranceDeclarationBundle(pmRoot,bundle,options={}){const candidate=createEmptyAssuranceDocument();candidate.measurements=structuredClone(bundle.measurements);candidate.assertions=structuredClone(bundle.assertions);candidate.gates=structuredClone(bundle.gates);validateAssuranceDocument(candidate);const settings=await readSettings(pmRoot);const author=resolveAuthor(options.author,settings.author_default);const mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:"assurance:bundle:apply",author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw);const createdIds=[];const unchangedIds=[];const apply=(target,additions,kind)=>{for(const definition of additions){const existing=target.find(entry=>entry.id===definition.id);if(!existing){target.push(structuredClone(definition));createdIds.push(`${kind}:${definition.id}`);continue}if(stableStringify(existing)!==stableStringify(definition)){throw new AssuranceMutationRefusalError(`assurance bundle refuses to replace divergent ${kind} ${definition.id}`)}unchangedIds.push(`${kind}:${definition.id}`)}};apply(document.measurements,candidate.measurements,"measurement");apply(document.assertions,candidate.assertions,"assertion");apply(document.gates,candidate.gates,"gate");validateAssuranceDocument(document);return{raw:`${JSON.stringify(document,null,2)}
-`,result:{changed:createdIds.length>0,created_ids:createdIds,unchanged_ids:unchangedIds}}}});return{...mutation.result,changed:mutation.changed}}async function removeAssuranceDeclaration(pmRoot,kind,id,options={}){const settings=await readSettings(pmRoot);const author=resolveAuthor(options.author,settings.author_default);const mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:`assurance:${kind}:remove`,author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw);if(kind==="measurement"){const consumers=collectMeasurementReferences(document).get(id);if(consumers&&consumers.length>0){throw new AssuranceMutationRefusalError(`assurance measurement ${id} is referenced by ${consumers.join(", ")}`)}}if(kind==="assertion"&&document.gates.some(entry=>entry.assertion_ids.includes(id))){throw new AssuranceMutationRefusalError(`assurance assertion ${id} is referenced by gate`)}const collection=collectionFor(document,kind);const index=collection.findIndex(entry=>entry.id===id);if(index<0){throw new AssuranceMutationRefusalError(`assurance ${kind} ${id} not found`)}collection.splice(index,1);validateAssuranceDocument(document);return{raw:`${JSON.stringify(document,null,2)}
-`,result:{changed:true,action:"removed",kind,id}}}});return{...mutation.result,changed:mutation.changed}}async function recordAssuranceVerdict(pmRoot,verdict,options={}){if(verdict.dry_run)throw new TypeError("dry-run assurance verdicts are not persisted");const settings=await readSettings(pmRoot);await appendWorkspaceAuditEvent({pmRoot,op:"assurance:gate:verdict",author:resolveAuthor(options.author,settings.author_default),context:{assurance_verdict:verdict},message:options.message??`Assurance gate ${verdict.gate_id} returned ${verdict.verdict}`,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS})}async function listAssuranceVerdicts(pmRoot,options={}){const limit=options.limit??DEFAULT_VERDICT_LIMIT;if(!Number.isInteger(limit)||limit<1||limit>MAX_ASSURANCE_VERDICT_LIMIT){throw new TypeError(`assurance verdict limit must be an integer from 1 through ${MAX_ASSURANCE_VERDICT_LIMIT}`)}const entries=await readHistoryEntries(getWorkspaceHistoryPath(pmRoot),WORKSPACE_HISTORY_ID);return entries.reverse().filter(entry=>entry.op==="assurance:gate:verdict").map(entry=>entry.context?.assurance_verdict).filter(value=>typeof value==="object"&&value!==null&&"gate_id"in value).filter(verdict=>options.gate_id===void 0||verdict.gate_id===options.gate_id).slice(0,limit)}export{ASSURANCE_DOCUMENT_VERSION,ASSURANCE_GATE_TRIGGERS,ASSURANCE_MEASUREMENT_SOURCE_KINDS,assuranceAssertionUpdateIsLoosening,createEmptyAssuranceDocument,evaluateAssuranceAssertion,evaluateAssuranceGate,evaluateMeasurement,getAssuranceDeclaration,listAssuranceDeclarations,listAssuranceVerdicts,putAssuranceDeclaration,putAssuranceDeclarationBundle,recordAssuranceVerdict,removeAssuranceDeclaration,validateAssertionDefinition,validateAssuranceDocument,validateGateDefinition,validateMeasurementDefinition};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df2d04b7-a47b-59d1-8a70-ba321a1c6b24")}catch{}})();import{createHash}from"node:crypto";import path from"node:path";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{appendWorkspaceAuditEvent,mutateWorkspaceJsonWithHistory,readFileIfExists,readHistoryEntries,readSettings,resolveAuthor,stableStringify,WORKSPACE_HISTORY_ID,getWorkspaceHistoryPath}from"../runtime-primitives.js";import{resolveCanonicalRelationshipKind}from"../relationships.js";import{MAX_ASSURANCE_VERDICT_LIMIT}from"./assurance-limits.js";import{AssuranceEvaluationRefusalError,AssuranceMutationRefusalError,AssuranceSourceResolutionError}from"./assurance-mutation-error.js";const ASSURANCE_DOCUMENT_VERSION=1,ASSURANCE_GATE_TRIGGERS=["pre-commit","pre-push","pre-merge","ci","pre-release","post-release","scheduled","on-claim","on-close"],ASSURANCE_MEASUREMENT_SOURCE_KINDS=["items","dependency_kind","prose_edge_gap","graph","validate","health","history","links","provider","derived"],POLARITY_KEYS=["ceiling","floor","equals","zero","monotone_nondecreasing","monotone_nonincreasing","subset_of"],ID_PATTERN=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/,LOCK_TTL_SECONDS=30,LOCK_WAIT_MS=5e3,EVALUATION_CONCURRENCY=4,DEFAULT_VERDICT_LIMIT=50;function requireStableId(value,field){if(!ID_PATTERN.test(value))throw new AssuranceMutationRefusalError(`${field} must be a stable lowercase id`)}function requireFiniteNonNegative(value,field){if(!Number.isFinite(value)||value<0)throw new AssuranceMutationRefusalError(`${field} must be a finite non-negative number`)}function boundFor(assertion){const present=POLARITY_KEYS.filter(key=>assertion[key]!==void 0);if(present.length!==1)throw new AssuranceMutationRefusalError(`assertion ${assertion.id} must declare exactly one polarity`);const polarity=present[0],raw=assertion[polarity];return{polarity,value:polarity==="zero"?0:raw}}function valuesEqual(left,right){return stableStringify(left)===stableStringify(right)}function compareBound(observed,bound){if(bound.polarity==="equals")return valuesEqual(observed,bound.value);if(bound.polarity==="subset_of"){if(!Array.isArray(observed)||!Array.isArray(bound.value))return!1;const allowed=bound.value;return observed.every(entry=>allowed.includes(entry))}if(typeof observed!="number")return!1;const numericBound=bound.value;return bound.polarity==="ceiling"||bound.polarity==="monotone_nonincreasing"?observed<=numericBound:bound.polarity==="floor"||bound.polarity==="monotone_nondecreasing"?observed>=numericBound:observed===0}function proveNegativeControl(assertion){const bound=boundFor(assertion),cases=assertion.negative_control.cases;return cases.some(entry=>entry.expected==="pass")&&cases.some(entry=>entry.expected==="fail")&&cases.every(entry=>compareBound(entry.observed,bound)===(entry.expected==="pass"))}function boundUpdateIsLoosening(beforeBound,afterBound){if(beforeBound.polarity!==afterBound.polarity)return!0;if(typeof beforeBound.value=="number"&&typeof afterBound.value=="number")return beforeBound.polarity==="ceiling"||beforeBound.polarity==="monotone_nonincreasing"?afterBound.value>beforeBound.value:beforeBound.polarity==="floor"||beforeBound.polarity==="monotone_nondecreasing"?afterBound.value<beforeBound.value:afterBound.value!==beforeBound.value;if(beforeBound.polarity==="subset_of"){const beforeValues=beforeBound.value,afterValues=afterBound.value;return!Array.isArray(beforeValues)||!Array.isArray(afterValues)||afterValues.some(entry=>!beforeValues.includes(entry))}return!valuesEqual(beforeBound.value,afterBound.value)}function assuranceAssertionUpdateIsLoosening(before,after){if(before.measurement_id!==after.measurement_id||before.owner_item_id!==after.owner_item_id||stableStringify(before.scope)!==stableStringify(after.scope))return!0;const enforcementRank={observe:0,warn:1,block:2},lifetimeLoosened=(before.lifetime??"hold")==="hold"&&(after.lifetime??"hold")==="retire";return boundUpdateIsLoosening(boundFor(before),boundFor(after))||enforcementRank[after.enforcement]<enforcementRank[before.enforcement]||lifetimeLoosened}function validateItemsMeasurementSource(source){if(source.state!==void 0&&!(source.state==="present"||source.state==="missing"))throw new AssuranceMutationRefusalError("items source state must be present or missing");const hasEquals=Object.hasOwn(source,"equals"),hasState=source.state!==void 0,predicateCount=Number(hasEquals)+Number(hasState);if(source.field!==void 0&&predicateCount!==1)throw new AssuranceMutationRefusalError("items source with field requires exactly one of equals or state");if(source.field===void 0&&predicateCount!==0)throw new AssuranceMutationRefusalError("items source equals/state requires field")}function validateDependencyKindMeasurementSource(source){if(typeof source.dependency_kind!="string"||source.dependency_kind.trim().length===0)throw new AssuranceMutationRefusalError("dependency_kind source requires dependency_kind");if([source.source_kind,source.source_kind_prefix,source.source_kind_state].filter(value=>value!==void 0).length>1)throw new AssuranceMutationRefusalError("dependency_kind source accepts at most one source_kind predicate");if(source.source_kind!==void 0&&source.source_kind.trim().length===0||source.source_kind_prefix!==void 0&&source.source_kind_prefix.trim().length===0)throw new AssuranceMutationRefusalError("dependency_kind source provenance values must not be empty");if(source.source_kind_state!==void 0&&source.source_kind_state!=="present"&&source.source_kind_state!=="missing")throw new AssuranceMutationRefusalError("dependency_kind source source_kind_state must be present or missing")}function validateProseEdgeGapSource(source){if(source.sample_limit!==void 0&&(!Number.isInteger(source.sample_limit)||source.sample_limit<1))throw new AssuranceMutationRefusalError("prose_edge_gap sample_limit must be a positive integer");for(const exemption of source.exemptions??[]){if(typeof exemption.holder_id!="string"||exemption.holder_id.trim().length===0||typeof exemption.reason!="string"||exemption.reason.trim().length===0)throw new AssuranceMutationRefusalError("prose_edge_gap exemptions require holder_id and reason");if(exemption.target_id!==void 0&&exemption.target_id.trim().length===0||exemption.text_contains!==void 0&&exemption.text_contains.trim().length===0)throw new AssuranceMutationRefusalError("prose_edge_gap exemption selectors must not be empty")}}function validateMeasurementDefinition(definition){requireStableId(definition.id,"measurement.id"),definition.max_cost!==void 0&&requireFiniteNonNegative(definition.max_cost,"measurement.max_cost");const candidateSource=definition.source;if(Object.prototype.toString.call(candidateSource)!=="[object Object]")throw new AssuranceMutationRefusalError(`measurement.source.kind must be one of ${ASSURANCE_MEASUREMENT_SOURCE_KINDS.join(", ")}`);const sourceKind=Reflect.get(candidateSource,"kind");if(!ASSURANCE_MEASUREMENT_SOURCE_KINDS.includes(sourceKind))throw new AssuranceMutationRefusalError(`measurement.source.kind must be one of ${ASSURANCE_MEASUREMENT_SOURCE_KINDS.join(", ")}`);const source=candidateSource;if(source.kind==="items"&&validateItemsMeasurementSource(source),source.kind==="dependency_kind"&&validateDependencyKindMeasurementSource(source),source.kind==="prose_edge_gap"&&validateProseEdgeGapSource(source),(source.kind==="graph"||source.kind==="validate"||source.kind==="health")&&(typeof source.field!="string"||source.field.trim().length===0))throw new AssuranceMutationRefusalError(`${source.kind} source requires field`);return source.kind==="provider"&&(requireStableId(source.provider,"provider source provider"),requireStableId(source.key,"provider source key")),definition}function validateAssertionDefinition(definition){if(requireStableId(definition.id,"assertion.id"),requireStableId(definition.measurement_id,"assertion.measurement_id"),typeof definition.owner_item_id!="string"||definition.owner_item_id.trim().length===0)throw new AssuranceMutationRefusalError("assertion.owner_item_id is required");const bound=boundFor(definition);if(typeof bound.value=="number"&&!Number.isFinite(bound.value))throw new AssuranceMutationRefusalError(`assertion.${bound.polarity} must be a finite number`);if(definition.lifetime==="retire"&&(typeof definition.retire_reason!="string"||definition.retire_reason.trim().length===0))throw new AssuranceMutationRefusalError("retired assertion requires retire_reason");definition.scope.kind==="filter"&&requireStableId(definition.scope.measurement_id,"assertion.scope.measurement_id");const cases=definition.negative_control?.cases;if(!Array.isArray(cases)||!cases.some(entry=>entry.expected==="pass")||!cases.some(entry=>entry.expected==="fail"))throw new AssuranceMutationRefusalError("assertion negative control requires pass and fail cases");if(!proveNegativeControl(definition))throw new AssuranceMutationRefusalError(`assertion ${definition.id} negative control does not prove its bound`);return definition}function validateGateProviderPolicy(policy){if(!Array.isArray(policy.allowed_providers))throw new AssuranceMutationRefusalError("gate provider_policy.allowed_providers must be an array");for(const provider of policy.allowed_providers)requireStableId(provider,"gate.provider_policy.allowed_provider");if(typeof policy.triggers!="object"||policy.triggers===null||Array.isArray(policy.triggers))throw new AssuranceMutationRefusalError("gate provider_policy.triggers must be an object");for(const[trigger,rule]of Object.entries(policy.triggers)){if(!ASSURANCE_GATE_TRIGGERS.includes(trigger))throw new AssuranceMutationRefusalError(`gate provider policy has unknown trigger ${trigger}`);if(typeof rule!="object"||rule===null||!["low","medium","high"].includes(rule.max_cost_class)||typeof rule.allow_network!="boolean")throw new AssuranceMutationRefusalError(`gate provider policy trigger ${trigger} is invalid`)}}function validateGateDefinition(definition){if(requireStableId(definition.id,"gate.id"),!Array.isArray(definition.assertion_ids))throw new AssuranceMutationRefusalError("gate.assertion_ids is required and must be an array");if(definition.assertion_ids.length===0)throw new AssuranceMutationRefusalError("gate requires at least one assertion");for(const id of definition.assertion_ids)requireStableId(id,"gate.assertion_id");if(!Array.isArray(definition.triggers))throw new AssuranceMutationRefusalError(`gate.triggers is required and must be an array of ${ASSURANCE_GATE_TRIGGERS.join(", ")}`);if(definition.triggers.length===0)throw new AssuranceMutationRefusalError("gate requires at least one trigger");for(const trigger of definition.triggers)if(!ASSURANCE_GATE_TRIGGERS.includes(trigger))throw new AssuranceMutationRefusalError(`gate trigger must be one of ${ASSURANCE_GATE_TRIGGERS.join(", ")}`);return definition.provider_policy&&validateGateProviderPolicy(definition.provider_policy),definition}function validateAssuranceDocument(document){if(document.version!==ASSURANCE_DOCUMENT_VERSION)throw new AssuranceMutationRefusalError(`unsupported assurance document version ${String(document.version)}`);const ids=new Set;for(const definition of document.measurements){if(validateMeasurementDefinition(definition),ids.has(`measurement:${definition.id}`))throw new AssuranceMutationRefusalError(`duplicate measurement ${definition.id}`);ids.add(`measurement:${definition.id}`)}for(const definition of document.assertions){if(validateAssertionDefinition(definition),ids.has(`assertion:${definition.id}`))throw new AssuranceMutationRefusalError(`duplicate assertion ${definition.id}`);ids.add(`assertion:${definition.id}`)}for(const definition of document.gates){validateGateDefinition(definition);const missing=definition.assertion_ids.filter(id=>!document.assertions.some(assertionDefinition=>assertionDefinition.id===id));if(missing.length>0)throw new AssuranceMutationRefusalError(`gate ${definition.id} references missing assertions: ${missing.join(", ")}`);if(ids.has(`gate:${definition.id}`))throw new AssuranceMutationRefusalError(`duplicate gate ${definition.id}`);ids.add(`gate:${definition.id}`)}const measurementIds=new Set(document.measurements.map(entry=>entry.id));for(const[measurementId,consumers]of collectMeasurementReferences(document))if(!measurementIds.has(measurementId))throw new AssuranceMutationRefusalError(`${consumers.join(", ")} references missing measurement ${measurementId}`);return document}function collectExpressionMeasurementReferences(expression,references){if("measurement"in expression){references.push(expression.measurement);return}if("operator"in expression)for(const operand of expression.operands)collectExpressionMeasurementReferences(operand,references)}function collectMeasurementReferences(document){const references=new Map,add=(measurementId,consumer)=>{const consumers=references.get(measurementId)??[];consumers.push(consumer),references.set(measurementId,consumers)};for(const assertionDefinition of document.assertions)add(assertionDefinition.measurement_id,`assertion ${assertionDefinition.id}`),assertionDefinition.scope.kind==="filter"&&add(assertionDefinition.scope.measurement_id,`assertion ${assertionDefinition.id} scope`);for(const measurementDefinition of document.measurements){if(measurementDefinition.source.kind!=="derived")continue;const derivedReferences=[];collectExpressionMeasurementReferences(measurementDefinition.source.expression,derivedReferences);for(const measurementId of derivedReferences)add(measurementId,`derived measurement ${measurementDefinition.id}`)}return references}function collectGateProviderIds(gate,document){const pending=gate.assertion_ids.flatMap(assertionId=>{const assertion=document.assertions.find(entry=>entry.id===assertionId);return[assertion.measurement_id,...assertion.scope.kind==="filter"?[assertion.scope.measurement_id]:[]]}),visited=new Set,providers=new Set;for(;pending.length>0;){const measurementId=pending.pop();if(visited.has(measurementId))continue;visited.add(measurementId);const measurement=document.measurements.find(entry=>entry.id===measurementId);measurement.source.kind==="provider"?providers.add(measurement.source.provider):measurement.source.kind==="derived"&&collectExpressionMeasurementReferences(measurement.source.expression,pending)}return providers}function createEmptyAssuranceDocument(){return{version:ASSURANCE_DOCUMENT_VERSION,measurements:[],assertions:[],gates:[]}}function itemsSourceResult(source,context){const matches=context.items.filter(item=>(source.statuses===void 0||source.statuses.includes(item.status))&&(source.types===void 0||source.types.includes(item.type))&&(source.tags===void 0||source.tags.every(tag=>item.tags?.includes(tag)))&&(source.field===void 0||(()=>{const value=item[source.field];if(source.state!==void 0){const missing=value==null||value===""||Array.isArray(value)&&value.length===0;return source.state==="missing"?missing:!missing}return valuesEqual(value,source.equals)})()));return{value:matches.length,population_size:context.items.length,cost:context.items.length,contributors:matches.map(item=>item.id)}}function dependencyProvenanceMatches(source,sourceKind){return source.source_kind!==void 0?sourceKind?.toLowerCase()===source.source_kind.trim().toLowerCase():source.source_kind_prefix!==void 0?sourceKind?.toLowerCase().startsWith(source.source_kind_prefix.trim().toLowerCase())===!0:source.source_kind_state==="present"?sourceKind!==void 0&&sourceKind.length>0:source.source_kind_state==="missing"?sourceKind===void 0||sourceKind.length===0:!0}function dependencyKindSourceResult(source,context){const contributors=[],requestedKind=resolveCanonicalRelationshipKind(source.dependency_kind)??source.dependency_kind.trim().toLowerCase();for(const item of context.items)for(const dependency of item.dependencies??[]){const dependencyKind=resolveCanonicalRelationshipKind(dependency.kind)??dependency.kind.trim().toLowerCase(),sourceKind=dependency.source_kind?.trim();dependencyKind===requestedKind&&dependencyProvenanceMatches(source,sourceKind)&&contributors.push(`${item.id}->${dependency.id}${sourceKind?`@${sourceKind}`:""}`)}return{value:contributors.length,population_size:context.items.length,cost:context.items.length,contributors}}function assuranceItemProseSegments(item){const segments=[item.description,item.body].filter(value=>typeof value=="string").map(value=>value.trim()).filter(Boolean);for(const key of["comments","notes","learnings"]){const entries=item[key];if(Array.isArray(entries)){for(const entry of entries)if(typeof entry=="string")segments.push(entry);else if(typeof entry=="object"&&entry!==null){const text=Reflect.get(entry,"text");typeof text=="string"&&segments.push(text)}}}return segments}function proseReferenceIsExempt(exemptions,holderId,targetId,segment){return exemptions.some(exemption=>exemption.holder_id.trim().toLowerCase()===holderId.toLowerCase()&&(exemption.target_id===void 0||exemption.target_id.trim().toLowerCase()===targetId.toLowerCase())&&(exemption.text_contains===void 0||segment.toLowerCase().includes(exemption.text_contains.trim().toLowerCase())))}function prosePairKey(left,right){return[left.toLowerCase(),right.toLowerCase()].sort().join("\0")}function collectProseEdgeCensusInputs(items){const canonicalIds=new Map,linkedPairs=new Set,proseMentions=[],mentionPattern=/\b[a-z][a-z0-9]*-[a-z0-9]+\b/giu;let mentionCount=0;for(const item of items){canonicalIds.set(item.id.toLowerCase(),item.id);for(const dependency of item.dependencies??[])linkedPairs.add(prosePairKey(item.id,dependency.id));for(const scalar of[item.parent,item.blocked_by])typeof scalar=="string"&&linkedPairs.add(prosePairKey(item.id,scalar));for(const segment of assuranceItemProseSegments(item)){const mentionedIds=[...segment.matchAll(mentionPattern)].map(match=>match[0]);mentionCount+=mentionedIds.length,proseMentions.push({holder_id:item.id,segment,mentioned_ids:mentionedIds})}}return{canonical_ids:canonicalIds,linked_pairs:linkedPairs,prose_mentions:proseMentions,mention_count:mentionCount}}function proseEdgeGapSourceResult(source,context){const census=collectProseEdgeCensusInputs(context.items),gaps=new Map;for(const proseMention of census.prose_mentions){const mentions=proseMention.mentioned_ids.map(id=>census.canonical_ids.get(id.toLowerCase())).filter(id=>id!==void 0&&id!==proseMention.holder_id),distinctMentions=[...new Set(mentions)];for(const targetId of distinctMentions){const key=prosePairKey(proseMention.holder_id,targetId);if(census.linked_pairs.has(key)||proseReferenceIsExempt(source.exemptions??[],proseMention.holder_id,targetId,proseMention.segment))continue;const explicit=distinctMentions.some(candidate=>candidate!==targetId);gaps.get(key)?.explicit===!0&&!explicit||gaps.set(key,{contributor:`${proseMention.holder_id}->${targetId}|subject=${explicit?"explicit":"implicit"}`,explicit})}}const gapRows=[...gaps.values()],contributors=gapRows.map(entry=>entry.contributor).sort();return{value:contributors.length,population_size:census.canonical_ids.size,cost:context.items.length+census.linked_pairs.size+census.mention_count,contributors:contributors.slice(0,source.sample_limit??25),partitions:{explicit_subject:gapRows.filter(entry=>entry.explicit).length,implicit_subject:gapRows.filter(entry=>!entry.explicit).length}}}function historySourceResult(source,context){return{value:context.history.filter(entry=>(source.op===void 0||entry.op===source.op)&&(source.author===void 0||entry.author===source.author)&&(source.harness===void 0||entry.agent_harness===source.harness)&&(source.model===void 0||entry.agent_model===source.model)).length,population_size:context.history.length,cost:context.history.length}}function linksSourceResult(source,context){const matches=context.items.filter(item=>{const links=item[source.link],present=Array.isArray(links)&&links.length>0;return source.state==="present"?present:!present});return{value:matches.length,population_size:context.items.length,cost:context.items.length,contributors:matches.map(item=>item.id)}}function sourceResult(definition,context){const source=definition.source;return source.kind==="items"?itemsSourceResult(source,context):source.kind==="dependency_kind"?dependencyKindSourceResult(source,context):source.kind==="prose_edge_gap"?proseEdgeGapSourceResult(source,context):source.kind==="history"?historySourceResult(source,context):source.kind==="links"?linksSourceResult(source,context):null}function sumCosts(costs,durationMs){return costs.reduce((total,cost)=>({units:total.units+cost.units,items_scanned:total.items_scanned+cost.items_scanned,history_entries:total.history_entries+cost.history_entries,provider_calls:total.provider_calls+cost.provider_calls,duration_ms:durationMs}),{units:0,items_scanned:0,history_entries:0,provider_calls:0,duration_ms:durationMs})}function arithmeticValue(operator,values){if(values.length===0)throw new TypeError(`derived ${operator} requires operands`);if(operator==="add")return values.reduce((sum,value)=>sum+value,0);if(operator==="subtract")return values.slice(1).reduce((result,value)=>result-value,values[0]);if(operator==="multiply")return values.reduce((result,value)=>result*value,1);if(operator==="divide"){if(values.slice(1).includes(0))throw new TypeError("derived divide cannot divide by zero");return values.slice(1).reduce((result,value)=>result/value,values[0])}return operator==="min"?Math.min(...values):Math.max(...values)}async function mapWithConcurrency(values,limit,transform){const results=new Array(values.length);let nextIndex=0;const workers=Array.from({length:Math.min(limit,values.length)},async()=>{for(;nextIndex<values.length;){const index=nextIndex;nextIndex+=1,results[index]=await transform(values[index],index)}});return await Promise.all(workers),results}async function evaluateExpression(expression,context,definitions,stack,state){if("literal"in expression)return{value:expression.literal,costs:[],population_size:0,contributors:[]};if("measurement"in expression){const definition=definitions.find(entry=>entry.id===expression.measurement);if(!definition)throw new TypeError(`derived measurement references missing ${expression.measurement}`);const result=await evaluateMeasurementCached(definition,context,definitions,stack,state);if(typeof result.value!="number")throw new TypeError(`derived measurement ${definition.id} is not numeric`);const costs=state.charged.has(definition.id)?[]:[result.cost];return state.charged.add(definition.id),{value:result.value,costs,population_size:result.population_size,contributors:result.contributors}}const operands=await mapWithConcurrency(expression.operands,EVALUATION_CONCURRENCY,operand=>evaluateExpression(operand,context,definitions,stack,state));return{value:arithmeticValue(expression.operator,operands.map(entry=>entry.value)),costs:operands.flatMap(entry=>entry.costs),population_size:Math.max(0,...operands.map(entry=>entry.population_size)),contributors:[...new Set(operands.flatMap(entry=>entry.contributors))]}}async function evaluateMeasurementInternal(definition,context,definitions,stack,state){validateMeasurementDefinition(definition);const startedAt=Date.now();let result,nestedCosts=[],providerCalls=0;if(definition.source.kind==="derived"){const derived=await evaluateExpression(definition.source.expression,context,definitions,[...stack,definition.id],state);result={value:derived.value,population_size:derived.population_size,cost:0,contributors:derived.contributors},nestedCosts=derived.costs}else{const builtin=sourceResult(definition,context);builtin!==null?result=builtin:(result=await context.external(definition.source),providerCalls=1)}const ownCost={units:result.cost,items_scanned:definition.source.kind==="items"||definition.source.kind==="dependency_kind"||definition.source.kind==="prose_edge_gap"||definition.source.kind==="links"?context.items.length:0,history_entries:definition.source.kind==="history"?context.history.length:0,provider_calls:providerCalls,duration_ms:Date.now()-startedAt},cost=sumCosts([...nestedCosts,ownCost],Date.now()-startedAt);if(definition.max_cost!==void 0&&cost.units>definition.max_cost)throw new AssuranceEvaluationRefusalError(`measurement ${definition.id} exceeded cost ceiling ${definition.max_cost} with ${cost.units}`);return{id:definition.id,definition_fingerprint:`sha256:${createHash("sha256").update(stableStringify(definition)).digest("hex")}`,value:result.value,population_size:result.population_size,cost,contributors:result.contributors??[],...result.partitions?{partitions:result.partitions}:{}}}function evaluateMeasurementCached(definition,context,definitions,stack,state){if(stack.includes(definition.id))throw new TypeError(`derived measurement cycle: ${[...stack,definition.id].join(" -> ")}`);const cached=state.cache.get(definition.id);if(cached)return cached;const evaluation=evaluateMeasurementInternal(definition,context,definitions,stack,state).catch(error=>{if(error instanceof AssuranceSourceResolutionError&&error.measurement_id===void 0){const sourceContext={measurement_id:definition.id,source_kind:error.source_kind,field:error.field,...error.check?{check:error.check}:{}},sourceError=new AssuranceSourceResolutionError(error.message,sourceContext);throw sourceError.cause=error,sourceError}throw error});return state.cache.set(definition.id,evaluation),evaluation}async function evaluateMeasurement(definition,context,definitions=[definition]){return evaluateMeasurementCached(definition,context,definitions,[],{cache:new Map,charged:new Set})}function assertionDistance(observed,bound){return typeof observed!="number"||typeof bound.value!="number"?null:bound.polarity==="ceiling"||bound.polarity==="monotone_nonincreasing"?bound.value-observed:(bound.polarity==="floor"||bound.polarity,observed-bound.value)}function evaluateAssuranceAssertion(definition,measurement,options={}){validateAssertionDefinition(definition);const bound=boundFor(definition),retired=definition.lifetime==="retire"&&options.owner_terminal===!0;return{assertion_id:definition.id,measurement_id:definition.measurement_id,measurement_definition_fingerprint:measurement.definition_fingerprint,scope:definition.scope,population_size:measurement.population_size,observed:measurement.value,bound,distance:assertionDistance(measurement.value,bound),verdict:retired?"retired":compareBound(measurement.value,bound)?"pass":"fail",enforcement:definition.enforcement,negative_control_proven:proveNegativeControl(definition),cost:measurement.cost,contributors:measurement.contributors,...measurement.partitions?{partitions:measurement.partitions}:{}}}function enforceGateProviderPolicy(gate,document,context,trigger){const providerIds=collectGateProviderIds(gate,document);if(providerIds.size===0)return;const policy=gate.provider_policy,triggerPolicy=policy?.triggers[trigger];if(!policy||!triggerPolicy)throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider execution at trigger ${trigger} without an explicit provider policy`);const allowedProviders=new Set(policy.allowed_providers),costRank={low:0,medium:1,high:2};for(const providerId of providerIds){if(!allowedProviders.has(providerId))throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider ${providerId}`);const capability=context.provider_capabilities?.[providerId];if(!capability)throw new AssuranceEvaluationRefusalError(`assurance provider ${providerId} has no declared capabilities`);if(costRank[capability.cost_class]>costRank[triggerPolicy.max_cost_class])throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses ${capability.cost_class}-cost provider ${providerId} at trigger ${trigger}`);if(capability.network&&!triggerPolicy.allow_network)throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses network provider ${providerId} at trigger ${trigger}`)}}async function evaluateGateMeasurement(gateId,assertionId,definition,context,definitions){try{return await evaluateMeasurement(definition,context,definitions)}catch(error){if(error instanceof AssuranceSourceResolutionError){const checkLocation=error.check?` check ${error.check}`:"",measurementId=error.measurement_id??definition.id,refusal=new AssuranceEvaluationRefusalError(`assurance gate ${gateId} assertion ${assertionId} measurement ${measurementId} source ${error.source_kind}${checkLocation} field ${error.field} could not resolve: ${error.message}`,{gate_id:gateId,assertion_id:assertionId,measurement_id:measurementId,source_kind:error.source_kind,field:error.field,...error.check?{check:error.check}:{}});throw refusal.cause=error,refusal}throw error}}async function evaluateAssuranceGate(gateId,document,context,options){validateAssuranceDocument(document);const gateDefinition=document.gates.find(entry=>entry.id===gateId);if(!gateDefinition)throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} not found`);if(!gateDefinition.triggers.includes(options.trigger))throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} does not declare trigger ${options.trigger}`);enforceGateProviderPolicy(gateDefinition,document,context,options.trigger);const assertions=await mapWithConcurrency(gateDefinition.assertion_ids,EVALUATION_CONCURRENCY,async id=>{const assertionDefinition=document.assertions.find(entry=>entry.id===id),measurementDefinition=document.measurements.find(entry=>entry.id===assertionDefinition.measurement_id);let scopedContext=context;if(assertionDefinition.scope.kind==="active"){const terminalStatuses=new Set(context.terminal_statuses??["closed","canceled"]);scopedContext={...context,items:context.items.filter(item=>!terminalStatuses.has(item.status))}}else if(assertionDefinition.scope.kind==="filter"){const scopeMeasurementId=assertionDefinition.scope.measurement_id,scopeDefinition=document.measurements.find(entry=>entry.id===scopeMeasurementId),scope=await evaluateGateMeasurement(gateDefinition.id,assertionDefinition.id,scopeDefinition,context,document.measurements),contributorIds=new Set(scope.contributors);scopedContext={...context,items:context.items.filter(item=>contributorIds.has(item.id))}}const owner=context.items.find(item=>item.id===assertionDefinition.owner_item_id),ownerTerminal=owner!==void 0&&new Set(context.terminal_statuses??["closed","canceled"]).has(owner.status);return evaluateAssuranceAssertion(assertionDefinition,await evaluateGateMeasurement(gateDefinition.id,assertionDefinition.id,measurementDefinition,scopedContext,document.measurements),{owner_terminal:ownerTerminal})}),blocking=assertions.some(entry=>entry.verdict==="fail"&&entry.enforcement==="block"),warning=assertions.some(entry=>entry.verdict==="fail"&&entry.enforcement==="warn");return{gate_id:gateDefinition.id,tree_id:context.tree_id,trigger:options.trigger,dry_run:options.dry_run===!0,evaluated_at:new Date().toISOString(),verdict:blocking?"block":warning?"warn":"pass",exit_code:blocking?1:0,assertions,assertions_total:assertions.length,row_contract:{row_keys:["assertions"],jq_selector:".assertions[]"},cost:sumCosts(assertions.map(entry=>entry.cost),Math.max(0,...assertions.map(entry=>entry.cost.duration_ms)))}}function assurancePath(pmRoot){return path.join(pmRoot,"assurance.json")}async function readDocument(pmRoot){const raw=await readFileIfExists(assurancePath(pmRoot));return raw===null?createEmptyAssuranceDocument():parseAssuranceDocument(raw)}function parseAssuranceDocument(raw){try{return validateAssuranceDocument(JSON.parse(raw))}catch(error){throw new PmCliError("The assurance registry is invalid. Repair or restore .agents/pm/assurance.json and retry.",EXIT_CODE.GENERIC_FAILURE,{code:"assurance_registry_invalid",reason:String(error),nextSteps:["Restore a valid assurance.json from version control or repair its declaration references.","Run pm assurance list measurement after the repair."]})}}function collectionFor(document,kind){return kind==="measurement"?document.measurements:kind==="assertion"?document.assertions:document.gates}function validateForKind(kind,definition){kind==="measurement"?validateMeasurementDefinition(definition):kind==="assertion"?validateAssertionDefinition(definition):validateGateDefinition(definition)}async function listAssuranceDeclarations(pmRoot,kind){const items=structuredClone(collectionFor(await readDocument(pmRoot),kind));return{items,count:items.length,row_contract:{row_keys:["items"],jq_selector:".items[]"}}}async function getAssuranceDeclaration(pmRoot,kind,id){const found=collectionFor(await readDocument(pmRoot),kind).find(entry=>entry.id===id);if(!found)throw new TypeError(`assurance ${kind} ${id} not found`);return structuredClone(found)}async function putAssuranceDeclaration(pmRoot,kind,definition,options={}){validateForKind(kind,definition);const settings=await readSettings(pmRoot),author=resolveAuthor(options.author,settings.author_default),mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:`assurance:${kind}:put`,author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw),collection=collectionFor(document,kind),index=collection.findIndex(entry=>entry.id===definition.id),action=index<0?"created":"updated";if(kind==="assertion"&&index>=0&&assuranceAssertionUpdateIsLoosening(collection[index],definition)){const decision=definition.authorization_decision;if(!decision||!options.authorized_decision_ids?.includes(decision))throw new AssuranceMutationRefusalError(`loosening assertion ${definition.id} requires a verified authorization_decision`)}return index<0?collection.push(structuredClone(definition)):collection[index]=structuredClone(definition),validateAssuranceDocument(document),{raw:`${JSON.stringify(document,null,2)}
+`,result:{changed:!0,action,kind,id:definition.id}}}});return{...mutation.result,changed:mutation.changed}}async function putAssuranceDeclarationBundle(pmRoot,bundle,options={}){const candidate=createEmptyAssuranceDocument();candidate.measurements=structuredClone(bundle.measurements),candidate.assertions=structuredClone(bundle.assertions),candidate.gates=structuredClone(bundle.gates),validateAssuranceDocument(candidate);const settings=await readSettings(pmRoot),author=resolveAuthor(options.author,settings.author_default),mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:"assurance:bundle:apply",author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw),createdIds=[],unchangedIds=[],apply=(target,additions,kind)=>{for(const definition of additions){const existing=target.find(entry=>entry.id===definition.id);if(!existing){target.push(structuredClone(definition)),createdIds.push(`${kind}:${definition.id}`);continue}if(stableStringify(existing)!==stableStringify(definition))throw new AssuranceMutationRefusalError(`assurance bundle refuses to replace divergent ${kind} ${definition.id}`);unchangedIds.push(`${kind}:${definition.id}`)}};return apply(document.measurements,candidate.measurements,"measurement"),apply(document.assertions,candidate.assertions,"assertion"),apply(document.gates,candidate.gates,"gate"),validateAssuranceDocument(document),{raw:`${JSON.stringify(document,null,2)}
+`,result:{changed:createdIds.length>0,created_ids:createdIds,unchanged_ids:unchangedIds}}}});return{...mutation.result,changed:mutation.changed}}async function removeAssuranceDeclaration(pmRoot,kind,id,options={}){const settings=await readSettings(pmRoot),author=resolveAuthor(options.author,settings.author_default),mutation=await mutateWorkspaceJsonWithHistory({pmRoot,filePath:assurancePath(pmRoot),op:`assurance:${kind}:remove`,author,message:options.message,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS,mutate:beforeRaw=>{const document=beforeRaw===null?createEmptyAssuranceDocument():parseAssuranceDocument(beforeRaw);if(kind==="measurement"){const consumers=collectMeasurementReferences(document).get(id);if(consumers&&consumers.length>0)throw new AssuranceMutationRefusalError(`assurance measurement ${id} is referenced by ${consumers.join(", ")}`)}if(kind==="assertion"&&document.gates.some(entry=>entry.assertion_ids.includes(id)))throw new AssuranceMutationRefusalError(`assurance assertion ${id} is referenced by gate`);const collection=collectionFor(document,kind),index=collection.findIndex(entry=>entry.id===id);if(index<0)throw new AssuranceMutationRefusalError(`assurance ${kind} ${id} not found`);return collection.splice(index,1),validateAssuranceDocument(document),{raw:`${JSON.stringify(document,null,2)}
+`,result:{changed:!0,action:"removed",kind,id}}}});return{...mutation.result,changed:mutation.changed}}async function recordAssuranceVerdict(pmRoot,verdict,options={}){if(verdict.dry_run)throw new TypeError("dry-run assurance verdicts are not persisted");const settings=await readSettings(pmRoot);await appendWorkspaceAuditEvent({pmRoot,op:"assurance:gate:verdict",author:resolveAuthor(options.author,settings.author_default),context:{assurance_verdict:verdict},message:options.message??`Assurance gate ${verdict.gate_id} returned ${verdict.verdict}`,lockTtlSeconds:LOCK_TTL_SECONDS,lockWaitMs:LOCK_WAIT_MS})}async function listAssuranceVerdicts(pmRoot,options={}){const limit=options.limit??DEFAULT_VERDICT_LIMIT;if(!Number.isInteger(limit)||limit<1||limit>MAX_ASSURANCE_VERDICT_LIMIT)throw new TypeError(`assurance verdict limit must be an integer from 1 through ${MAX_ASSURANCE_VERDICT_LIMIT}`);return(await readHistoryEntries(getWorkspaceHistoryPath(pmRoot),WORKSPACE_HISTORY_ID)).reverse().filter(entry=>entry.op==="assurance:gate:verdict").map(entry=>entry.context?.assurance_verdict).filter(value=>typeof value=="object"&&value!==null&&"gate_id"in value).filter(verdict=>options.gate_id===void 0||verdict.gate_id===options.gate_id).slice(0,limit)}export{ASSURANCE_DOCUMENT_VERSION,ASSURANCE_GATE_TRIGGERS,ASSURANCE_MEASUREMENT_SOURCE_KINDS,assuranceAssertionUpdateIsLoosening,createEmptyAssuranceDocument,evaluateAssuranceAssertion,evaluateAssuranceGate,evaluateMeasurement,getAssuranceDeclaration,listAssuranceDeclarations,listAssuranceVerdicts,putAssuranceDeclaration,putAssuranceDeclarationBundle,recordAssuranceVerdict,removeAssuranceDeclaration,validateAssertionDefinition,validateAssuranceDocument,validateGateDefinition,validateMeasurementDefinition};
 //# sourceMappingURL=assurance.js.map

package/dist/sdk/governance/boundary-fixtures.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aa6b9997-a4c6-5bfb-8804-45b34afd9e01")}catch(e2){}})();import{isRfc3339DateTime}from"../../core/shared/time.js";const BOUNDARY_FIXTURE_CAPTURE_SOURCES=["captured_redacted","captured_verbatim"];const SECRET_OR_PRIVATE_PATTERNS=[{label:"home directory",pattern:/(?:\/home\/|\/Users\/)[^/\s"']+/u},{label:"GitHub token",pattern:/\b(?:gh[oprsu]_[A-Za-z0-9_]{20,})\b/u},{label:"npm token",pattern:/\bnpm_[A-Za-z0-9]{20,}\b/u},{label:"private key",pattern:/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u}];function nonEmpty(value){return typeof value==="string"&&value.trim().length>0}function validateSample(boundary,sample){if(typeof sample!=="object"||sample===null||Array.isArray(sample)){return[{boundary_id:boundary.id,kind:"invalid_fixture",detail:`${boundary.fixture_path} must contain a JSON object.`}]}const fixture=sample;const findings=[];if(fixture.boundary_id!==boundary.id){findings.push({boundary_id:boundary.id,kind:"fixture_boundary_mismatch",detail:`${boundary.fixture_path} names ${String(fixture.boundary_id)} instead of ${boundary.id}.`})}if(fixture.version!==1||!BOUNDARY_FIXTURE_CAPTURE_SOURCES.includes(fixture.capture_source)||!nonEmpty(fixture.capture_provenance)||!Array.isArray(fixture.redactions)||!fixture.redactions.every(nonEmpty)||!("input"in fixture)||!("observed"in fixture)){findings.push({boundary_id:boundary.id,kind:"invalid_fixture",detail:`${boundary.fixture_path} lacks captured provenance, redaction metadata, input, or observed output.`})}const serialized=JSON.stringify(sample);for(const sensitive of SECRET_OR_PRIVATE_PATTERNS){if(sensitive.pattern.test(serialized)){findings.push({boundary_id:boundary.id,kind:"unsafe_fixture",detail:`${boundary.fixture_path} contains a possible ${sensitive.label}.`})}}return findings}function evaluateBoundaryWaiver(boundary,nowMs){const expiresAt=Date.parse(boundary.waiver_expires_at);const validWaiver=nonEmpty(boundary.waiver_reason)&&nonEmpty(boundary.waiver_owner)&&boundary.waiver_expires_at.endsWith("Z")&&isRfc3339DateTime(boundary.waiver_expires_at)&&Number.isFinite(expiresAt);return{captured:0,waived:validWaiver&&expiresAt>=nowMs?1:0,findings:!validWaiver?[{boundary_id:boundary.id,kind:"invalid_waiver",detail:`Boundary ${boundary.id} waiver requires reason, owner, and an RFC 3339 UTC expiry.`}]:expiresAt<nowMs?[{boundary_id:boundary.id,kind:"expired_waiver",detail:`Boundary ${boundary.id} waiver expired at ${boundary.waiver_expires_at}.`}]:[]}}function evaluateBoundaryRecord(boundary,fixtures,nowMs){if(!nonEmpty(boundary.id)||!nonEmpty(boundary.producer)||!nonEmpty(boundary.consumer)||!nonEmpty(boundary.format)){const boundaryId=nonEmpty(boundary.id)?boundary.id:"unknown";return{captured:0,waived:0,findings:[{boundary_id:boundaryId,kind:"invalid_boundary",detail:"Each boundary requires non-empty id, producer, consumer, and format."}]}}if("fixture_path"in boundary){const sample=fixtures[boundary.fixture_path];const findings=nonEmpty(boundary.fixture_path)&&boundary.fixture_path in fixtures?validateSample(boundary,sample):[{boundary_id:boundary.id,kind:"missing_fixture",detail:`Boundary ${boundary.id} fixture ${String(boundary.fixture_path)} is missing.`}];return{captured:findings.length===0?1:0,waived:0,findings}}return evaluateBoundaryWaiver(boundary,nowMs)}function evaluateBoundaryFixtures(registry,fixtures,now=new Date){const findings=[];if(registry.version!==1||!nonEmpty(registry.inventory_scope)||!Array.isArray(registry.boundaries)){return{ok:false,boundary_count:0,captured_count:0,waived_count:0,findings:[{boundary_id:"registry",kind:"invalid_registry",detail:"Boundary registry requires version 1, inventory_scope, and boundaries."}]}}const ids=new Set;let capturedCount=0;let waivedCount=0;for(const candidate of registry.boundaries){if(typeof candidate!=="object"||candidate===null||Array.isArray(candidate)){findings.push({boundary_id:"unknown",kind:"invalid_boundary",detail:"Each boundary must be a JSON object."});continue}const boundary=candidate;const boundaryId=nonEmpty(boundary.id)?boundary.id:void 0;if(boundaryId!==void 0&&ids.has(boundaryId)){findings.push({boundary_id:boundaryId,kind:"duplicate_boundary",detail:`Boundary ${boundaryId} is inventoried more than once.`});continue}if(boundaryId!==void 0)ids.add(boundaryId);const evaluated=evaluateBoundaryRecord(boundary,fixtures,now.getTime());capturedCount+=evaluated.captured;waivedCount+=evaluated.waived;findings.push(...evaluated.findings)}findings.sort((left,right)=>left.boundary_id!==right.boundary_id?left.boundary_id.localeCompare(right.boundary_id):left.kind.localeCompare(right.kind));return{ok:findings.length===0,boundary_count:registry.boundaries.length,captured_count:capturedCount,waived_count:waivedCount,findings}}export{BOUNDARY_FIXTURE_CAPTURE_SOURCES,evaluateBoundaryFixtures};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7e55d416-9cc3-51c5-8e56-6b5fd5c836a9")}catch{}})();import{isRfc3339DateTime}from"../../core/shared/time.js";const BOUNDARY_FIXTURE_CAPTURE_SOURCES=["captured_redacted","captured_verbatim"],SECRET_OR_PRIVATE_PATTERNS=[{label:"home directory",pattern:/(?:\/home\/|\/Users\/)[^/\s"']+/u},{label:"GitHub token",pattern:/\b(?:gh[oprsu]_[A-Za-z0-9_]{20,})\b/u},{label:"npm token",pattern:/\bnpm_[A-Za-z0-9]{20,}\b/u},{label:"private key",pattern:/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u}];function nonEmpty(value){return typeof value=="string"&&value.trim().length>0}function validateSample(boundary,sample){if(typeof sample!="object"||sample===null||Array.isArray(sample))return[{boundary_id:boundary.id,kind:"invalid_fixture",detail:`${boundary.fixture_path} must contain a JSON object.`}];const fixture=sample,findings=[];fixture.boundary_id!==boundary.id&&findings.push({boundary_id:boundary.id,kind:"fixture_boundary_mismatch",detail:`${boundary.fixture_path} names ${String(fixture.boundary_id)} instead of ${boundary.id}.`}),(fixture.version!==1||!BOUNDARY_FIXTURE_CAPTURE_SOURCES.includes(fixture.capture_source)||!nonEmpty(fixture.capture_provenance)||!Array.isArray(fixture.redactions)||!fixture.redactions.every(nonEmpty)||!("input"in fixture)||!("observed"in fixture))&&findings.push({boundary_id:boundary.id,kind:"invalid_fixture",detail:`${boundary.fixture_path} lacks captured provenance, redaction metadata, input, or observed output.`});const serialized=JSON.stringify(sample);for(const sensitive of SECRET_OR_PRIVATE_PATTERNS)sensitive.pattern.test(serialized)&&findings.push({boundary_id:boundary.id,kind:"unsafe_fixture",detail:`${boundary.fixture_path} contains a possible ${sensitive.label}.`});return findings}function evaluateBoundaryWaiver(boundary,nowMs){const expiresAt=Date.parse(boundary.waiver_expires_at),validWaiver=nonEmpty(boundary.waiver_reason)&&nonEmpty(boundary.waiver_owner)&&boundary.waiver_expires_at.endsWith("Z")&&isRfc3339DateTime(boundary.waiver_expires_at)&&Number.isFinite(expiresAt);return{captured:0,waived:validWaiver&&expiresAt>=nowMs?1:0,findings:validWaiver?expiresAt<nowMs?[{boundary_id:boundary.id,kind:"expired_waiver",detail:`Boundary ${boundary.id} waiver expired at ${boundary.waiver_expires_at}.`}]:[]:[{boundary_id:boundary.id,kind:"invalid_waiver",detail:`Boundary ${boundary.id} waiver requires reason, owner, and an RFC 3339 UTC expiry.`}]}}function evaluateBoundaryRecord(boundary,fixtures,nowMs){if(!nonEmpty(boundary.id)||!nonEmpty(boundary.producer)||!nonEmpty(boundary.consumer)||!nonEmpty(boundary.format))return{captured:0,waived:0,findings:[{boundary_id:nonEmpty(boundary.id)?boundary.id:"unknown",kind:"invalid_boundary",detail:"Each boundary requires non-empty id, producer, consumer, and format."}]};if("fixture_path"in boundary){const sample=fixtures[boundary.fixture_path],findings=nonEmpty(boundary.fixture_path)&&boundary.fixture_path in fixtures?validateSample(boundary,sample):[{boundary_id:boundary.id,kind:"missing_fixture",detail:`Boundary ${boundary.id} fixture ${String(boundary.fixture_path)} is missing.`}];return{captured:findings.length===0?1:0,waived:0,findings}}return evaluateBoundaryWaiver(boundary,nowMs)}function evaluateBoundaryFixtures(registry,fixtures,now=new Date){const findings=[];if(registry.version!==1||!nonEmpty(registry.inventory_scope)||!Array.isArray(registry.boundaries))return{ok:!1,boundary_count:0,captured_count:0,waived_count:0,findings:[{boundary_id:"registry",kind:"invalid_registry",detail:"Boundary registry requires version 1, inventory_scope, and boundaries."}]};const ids=new Set;let capturedCount=0,waivedCount=0;for(const candidate of registry.boundaries){if(typeof candidate!="object"||candidate===null||Array.isArray(candidate)){findings.push({boundary_id:"unknown",kind:"invalid_boundary",detail:"Each boundary must be a JSON object."});continue}const boundary=candidate,boundaryId=nonEmpty(boundary.id)?boundary.id:void 0;if(boundaryId!==void 0&&ids.has(boundaryId)){findings.push({boundary_id:boundaryId,kind:"duplicate_boundary",detail:`Boundary ${boundaryId} is inventoried more than once.`});continue}boundaryId!==void 0&&ids.add(boundaryId);const evaluated=evaluateBoundaryRecord(boundary,fixtures,now.getTime());capturedCount+=evaluated.captured,waivedCount+=evaluated.waived,findings.push(...evaluated.findings)}return findings.sort((left,right)=>left.boundary_id!==right.boundary_id?left.boundary_id.localeCompare(right.boundary_id):left.kind.localeCompare(right.kind)),{ok:findings.length===0,boundary_count:registry.boundaries.length,captured_count:capturedCount,waived_count:waivedCount,findings}}export{BOUNDARY_FIXTURE_CAPTURE_SOURCES,evaluateBoundaryFixtures};
 //# sourceMappingURL=boundary-fixtures.js.map

package/dist/sdk/governance/closure-timestamps.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1e1d8d86-3f4e-50eb-ae73-ca7c030f7c0a")}catch(e2){}})();import{applyHistoryPatch,readHistoryEntries,verifyHistoryEntries}from"../history-read.js";import{cloneEmptyReplayDocument}from"../../core/history/replay.js";import{resolveRuntimeStatusRegistry}from"../../core/schema/runtime-schema.js";import{resolveAuthor}from"../../core/shared/author.js";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{isMillisecondPrecisionRfc3339DateTime}from"../../core/shared/time.js";import{mutateItem}from"../../core/store/item-store.js";import{getHistoryPath,resolvePmRoot}from"../../core/store/paths.js";import{readSettings}from"../../core/store/settings.js";function deriveClosureTimestamp(history,document,terminalStatuses){if(!terminalStatuses.has(document.metadata.status))return{reason:"not_terminal"};if(history.length===0)return{reason:"missing_history"};if(!verifyHistoryEntries(history,document).ok)return{reason:"unverified_history"};let replay=cloneEmptyReplayDocument();let evidence={reason:"no_proven_transition"};for(const[index,entry]of history.entries()){const wasTerminal=terminalStatuses.has(String(replay.metadata.status));replay=applyHistoryPatch(replay,entry.patch,index+1,entry.op);const isTerminal=terminalStatuses.has(String(replay.metadata.status));if(!isTerminal)evidence={reason:"no_proven_transition"};else if(!wasTerminal){evidence=["create","close","cancel","update","update_audit"].includes(entry.op)&&isMillisecondPrecisionRfc3339DateTime(entry.ts)?{timestamp:entry.ts,source_index:index+1}:{reason:"no_proven_transition"}}}return evidence}function closureTerminalStatuses(registry){return new Set([...registry.terminal_statuses,...[...registry.alias_to_id].filter(([,id])=>registry.terminal_statuses.has(id)).map(([alias])=>alias)])}async function scanClosureTimestamps(pmRoot,items,registry,inspectHistory,limit){const terminalStatuses=closureTerminalStatuses(registry);const missing=items.filter(item=>terminalStatuses.has(item.status)&&!item.closed_at);const fixes=[];const residual=[];for(const item of inspectHistory?missing:[]){let evidence;try{const history=await readHistoryEntries(getHistoryPath(pmRoot,item.id),item.id);const{body,...metadata}=item;evidence=deriveClosureTimestamp(history,{metadata,body},terminalStatuses)}catch{residual.push({id:item.id,reason:"unreadable_history"});continue}if("reason"in evidence){residual.push({id:item.id,reason:evidence.reason});continue}fixes.push({item_id:item.id,check:"metadata",field:"closed_at",kind:"set_closed_at",value:evidence.timestamp,gate:"timestamps",command:"pm validate --check-metadata --auto-fix --fix-scope timestamps"})}return{details:{missing_closed_at_count:missing.length,missing_closed_at_item_ids:missing.slice(0,limit).map(item=>item.id),missing_closed_at_item_ids_truncated:missing.length>limit,closure_history_inspected:inspectHistory,closure_timestamp_derivable_count:fixes.length,closure_timestamp_residual_count:residual.length,closure_timestamp_residual:residual.slice(0,limit),closure_timestamp_residual_truncated:residual.length>limit,...missing.length>0?{closure_timestamp_fix_hint:"pm validate --check-metadata --auto-fix --fix-scope timestamps --dry-run"}:{}},fixes,warnings:missing.length>0?[`validate_metadata_missing_closed_at:${missing.length}`]:[]}}async function applyClosureTimestampFix(fix,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path);const settings=await readSettings(pmRoot);const registry=resolveRuntimeStatusRegistry(settings.schema);await mutateItem({pmRoot,settings,id:fix.item_id,op:"update",author:resolveAuthor(global2.author,settings.author_default),message:"Backfill closed_at from verified lifecycle history",skipNoop:true,async mutate(document){if(document.metadata.closed_at)return{changedFields:[]};const history=await readHistoryEntries(getHistoryPath(pmRoot,document.metadata.id),document.metadata.id);const terminalStatuses=closureTerminalStatuses(registry);const evidence=deriveClosureTimestamp(history,document,terminalStatuses);if(!("timestamp"in evidence)||evidence.timestamp!==fix.value){throw new PmCliError("Closure timestamp evidence changed or cannot be verified; rerun the timestamp repair preview.",EXIT_CODE.GENERIC_FAILURE)}document.metadata.closed_at=evidence.timestamp;return{changedFields:["closed_at"]}}})}export{applyClosureTimestampFix,deriveClosureTimestamp,scanClosureTimestamps};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a07d2f98-7c1d-5d0a-be70-5181ed0f7b4f")}catch{}})();import{applyHistoryPatch,readHistoryEntries,verifyHistoryEntries}from"../history-read.js";import{cloneEmptyReplayDocument}from"../../core/history/replay.js";import{resolveRuntimeStatusRegistry}from"../../core/schema/runtime-schema.js";import{resolveAuthor}from"../../core/shared/author.js";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{isMillisecondPrecisionRfc3339DateTime}from"../../core/shared/time.js";import{mutateItem}from"../../core/store/item-store.js";import{getHistoryPath,resolvePmRoot}from"../../core/store/paths.js";import{readSettings}from"../../core/store/settings.js";function deriveClosureTimestamp(history,document,terminalStatuses){if(!terminalStatuses.has(document.metadata.status))return{reason:"not_terminal"};if(history.length===0)return{reason:"missing_history"};if(!verifyHistoryEntries(history,document).ok)return{reason:"unverified_history"};let replay=cloneEmptyReplayDocument(),evidence={reason:"no_proven_transition"};for(const[index,entry]of history.entries()){const wasTerminal=terminalStatuses.has(String(replay.metadata.status));replay=applyHistoryPatch(replay,entry.patch,index+1,entry.op),terminalStatuses.has(String(replay.metadata.status))?wasTerminal||(evidence=["create","close","cancel","update","update_audit"].includes(entry.op)&&isMillisecondPrecisionRfc3339DateTime(entry.ts)?{timestamp:entry.ts,source_index:index+1}:{reason:"no_proven_transition"}):evidence={reason:"no_proven_transition"}}return evidence}function closureTerminalStatuses(registry){return new Set([...registry.terminal_statuses,...[...registry.alias_to_id].filter(([,id])=>registry.terminal_statuses.has(id)).map(([alias])=>alias)])}async function scanClosureTimestamps(pmRoot,items,registry,inspectHistory,limit){const terminalStatuses=closureTerminalStatuses(registry),missing=items.filter(item=>terminalStatuses.has(item.status)&&!item.closed_at),fixes=[],residual=[];for(const item of inspectHistory?missing:[]){let evidence;try{const history=await readHistoryEntries(getHistoryPath(pmRoot,item.id),item.id),{body,...metadata}=item;evidence=deriveClosureTimestamp(history,{metadata,body},terminalStatuses)}catch{residual.push({id:item.id,reason:"unreadable_history"});continue}if("reason"in evidence){residual.push({id:item.id,reason:evidence.reason});continue}fixes.push({item_id:item.id,check:"metadata",field:"closed_at",kind:"set_closed_at",value:evidence.timestamp,gate:"timestamps",command:"pm validate --check-metadata --auto-fix --fix-scope timestamps"})}return{details:{missing_closed_at_count:missing.length,missing_closed_at_item_ids:missing.slice(0,limit).map(item=>item.id),missing_closed_at_item_ids_truncated:missing.length>limit,closure_history_inspected:inspectHistory,closure_timestamp_derivable_count:fixes.length,closure_timestamp_residual_count:residual.length,closure_timestamp_residual:residual.slice(0,limit),closure_timestamp_residual_truncated:residual.length>limit,...missing.length>0?{closure_timestamp_fix_hint:"pm validate --check-metadata --auto-fix --fix-scope timestamps --dry-run"}:{}},fixes,warnings:missing.length>0?[`validate_metadata_missing_closed_at:${missing.length}`]:[]}}async function applyClosureTimestampFix(fix,global2){const pmRoot=resolvePmRoot(process.cwd(),global2.path),settings=await readSettings(pmRoot),registry=resolveRuntimeStatusRegistry(settings.schema);await mutateItem({pmRoot,settings,id:fix.item_id,op:"update",author:resolveAuthor(global2.author,settings.author_default),message:"Backfill closed_at from verified lifecycle history",skipNoop:!0,async mutate(document){if(document.metadata.closed_at)return{changedFields:[]};const history=await readHistoryEntries(getHistoryPath(pmRoot,document.metadata.id),document.metadata.id),terminalStatuses=closureTerminalStatuses(registry),evidence=deriveClosureTimestamp(history,document,terminalStatuses);if(!("timestamp"in evidence)||evidence.timestamp!==fix.value)throw new PmCliError("Closure timestamp evidence changed or cannot be verified; rerun the timestamp repair preview.",EXIT_CODE.GENERIC_FAILURE);return document.metadata.closed_at=evidence.timestamp,{changedFields:["closed_at"]}}})}export{applyClosureTimestampFix,deriveClosureTimestamp,scanClosureTimestamps};
 //# sourceMappingURL=closure-timestamps.js.map

package/dist/sdk/governance/coverage-assurance.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b84b220f-cad0-5861-b3ed-07453179706e")}catch(e2){}})();const PM_EXACT_COVERAGE_METRICS=["lines","branches","functions","statements"];function assertCoverageEntry(file,entry){if(typeof entry!=="object"||entry===null||Array.isArray(entry)){throw new TypeError(`Coverage entry for ${file} must be an object.`)}}function coverageCounts(file,metric,value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError(`Coverage entry ${file} has invalid ${metric} counts.`)}const counts=value;if(typeof counts.covered!=="number"||typeof counts.total!=="number"||!Number.isInteger(counts.covered)||!Number.isInteger(counts.total)||counts.covered<0||counts.total<counts.covered){throw new TypeError(`Coverage entry ${file} has invalid ${metric} counts.`)}return{covered:counts.covered,total:counts.total}}function findCoverageDeficits(summary){if(typeof summary!=="object"||summary===null||Array.isArray(summary)){throw new TypeError("Coverage summary must be a JSON object.")}if(!("total"in summary)){throw new TypeError("Coverage summary is missing the total entry.")}const deficits=[];for(const[file,entry]of Object.entries(summary)){assertCoverageEntry(file,entry);for(const metric of PM_EXACT_COVERAGE_METRICS){const counts=coverageCounts(file,metric,entry[metric]);const uncovered=counts.total-counts.covered;if(uncovered>0){deficits.push({file,metric,uncovered,...counts})}}}return deficits}export{PM_EXACT_COVERAGE_METRICS,findCoverageDeficits};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c1cb8d82-20a6-5460-a0ff-f55312911218")}catch{}})();const PM_EXACT_COVERAGE_METRICS=["lines","branches","functions","statements"];function assertCoverageEntry(file,entry){if(typeof entry!="object"||entry===null||Array.isArray(entry))throw new TypeError(`Coverage entry for ${file} must be an object.`)}function coverageCounts(file,metric,value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError(`Coverage entry ${file} has invalid ${metric} counts.`);const counts=value;if(typeof counts.covered!="number"||typeof counts.total!="number"||!Number.isInteger(counts.covered)||!Number.isInteger(counts.total)||counts.covered<0||counts.total<counts.covered)throw new TypeError(`Coverage entry ${file} has invalid ${metric} counts.`);return{covered:counts.covered,total:counts.total}}function findCoverageDeficits(summary){if(typeof summary!="object"||summary===null||Array.isArray(summary))throw new TypeError("Coverage summary must be a JSON object.");if(!("total"in summary))throw new TypeError("Coverage summary is missing the total entry.");const deficits=[];for(const[file,entry]of Object.entries(summary)){assertCoverageEntry(file,entry);for(const metric of PM_EXACT_COVERAGE_METRICS){const counts=coverageCounts(file,metric,entry[metric]),uncovered=counts.total-counts.covered;uncovered>0&&deficits.push({file,metric,uncovered,...counts})}}return deficits}export{PM_EXACT_COVERAGE_METRICS,findCoverageDeficits};
 //# sourceMappingURL=coverage-assurance.js.map

package/dist/sdk/governance/defect-recurrence-coverage.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="538168d9-116c-5e72-81a4-a23e021c48f5")}catch(e2){}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{DEFECT_ESCAPE_CLASSES,parseDefectRecurrencePolicy,parseDefectChangeRiskRequest}from"./defect-recurrence.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";function parseDefectRecurrenceCoverageRequest(value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("recurrence coverage request must be an object")}const input=value;if(Object.hasOwn(input,"change")){throw new TypeError("recurrence coverage request does not accept change")}if(input.uncoveredOnly!==void 0&&typeof input.uncoveredOnly!=="boolean"){throw new TypeError("recurrence coverage request.uncoveredOnly must be a boolean")}const{policy,cursor,limit}=parseDefectChangeRiskRequest({...input,change:{}});return{policy,...cursor===void 0?{}:{cursor},...limit===void 0?{}:{limit},...input.uncoveredOnly===void 0?{}:{uncoveredOnly:input.uncoveredOnly}}}function coverageOffset(cursor,fingerprint){if(cursor===void 0)return 0;let value;try{value=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("recurrence coverage cursor is invalid")}if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("recurrence coverage cursor is invalid")}const record=value;if(record.fingerprint!==fingerprint||typeof record.offset!=="number"||!Number.isSafeInteger(record.offset)||record.offset<0){throw new TypeError("recurrence coverage cursor does not match this evidence and filter")}return record.offset}function summarizeCoverage(graph,records,knownIds,ids,identity,uncoveredOnly){const classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(key=>[key,0]));let coveredCount=0;let uncoveredCount=0;let missingCount=0;let classifiedCount=0;const selected=[];const hash=createHash("sha256").update(identity);for(const id of ids){const lineage=graph.membership.get(id);const present=knownIds.has(id);const covered=lineage.family_ids.length>0;if(covered&&present)coveredCount+=1;if(!covered)uncoveredCount+=1;if(!present)missingCount+=1;const classification=records.get(id)?.escape_class;if(classification!==void 0&&DEFECT_ESCAPE_CLASSES.includes(classification)){classCounts[classification]+=1;classifiedCount+=1}hash.update(stableStringify([id,present,records.get(id)??null,lineage.id,lineage.family_ids]));if(!uncoveredOnly||!covered||!present)selected.push(id)}return{classCounts,coveredCount,uncoveredCount,missingCount,classifiedCount,selected,fingerprint:hash.digest("hex")}}function analyzeDefectRecurrenceCoverage(policy,items,options={}){parseDefectRecurrencePolicy(policy);const limit=options.limit??25;if(!Number.isSafeInteger(limit)||limit<1||limit>100){throw new TypeError("recurrence coverage limit must be an integer from 1 through 100")}const knownIds=new Set;const records=new Map;for(const item of items){if(knownIds.has(item.id))throw new TypeError(`Duplicate recurrence item ${item.id}`);knownIds.add(item.id);const record=readDefectRecurrenceRecord(item);if(record!==void 0)records.set(item.id,record)}const graph=buildDefectRecurrenceGraph(policy.families,records);const ids=[...graph.membership.keys()].sort();const identity=stableStringify({policy,uncoveredOnly:options.uncoveredOnly===true});const{classCounts,coveredCount,uncoveredCount,missingCount,classifiedCount,selected,fingerprint}=summarizeCoverage(graph,records,knownIds,ids,identity,options.uncoveredOnly===true);const offset=coverageOffset(options.cursor,fingerprint);if(offset>selected.length)throw new TypeError("recurrence coverage cursor offset exceeds the selected population");const page=selected.slice(offset,offset+limit).map(id=>{const lineage=graph.membership.get(id);const present=knownIds.has(id);return{item_id:id,lineage_id:lineage.id,lineage_item_count:lineage.item_ids.length,family_ids:lineage.family_ids,present,...!present?{finding:"missing_recurrence_item"}:lineage.family_ids.length===0?{finding:"unregistered_recurrence_item"}:{}}});const nextOffset=offset+page.length;const lowerBound=ids.length===0?null:classCounts.production_defect/ids.length;return{ok:uncoveredCount===0&&missingCount===0,fingerprint,items:page,total:selected.length,has_more:nextOffset<selected.length,...nextOffset<selected.length?{next_cursor:Buffer.from(JSON.stringify({fingerprint,offset:nextOffset})).toString("base64url")}:{},population:{scope:"all_recorded_recurrence_items",item_count:ids.length,lineage_count:graph.lineages.length,edge_count:graph.edge_count,covered_item_count:coveredCount,uncovered_item_count:uncoveredCount,missing_item_count:missingCount,classified_item_count:classifiedCount,unclassified_item_count:ids.length-classifiedCount,class_counts:classCounts,escape_rate:classifiedCount===ids.length?lowerBound:null,escape_rate_lower_bound:lowerBound},budget_scope:"registered_families_only",cost:{items_scanned:items.length,edges_scanned:graph.edge_count,row_limit:limit},row_contract:{row_keys:["items"],jq_selector:".items[]"}}}export{analyzeDefectRecurrenceCoverage,parseDefectRecurrenceCoverageRequest};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c72d246d-a7ff-5c9d-8c36-4ebd45b8a69f")}catch{}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{DEFECT_ESCAPE_CLASSES,parseDefectRecurrencePolicy,parseDefectChangeRiskRequest}from"./defect-recurrence.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";function parseDefectRecurrenceCoverageRequest(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("recurrence coverage request must be an object");const input=value;if(Object.hasOwn(input,"change"))throw new TypeError("recurrence coverage request does not accept change");if(input.uncoveredOnly!==void 0&&typeof input.uncoveredOnly!="boolean")throw new TypeError("recurrence coverage request.uncoveredOnly must be a boolean");const{policy,cursor,limit}=parseDefectChangeRiskRequest({...input,change:{}});return{policy,...cursor===void 0?{}:{cursor},...limit===void 0?{}:{limit},...input.uncoveredOnly===void 0?{}:{uncoveredOnly:input.uncoveredOnly}}}function coverageOffset(cursor,fingerprint){if(cursor===void 0)return 0;let value;try{value=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("recurrence coverage cursor is invalid")}if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("recurrence coverage cursor is invalid");const record=value;if(record.fingerprint!==fingerprint||typeof record.offset!="number"||!Number.isSafeInteger(record.offset)||record.offset<0)throw new TypeError("recurrence coverage cursor does not match this evidence and filter");return record.offset}function summarizeCoverage(graph,records,knownIds,ids,identity,uncoveredOnly){const classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(key=>[key,0]));let coveredCount=0,uncoveredCount=0,missingCount=0,classifiedCount=0;const selected=[],hash=createHash("sha256").update(identity);for(const id of ids){const lineage=graph.membership.get(id),present=knownIds.has(id),covered=lineage.family_ids.length>0;covered&&present&&(coveredCount+=1),covered||(uncoveredCount+=1),present||(missingCount+=1);const classification=records.get(id)?.escape_class;classification!==void 0&&DEFECT_ESCAPE_CLASSES.includes(classification)&&(classCounts[classification]+=1,classifiedCount+=1),hash.update(stableStringify([id,present,records.get(id)??null,lineage.id,lineage.family_ids])),(!uncoveredOnly||!covered||!present)&&selected.push(id)}return{classCounts,coveredCount,uncoveredCount,missingCount,classifiedCount,selected,fingerprint:hash.digest("hex")}}function analyzeDefectRecurrenceCoverage(policy,items,options={}){parseDefectRecurrencePolicy(policy);const limit=options.limit??25;if(!Number.isSafeInteger(limit)||limit<1||limit>100)throw new TypeError("recurrence coverage limit must be an integer from 1 through 100");const knownIds=new Set,records=new Map;for(const item of items){if(knownIds.has(item.id))throw new TypeError(`Duplicate recurrence item ${item.id}`);knownIds.add(item.id);const record=readDefectRecurrenceRecord(item);record!==void 0&&records.set(item.id,record)}const graph=buildDefectRecurrenceGraph(policy.families,records),ids=[...graph.membership.keys()].sort(),identity=stableStringify({policy,uncoveredOnly:options.uncoveredOnly===!0}),{classCounts,coveredCount,uncoveredCount,missingCount,classifiedCount,selected,fingerprint}=summarizeCoverage(graph,records,knownIds,ids,identity,options.uncoveredOnly===!0),offset=coverageOffset(options.cursor,fingerprint);if(offset>selected.length)throw new TypeError("recurrence coverage cursor offset exceeds the selected population");const page=selected.slice(offset,offset+limit).map(id=>{const lineage=graph.membership.get(id),present=knownIds.has(id);return{item_id:id,lineage_id:lineage.id,lineage_item_count:lineage.item_ids.length,family_ids:lineage.family_ids,present,...present?lineage.family_ids.length===0?{finding:"unregistered_recurrence_item"}:{}:{finding:"missing_recurrence_item"}}}),nextOffset=offset+page.length,lowerBound=ids.length===0?null:classCounts.production_defect/ids.length;return{ok:uncoveredCount===0&&missingCount===0,fingerprint,items:page,total:selected.length,has_more:nextOffset<selected.length,...nextOffset<selected.length?{next_cursor:Buffer.from(JSON.stringify({fingerprint,offset:nextOffset})).toString("base64url")}:{},population:{scope:"all_recorded_recurrence_items",item_count:ids.length,lineage_count:graph.lineages.length,edge_count:graph.edge_count,covered_item_count:coveredCount,uncovered_item_count:uncoveredCount,missing_item_count:missingCount,classified_item_count:classifiedCount,unclassified_item_count:ids.length-classifiedCount,class_counts:classCounts,escape_rate:classifiedCount===ids.length?lowerBound:null,escape_rate_lower_bound:lowerBound},budget_scope:"registered_families_only",cost:{items_scanned:items.length,edges_scanned:graph.edge_count,row_limit:limit},row_contract:{row_keys:["items"],jq_selector:".items[]"}}}export{analyzeDefectRecurrenceCoverage,parseDefectRecurrenceCoverageRequest};
 //# sourceMappingURL=defect-recurrence-coverage.js.map

package/dist/sdk/governance/defect-recurrence-graph.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8d87a4e8-5853-52ca-8fdf-1433e2a9e75d")}catch(e2){}})();import{isExternalDependencyReference,isExternalDependencySourceKind}from"../../core/item/dependency-reference.js";function recurrenceTargets(item){const targets=new Set;for(const edge of Array.isArray(item.dependencies)?item.dependencies:[]){if(typeof edge!=="object"||edge===null||Array.isArray(edge))continue;if(edge.kind!=="recurs_from")continue;if(typeof edge.id!=="string"||!edge.id.trim())continue;if(isExternalDependencyReference(edge.id)||isExternalDependencySourceKind(typeof edge.source_kind==="string"?edge.source_kind:void 0))continue;targets.add(edge.id.trim())}return[...targets].sort()}function recurrenceFiles(item){const files=new Set;for(const file of Array.isArray(item.files)?item.files:[]){if(typeof file!=="object"||file===null||Array.isArray(file))continue;const entry=file;if(entry.scope!==void 0&&entry.scope!=="project")continue;if(typeof entry.path==="string"&&entry.path.trim())files.add(entry.path.trim())}return[...files].sort()}function readDefectRecurrenceRecord(item){const targets=recurrenceTargets(item);const files=recurrenceFiles(item);const escapeClass=typeof item.escape_class==="string"?item.escape_class:void 0;if(targets.length===0&&files.length===0&&escapeClass===void 0)return void 0;return{targets,files,...escapeClass===void 0?{}:{escape_class:escapeClass}}}function traverseLineage(start,adjacency,seeds,membership){const lineage={id:start,item_ids:[],family_ids:[]};const pending=[start];const familyIds=new Set;membership.set(start,lineage);while(pending.length>0){const id=pending.pop();lineage.item_ids.push(id);for(const familyId of seeds.get(id)??[])familyIds.add(familyId);for(const target of adjacency.get(id)){if(membership.has(target))continue;membership.set(target,lineage);pending.push(target)}}lineage.item_ids.sort();lineage.id=lineage.item_ids[0];lineage.family_ids=[...familyIds].sort();return lineage}function buildDefectRecurrenceGraph(families,records){const adjacency=new Map;let edgeCount=0;for(const[id,record]of records){for(const target of new Set(record.targets)){const outgoing=adjacency.get(id)??new Set;outgoing.add(target);adjacency.set(id,outgoing);const incoming=adjacency.get(target)??new Set;incoming.add(id);adjacency.set(target,incoming);edgeCount+=1}}const seeds=new Map;for(const family of families){for(const id of[family.owner_item_id,...family.historical_item_ids,...family.triggers.item_ids??[]]){const ids=seeds.get(id)??new Set;ids.add(family.id);seeds.set(id,ids)}}const membership=new Map;const lineages=[];for(const start of adjacency.keys()){if(membership.has(start))continue;lineages.push(traverseLineage(start,adjacency,seeds,membership))}lineages.sort((left,right)=>left.id<right.id?-1:1);return{lineages,membership,edge_count:edgeCount}}export{buildDefectRecurrenceGraph,readDefectRecurrenceRecord};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7109e3f6-d34c-55d5-8cd8-5d797461495f")}catch{}})();import{isExternalDependencyReference,isExternalDependencySourceKind}from"../../core/item/dependency-reference.js";function recurrenceTargets(item){const targets=new Set;for(const edge of Array.isArray(item.dependencies)?item.dependencies:[])typeof edge!="object"||edge===null||Array.isArray(edge)||edge.kind==="recurs_from"&&(typeof edge.id!="string"||!edge.id.trim()||isExternalDependencyReference(edge.id)||isExternalDependencySourceKind(typeof edge.source_kind=="string"?edge.source_kind:void 0)||targets.add(edge.id.trim()));return[...targets].sort()}function recurrenceFiles(item){const files=new Set;for(const file of Array.isArray(item.files)?item.files:[]){if(typeof file!="object"||file===null||Array.isArray(file))continue;const entry=file;entry.scope!==void 0&&entry.scope!=="project"||typeof entry.path=="string"&&entry.path.trim()&&files.add(entry.path.trim())}return[...files].sort()}function readDefectRecurrenceRecord(item){const targets=recurrenceTargets(item),files=recurrenceFiles(item),escapeClass=typeof item.escape_class=="string"?item.escape_class:void 0;if(!(targets.length===0&&files.length===0&&escapeClass===void 0))return{targets,files,...escapeClass===void 0?{}:{escape_class:escapeClass}}}function traverseLineage(start,adjacency,seeds,membership){const lineage={id:start,item_ids:[],family_ids:[]},pending=[start],familyIds=new Set;for(membership.set(start,lineage);pending.length>0;){const id=pending.pop();lineage.item_ids.push(id);for(const familyId of seeds.get(id)??[])familyIds.add(familyId);for(const target of adjacency.get(id))membership.has(target)||(membership.set(target,lineage),pending.push(target))}return lineage.item_ids.sort(),lineage.id=lineage.item_ids[0],lineage.family_ids=[...familyIds].sort(),lineage}function buildDefectRecurrenceGraph(families,records){const adjacency=new Map;let edgeCount=0;for(const[id,record]of records)for(const target of new Set(record.targets)){const outgoing=adjacency.get(id)??new Set;outgoing.add(target),adjacency.set(id,outgoing);const incoming=adjacency.get(target)??new Set;incoming.add(id),adjacency.set(target,incoming),edgeCount+=1}const seeds=new Map;for(const family of families)for(const id of[family.owner_item_id,...family.historical_item_ids,...family.triggers.item_ids??[]]){const ids=seeds.get(id)??new Set;ids.add(family.id),seeds.set(id,ids)}const membership=new Map,lineages=[];for(const start of adjacency.keys())membership.has(start)||lineages.push(traverseLineage(start,adjacency,seeds,membership));return lineages.sort((left,right)=>left.id<right.id?-1:1),{lineages,membership,edge_count:edgeCount}}export{buildDefectRecurrenceGraph,readDefectRecurrenceRecord};
 //# sourceMappingURL=defect-recurrence-graph.js.map

package/dist/sdk/governance/defect-recurrence-signals.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a14011f9-67eb-5cd6-b520-8e938ada4f1b")}catch(e2){}})();function defectRecurrenceItemSignals(item){return{files:(Array.isArray(item.files)?item.files:[]).flatMap(entry=>{if(typeof entry!=="object"||entry===null||Array.isArray(entry))return[];const value=entry.path;return typeof value==="string"?[value]:[]}),package_names:Array.isArray(item.package_names)?item.package_names.filter(value=>typeof value==="string"):[],item_ids:[item.id],tags:Array.isArray(item.tags)?item.tags.filter(value=>typeof value==="string"):[],error_codes:Array.isArray(item.error_codes)?item.error_codes.filter(value=>typeof value==="string"):[]}}export{defectRecurrenceItemSignals};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b0f9eca2-3f4f-5809-9c8f-0e596a95dba1")}catch{}})();function defectRecurrenceItemSignals(item){return{files:(Array.isArray(item.files)?item.files:[]).flatMap(entry=>{if(typeof entry!="object"||entry===null||Array.isArray(entry))return[];const value=entry.path;return typeof value=="string"?[value]:[]}),package_names:Array.isArray(item.package_names)?item.package_names.filter(value=>typeof value=="string"):[],item_ids:[item.id],tags:Array.isArray(item.tags)?item.tags.filter(value=>typeof value=="string"):[],error_codes:Array.isArray(item.error_codes)?item.error_codes.filter(value=>typeof value=="string"):[]}}export{defectRecurrenceItemSignals};
 //# sourceMappingURL=defect-recurrence-signals.js.map

package/dist/sdk/governance/defect-recurrence.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12a0ee7f-508d-5e6e-b59d-24bc0aba22aa")}catch(e2){}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{defectRecurrenceItemSignals}from"./defect-recurrence-signals.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";const DEFECT_ESCAPE_CLASSES=["production_defect","nightly_regression","scanner_finding","review_caught_late"];const DEFECT_GATE_EVIDENCE_DISPOSITIONS=["gate_added","gate_strengthened","explicit_waiver"];const MAX_FILE_PATTERN_LENGTH=256;const MAX_COMPILED_PATH_PATTERNS=1024;const compiledPathPatterns=new Map;const CHANGE_INPUT_FIELDS=["files","package_names","item_ids","tags","error_codes"];function uniqueSorted(values){return[...new Set(values.map(value=>value.trim()).filter(Boolean))].sort((left,right)=>left<right?-1:1)}function fingerprint(value){return createHash("sha256").update(stableStringify(value)).digest("hex")}function assertNonEmpty(value,field){if(typeof value!=="string"||!value.trim()){throw new TypeError(`${field} must be a non-empty string`)}}function isRecord(value){return typeof value==="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(entry=>typeof entry==="string")}function assertChangeInput(value,field){if(!isRecord(value))throw new TypeError(`${field} must be an object`);for(const key of CHANGE_INPUT_FIELDS){if(value[key]!==void 0&&!isStringArray(value[key])){throw new TypeError(`${field}.${key} must be an array of strings`)}}return value}function assertTriggers(value,familyId){if(!isRecord(value)){throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`)}for(const key of["package_names","item_ids","tags","error_codes"]){if(value[key]!==void 0&&!isStringArray(value[key])){throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`)}}const filePatterns=value.file_patterns;if(filePatterns!==void 0&&!isStringArray(filePatterns)){throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`)}for(const pattern of filePatterns??[]){if(pattern.length>MAX_FILE_PATTERN_LENGTH){throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`)}}}function assertFamilyIdentity(family,ids){assertNonEmpty(family.id,"defect recurrence family id");if(ids.has(family.id)){throw new TypeError(`Duplicate defect recurrence family ${family.id}`)}ids.add(family.id);if(!Number.isInteger(family.version)||family.version<1){throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`)}if(!DEFECT_ESCAPE_CLASSES.includes(family.escape_class)){throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`)}assertNonEmpty(family.title,`defect recurrence family ${family.id} title`);assertNonEmpty(family.owner_item_id,`defect recurrence family ${family.id} owner_item_id`)}function assertFamilyEvidenceContracts(family){if(!isStringArray(family.historical_item_ids)||family.historical_item_ids.length===0||family.historical_item_ids.some(itemId=>!itemId.trim())){throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`)}assertTriggers(family.triggers,family.id);if(!isRecord(family.checks)||!isStringArray(family.checks.local)||!isStringArray(family.checks.hosted)||family.checks.local.length===0||family.checks.hosted.length===0||family.checks.local.some(check=>!check.trim())||family.checks.hosted.some(check=>!check.trim())){throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`)}}function assertFamilyBudget(family){if(!isRecord(family.budget)||typeof family.budget.max_escape_rate!=="number"||!Number.isFinite(family.budget.max_escape_rate)||typeof family.budget.max_false_positive_rate!=="number"||!Number.isFinite(family.budget.max_false_positive_rate)){throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`)}if(family.budget.max_escape_rate<0||family.budget.max_escape_rate>1||family.budget.max_false_positive_rate<0||family.budget.max_false_positive_rate>1){throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`)}}function assertFamilyNegativeControl(family){const negativeControl=assertChangeInput(family.negative_control,`defect recurrence family ${family.id} negative_control`);if(familyReasons(family,negativeControl,{}).length===0){throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`)}}function validatePolicy(policy){if(policy.version!==1){throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`)}if(typeof policy.evidence_epoch!=="string"||!Number.isFinite(Date.parse(policy.evidence_epoch))){throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp")}const ids=new Set;for(const family of policy.families){if(!isRecord(family))throw new TypeError("defect recurrence family must be an object");assertFamilyIdentity(family,ids);assertFamilyEvidenceContracts(family);assertFamilyBudget(family);assertFamilyNegativeControl(family)}}function pathMatches(pattern,value){let compiled=compiledPathPatterns.get(pattern);if(compiled===void 0){if(compiledPathPatterns.size>=MAX_COMPILED_PATH_PATTERNS){const oldest=compiledPathPatterns.keys().next().value;compiledPathPatterns.delete(oldest)}const escaped=pattern.replaceAll("**","\0").replaceAll(/[|\\{}()[\]^$+?./]/gu,"\\$&").replaceAll("*","[^/]*").replaceAll("\0",".*");compiled=new RegExp(`^${escaped}$`,"u");compiledPathPatterns.set(pattern,compiled)}return compiled.test(value)}function fileReasons(family,input){const reasons=[];const patterns=uniqueSorted(family.triggers.file_patterns??[]);for(const file of uniqueSorted(input.files??[])){for(const pattern of patterns){if(pathMatches(pattern,file))reasons.push({signal:"file",value:file,matched:pattern})}}return reasons}function exactReasons(family,input){const exactSignals=[{signal:"package",values:uniqueSorted(input.package_names??[]),triggers:uniqueSorted(family.triggers.package_names??[])},{signal:"tag",values:uniqueSorted(input.tags??[]),triggers:uniqueSorted(family.triggers.tags??[])},{signal:"error_code",values:uniqueSorted(input.error_codes??[]),triggers:uniqueSorted(family.triggers.error_codes??[])}];const reasons=[];for(const exact of exactSignals){const triggerSet=new Set(exact.triggers);for(const value of exact.values){if(triggerSet.has(value))reasons.push({signal:exact.signal,value,matched:value})}}return reasons}function itemReasons(family,input,itemFamilies){const directItemIds=new Set(family.triggers.item_ids??[]);return uniqueSorted(input.item_ids??[]).flatMap(itemId=>directItemIds.has(itemId)||Object.hasOwn(itemFamilies,itemId)&&itemFamilies[itemId].includes(family.id)?[{signal:"item",value:itemId,matched:family.id}]:[])}function familyReasons(family,input,itemFamilies){return[...fileReasons(family,input),...exactReasons(family,input),...itemReasons(family,input,itemFamilies)]}function readRiskCursorOffset(cursor,indexFingerprint){if(!cursor)return 0;let parsed;try{parsed=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("defect change-risk cursor is invalid")}if(typeof parsed!=="object"||parsed===null||Array.isArray(parsed)||parsed.index_fingerprint!==indexFingerprint||!Number.isInteger(parsed.offset)||parsed.offset<0){throw new TypeError("defect change-risk cursor does not match this index")}return parsed.offset}function changeSignalCount(input){return[input.files,input.package_names,input.item_ids,input.tags,input.error_codes].reduce((total,values)=>total+(values?.length??0),0)}function inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies){const graph=buildDefectRecurrenceGraph(families,recurrenceRecords);const fileFamilies=new Map;for(const lineage of graph.lineages){if(lineage.family_ids.length===0)continue;for(const id of lineage.item_ids){itemFamilies[id]=uniqueSorted([...Object.hasOwn(itemFamilies,id)?itemFamilies[id]:[],...lineage.family_ids]);for(const file of recurrenceRecords.get(id)?.files??[]){const matched=fileFamilies.get(file)??new Set;for(const familyId of lineage.family_ids)matched.add(familyId);fileFamilies.set(file,matched)}}}return fileFamilies}function refreshRecurrenceRecords(recurrenceRecords,items){for(const item of items){const record=readDefectRecurrenceRecord(item);if(record===void 0)recurrenceRecords.delete(item.id);else recurrenceRecords.set(item.id,record)}}function compileDirectItemSeeds(families){const historical=new Map;const triggers=new Map;for(const family of families){for(const[index,ids]of[[historical,family.historical_item_ids],[triggers,family.triggers.item_ids??[]]]){for(const id of ids){const matches=index.get(id)??new Set;matches.add(family.id);index.set(id,matches)}}}return{historical,triggers}}function directItemMatches(item,families,seeds){const signals=defectRecurrenceItemSignals(item);const hasContext=[signals.files,signals.package_names,signals.tags,signals.error_codes].some(values=>values&&values.length>0);if(hasContext){return families.filter(family=>family.historical_item_ids.includes(item.id)||familyReasons(family,signals,{}).length>0).map(family=>family.id)}return uniqueSorted([...seeds.historical.get(item.id)??[],...seeds.triggers.get(item.id.trim())??[]])}function buildDefectRecurrenceIndex(policy,items,options={}){validatePolicy(policy);const families=[...policy.families].sort((left,right)=>left.id<right.id?-1:1);const policyFingerprint=fingerprint({...policy,families});const changed=new Set(options.changed_item_ids??[]);const canReuse=options.previous_index?.policy_fingerprint===policyFingerprint;const itemFamilies=Object.assign(Object.create(null),canReuse?Object.fromEntries(Object.entries(options.previous_index?.direct_item_families??options.previous_index?.item_families??{}).filter(([itemId])=>!changed.has(itemId))):{});const itemsReused=canReuse?Object.keys(itemFamilies).length:0;const seeds=compileDirectItemSeeds(families);for(const item of items){const matched=directItemMatches(item,families,seeds);if(matched.length>0)itemFamilies[item.id]=matched;else delete itemFamilies[item.id]}const directItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1));const recurrenceRecords=new Map(canReuse?Object.entries(options.previous_index?.recurrence_records??{}).filter(([id])=>!changed.has(id)):[]);refreshRecurrenceRecords(recurrenceRecords,items);const fileFamilies=inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies);const sortedRecords=Object.fromEntries([...recurrenceRecords].sort(([left],[right])=>left<right?-1:1));const sortedFileFamilies=Object.fromEntries([...fileFamilies].sort(([left],[right])=>left<right?-1:1).map(([file,matches])=>[file,[...matches].sort()]));const sortedItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1).map(([itemId,familyIds])=>[itemId,uniqueSorted(familyIds)]));return{version:1,policy_fingerprint:policyFingerprint,index_fingerprint:fingerprint({policy_fingerprint:policyFingerprint,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies}),families,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies,build:{items_scanned:items.length,items_reused:itemsReused,items_indexed:Object.keys(sortedItemFamilies).length}}}function analyzeDefectChangeRisk(index,input,options={}){const limit=options.limit??25;if(!Number.isInteger(limit)||limit<1||limit>100){throw new TypeError("defect change-risk limit must be an integer from 1 through 100")}const offset=readRiskCursorOffset(options.cursor,index.index_fingerprint);const matches=index.families.flatMap(family=>{const reasons=familyReasons(family,input,index.item_families);for(const file of uniqueSorted(input.files??[])){if(index.file_families&&Object.hasOwn(index.file_families,file)&&index.file_families[file].includes(family.id)){reasons.push({signal:"file",value:file,matched:`recurs_from:${family.id}`})}}reasons.sort((left,right)=>left.signal!==right.signal?left.signal.localeCompare(right.signal):left.value!==right.value?left.value.localeCompare(right.value):left.matched.localeCompare(right.matched));return reasons.length===0?[]:[{family_id:family.id,family_version:family.version,owner_item_id:family.owner_item_id,escape_class:family.escape_class,reasons,local_checks:uniqueSorted(family.checks.local),hosted_checks:uniqueSorted(family.checks.hosted),budget:family.budget}]});const page=matches.slice(offset,offset+limit);const nextOffset=offset+page.length;const nextCursor=nextOffset<matches.length?Buffer.from(JSON.stringify({index_fingerprint:index.index_fingerprint,offset:nextOffset})).toString("base64url"):void 0;const reportWithoutCost={risk_detected:matches.length>0,index_fingerprint:index.index_fingerprint,items:page,total:matches.length,...nextCursor?{next_cursor:nextCursor}:{},required_local_checks:uniqueSorted(matches.flatMap(match=>match.local_checks)),required_hosted_checks:uniqueSorted(matches.flatMap(match=>match.hosted_checks)),row_contract:{row_keys:["items"],jq_selector:".items[]"}};return{...reportWithoutCost,cost:{families_evaluated:index.families.length,signals_evaluated:changeSignalCount(input),families_selected:matches.length,estimated_output_tokens:Math.ceil(JSON.stringify(reportWithoutCost).length/4)}}}function isDefectItem(item){return typeof item.type==="string"&&item.type.toLowerCase()==="issue"||(Array.isArray(item.tags)?item.tags:[]).some(tag=>typeof tag==="string"&&["bug","defect","security"].includes(tag.toLowerCase()))}function nonEmptyString(value){return typeof value==="string"&&value.trim().length>0}function nonEmptyStringArray(value){return Array.isArray(value)&&value.length>0&&value.every(nonEmptyString)}function validEvidence(value,nowMs){if(typeof value!=="object"||value===null||Array.isArray(value)){return{valid:false,expired:false}}const evidence=value;if(!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition)||typeof evidence.owner!=="string"||!evidence.owner.trim()){return{valid:false,expired:false}}if(evidence.disposition==="explicit_waiver"){const expiry=Date.parse(evidence.waiver_expires_at??"");return{valid:nonEmptyString(evidence.waiver_reason)&&Number.isFinite(expiry)&&expiry>=nowMs,expired:Number.isFinite(expiry)&&expiry<nowMs}}return{valid:nonEmptyString(evidence.gate_id)&&nonEmptyString(evidence.negative_control)&&nonEmptyStringArray(evidence.local_checks)&&nonEmptyStringArray(evidence.hosted_checks),expired:false}}function evidenceFindings(item,nowMs){const findings=[];if(!Number.isFinite(Date.parse(typeof item.completed_at==="string"?item.completed_at:""))&&!Number.isFinite(Date.parse(typeof item.closed_at==="string"?item.closed_at:""))){findings.push({item_id:item.id,kind:"invalid_completion_timestamp",detail:`${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`})}if(typeof item.escape_class!=="string"){findings.push({item_id:item.id,kind:"missing_escape_class",detail:`${item.id} requires escape_class after the defect-evidence epoch.`})}else if(!DEFECT_ESCAPE_CLASSES.includes(item.escape_class)){findings.push({item_id:item.id,kind:"invalid_escape_class",detail:`${item.id} has unsupported escape_class ${item.escape_class}.`})}if(item.gate_evidence===void 0){findings.push({item_id:item.id,kind:"missing_gate_evidence",detail:`${item.id} requires structured gate_evidence after the defect-evidence epoch.`});return findings}const result=validEvidence(item.gate_evidence,nowMs);if(!result.valid){findings.push({item_id:item.id,kind:result.expired?"expired_waiver":"invalid_gate_evidence",detail:result.expired?`${item.id} carries an expired gate-evidence waiver.`:`${item.id} gate_evidence does not prove a gate or explicit waiver.`})}return findings}function evaluateDefectGateEvidence(items,policy,terminalStatuses,now=new Date){validatePolicy(policy);const epochMs=Date.parse(policy.evidence_epoch);const terminal=new Set(terminalStatuses);const terminalDefects=items.filter(item=>terminal.has(item.status)&&isDefectItem(item));const governed=terminalDefects.filter(item=>{const completedAt=Date.parse(typeof item.completed_at==="string"?item.completed_at:"");if(Number.isFinite(completedAt))return completedAt>=epochMs;const closedAt=Date.parse(typeof item.closed_at==="string"?item.closed_at:"");if(Number.isFinite(closedAt))return closedAt>=epochMs;const createdAt=Date.parse(typeof item.created_at==="string"?item.created_at:"");return!Number.isFinite(createdAt)||createdAt>=epochMs});const classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(escapeClass=>[escapeClass,0]));const evidenceDispositionCounts=Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map(disposition=>[disposition,0]));const classified=terminalDefects.filter(item=>typeof item.escape_class==="string"&&DEFECT_ESCAPE_CLASSES.includes(item.escape_class));for(const item of classified){classCounts[item.escape_class]+=1;if(typeof item.gate_evidence==="object"&&item.gate_evidence!==null&&!Array.isArray(item.gate_evidence)){const disposition=item.gate_evidence.disposition;if(typeof disposition==="string"&&DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)){evidenceDispositionCounts[disposition]+=1}}}const findings=governed.flatMap(item=>evidenceFindings(item,now.getTime()));findings.sort((left,right)=>left.item_id!==right.item_id?left.item_id.localeCompare(right.item_id):left.kind.localeCompare(right.kind));return{ok:findings.length===0,governed_item_count:governed.length,classified_item_count:classified.length,class_counts:classCounts,evidence_disposition_counts:evidenceDispositionCounts,findings}}function parseDefectRecurrencePolicy(value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("defect recurrence policy must be an object")}const policy=value;if(!Array.isArray(policy.families)){throw new TypeError("defect recurrence policy families must be an array")}validatePolicy(policy);return policy}function parseDefectChangeRiskRequest(value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("defect change-risk request must be an object")}const request=value;const change=assertChangeInput(request.change,"defect change-risk request.change");if(request.cursor!==void 0&&typeof request.cursor!=="string"){throw new TypeError("defect change-risk request.cursor must be a string")}if(request.limit!==void 0&&!Number.isInteger(request.limit)){throw new TypeError("defect change-risk request.limit must be an integer")}return{policy:parseDefectRecurrencePolicy(request.policy),change,...request.cursor===void 0?{}:{cursor:request.cursor},...request.limit===void 0?{}:{limit:request.limit}}}export{DEFECT_ESCAPE_CLASSES,DEFECT_GATE_EVIDENCE_DISPOSITIONS,analyzeDefectChangeRisk,buildDefectRecurrenceIndex,evaluateDefectGateEvidence,parseDefectChangeRiskRequest,parseDefectRecurrencePolicy};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9088773-9fcf-5dc9-b10d-32e2490c5ba8")}catch{}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{defectRecurrenceItemSignals}from"./defect-recurrence-signals.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";const DEFECT_ESCAPE_CLASSES=["production_defect","nightly_regression","scanner_finding","review_caught_late"],DEFECT_GATE_EVIDENCE_DISPOSITIONS=["gate_added","gate_strengthened","explicit_waiver"],MAX_FILE_PATTERN_LENGTH=256,MAX_COMPILED_PATH_PATTERNS=1024,compiledPathPatterns=new Map,CHANGE_INPUT_FIELDS=["files","package_names","item_ids","tags","error_codes"];function uniqueSorted(values){return[...new Set(values.map(value=>value.trim()).filter(Boolean))].sort((left,right)=>left<right?-1:1)}function fingerprint(value){return createHash("sha256").update(stableStringify(value)).digest("hex")}function assertNonEmpty(value,field){if(typeof value!="string"||!value.trim())throw new TypeError(`${field} must be a non-empty string`)}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(entry=>typeof entry=="string")}function assertChangeInput(value,field){if(!isRecord(value))throw new TypeError(`${field} must be an object`);for(const key of CHANGE_INPUT_FIELDS)if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`${field}.${key} must be an array of strings`);return value}function assertTriggers(value,familyId){if(!isRecord(value))throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`);for(const key of["package_names","item_ids","tags","error_codes"])if(value[key]!==void 0&&!isStringArray(value[key]))throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`);const filePatterns=value.file_patterns;if(filePatterns!==void 0&&!isStringArray(filePatterns))throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`);for(const pattern of filePatterns??[])if(pattern.length>MAX_FILE_PATTERN_LENGTH)throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`)}function assertFamilyIdentity(family,ids){if(assertNonEmpty(family.id,"defect recurrence family id"),ids.has(family.id))throw new TypeError(`Duplicate defect recurrence family ${family.id}`);if(ids.add(family.id),!Number.isInteger(family.version)||family.version<1)throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`);if(!DEFECT_ESCAPE_CLASSES.includes(family.escape_class))throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`);assertNonEmpty(family.title,`defect recurrence family ${family.id} title`),assertNonEmpty(family.owner_item_id,`defect recurrence family ${family.id} owner_item_id`)}function assertFamilyEvidenceContracts(family){if(!isStringArray(family.historical_item_ids)||family.historical_item_ids.length===0||family.historical_item_ids.some(itemId=>!itemId.trim()))throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`);if(assertTriggers(family.triggers,family.id),!isRecord(family.checks)||!isStringArray(family.checks.local)||!isStringArray(family.checks.hosted)||family.checks.local.length===0||family.checks.hosted.length===0||family.checks.local.some(check=>!check.trim())||family.checks.hosted.some(check=>!check.trim()))throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`)}function assertFamilyBudget(family){if(!isRecord(family.budget)||typeof family.budget.max_escape_rate!="number"||!Number.isFinite(family.budget.max_escape_rate)||typeof family.budget.max_false_positive_rate!="number"||!Number.isFinite(family.budget.max_false_positive_rate))throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`);if(family.budget.max_escape_rate<0||family.budget.max_escape_rate>1||family.budget.max_false_positive_rate<0||family.budget.max_false_positive_rate>1)throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`)}function assertFamilyNegativeControl(family){const negativeControl=assertChangeInput(family.negative_control,`defect recurrence family ${family.id} negative_control`);if(familyReasons(family,negativeControl,{}).length===0)throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`)}function validatePolicy(policy){if(policy.version!==1)throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`);if(typeof policy.evidence_epoch!="string"||!Number.isFinite(Date.parse(policy.evidence_epoch)))throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp");const ids=new Set;for(const family of policy.families){if(!isRecord(family))throw new TypeError("defect recurrence family must be an object");assertFamilyIdentity(family,ids),assertFamilyEvidenceContracts(family),assertFamilyBudget(family),assertFamilyNegativeControl(family)}}function pathMatches(pattern,value){let compiled=compiledPathPatterns.get(pattern);if(compiled===void 0){if(compiledPathPatterns.size>=MAX_COMPILED_PATH_PATTERNS){const oldest=compiledPathPatterns.keys().next().value;compiledPathPatterns.delete(oldest)}const escaped=pattern.replaceAll("**","\0").replaceAll(/[|\\{}()[\]^$+?./]/gu,"\\$&").replaceAll("*","[^/]*").replaceAll("\0",".*");compiled=new RegExp(`^${escaped}$`,"u"),compiledPathPatterns.set(pattern,compiled)}return compiled.test(value)}function fileReasons(family,input){const reasons=[],patterns=uniqueSorted(family.triggers.file_patterns??[]);for(const file of uniqueSorted(input.files??[]))for(const pattern of patterns)pathMatches(pattern,file)&&reasons.push({signal:"file",value:file,matched:pattern});return reasons}function exactReasons(family,input){const exactSignals=[{signal:"package",values:uniqueSorted(input.package_names??[]),triggers:uniqueSorted(family.triggers.package_names??[])},{signal:"tag",values:uniqueSorted(input.tags??[]),triggers:uniqueSorted(family.triggers.tags??[])},{signal:"error_code",values:uniqueSorted(input.error_codes??[]),triggers:uniqueSorted(family.triggers.error_codes??[])}],reasons=[];for(const exact of exactSignals){const triggerSet=new Set(exact.triggers);for(const value of exact.values)triggerSet.has(value)&&reasons.push({signal:exact.signal,value,matched:value})}return reasons}function itemReasons(family,input,itemFamilies){const directItemIds=new Set(family.triggers.item_ids??[]);return uniqueSorted(input.item_ids??[]).flatMap(itemId=>directItemIds.has(itemId)||Object.hasOwn(itemFamilies,itemId)&&itemFamilies[itemId].includes(family.id)?[{signal:"item",value:itemId,matched:family.id}]:[])}function familyReasons(family,input,itemFamilies){return[...fileReasons(family,input),...exactReasons(family,input),...itemReasons(family,input,itemFamilies)]}function readRiskCursorOffset(cursor,indexFingerprint){if(!cursor)return 0;let parsed;try{parsed=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("defect change-risk cursor is invalid")}if(typeof parsed!="object"||parsed===null||Array.isArray(parsed)||parsed.index_fingerprint!==indexFingerprint||!Number.isInteger(parsed.offset)||parsed.offset<0)throw new TypeError("defect change-risk cursor does not match this index");return parsed.offset}function changeSignalCount(input){return[input.files,input.package_names,input.item_ids,input.tags,input.error_codes].reduce((total,values)=>total+(values?.length??0),0)}function inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies){const graph=buildDefectRecurrenceGraph(families,recurrenceRecords),fileFamilies=new Map;for(const lineage of graph.lineages)if(lineage.family_ids.length!==0)for(const id of lineage.item_ids){itemFamilies[id]=uniqueSorted([...Object.hasOwn(itemFamilies,id)?itemFamilies[id]:[],...lineage.family_ids]);for(const file of recurrenceRecords.get(id)?.files??[]){const matched=fileFamilies.get(file)??new Set;for(const familyId of lineage.family_ids)matched.add(familyId);fileFamilies.set(file,matched)}}return fileFamilies}function refreshRecurrenceRecords(recurrenceRecords,items){for(const item of items){const record=readDefectRecurrenceRecord(item);record===void 0?recurrenceRecords.delete(item.id):recurrenceRecords.set(item.id,record)}}function compileDirectItemSeeds(families){const historical=new Map,triggers=new Map;for(const family of families)for(const[index,ids]of[[historical,family.historical_item_ids],[triggers,family.triggers.item_ids??[]]])for(const id of ids){const matches=index.get(id)??new Set;matches.add(family.id),index.set(id,matches)}return{historical,triggers}}function directItemMatches(item,families,seeds){const signals=defectRecurrenceItemSignals(item);return[signals.files,signals.package_names,signals.tags,signals.error_codes].some(values=>values&&values.length>0)?families.filter(family=>family.historical_item_ids.includes(item.id)||familyReasons(family,signals,{}).length>0).map(family=>family.id):uniqueSorted([...seeds.historical.get(item.id)??[],...seeds.triggers.get(item.id.trim())??[]])}function buildDefectRecurrenceIndex(policy,items,options={}){validatePolicy(policy);const families=[...policy.families].sort((left,right)=>left.id<right.id?-1:1),policyFingerprint=fingerprint({...policy,families}),changed=new Set(options.changed_item_ids??[]),canReuse=options.previous_index?.policy_fingerprint===policyFingerprint,itemFamilies=Object.assign(Object.create(null),canReuse?Object.fromEntries(Object.entries(options.previous_index?.direct_item_families??options.previous_index?.item_families??{}).filter(([itemId])=>!changed.has(itemId))):{}),itemsReused=canReuse?Object.keys(itemFamilies).length:0,seeds=compileDirectItemSeeds(families);for(const item of items){const matched=directItemMatches(item,families,seeds);matched.length>0?itemFamilies[item.id]=matched:delete itemFamilies[item.id]}const directItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1)),recurrenceRecords=new Map(canReuse?Object.entries(options.previous_index?.recurrence_records??{}).filter(([id])=>!changed.has(id)):[]);refreshRecurrenceRecords(recurrenceRecords,items);const fileFamilies=inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies),sortedRecords=Object.fromEntries([...recurrenceRecords].sort(([left],[right])=>left<right?-1:1)),sortedFileFamilies=Object.fromEntries([...fileFamilies].sort(([left],[right])=>left<right?-1:1).map(([file,matches])=>[file,[...matches].sort()])),sortedItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1).map(([itemId,familyIds])=>[itemId,uniqueSorted(familyIds)]));return{version:1,policy_fingerprint:policyFingerprint,index_fingerprint:fingerprint({policy_fingerprint:policyFingerprint,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies}),families,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies,build:{items_scanned:items.length,items_reused:itemsReused,items_indexed:Object.keys(sortedItemFamilies).length}}}function analyzeDefectChangeRisk(index,input,options={}){const limit=options.limit??25;if(!Number.isInteger(limit)||limit<1||limit>100)throw new TypeError("defect change-risk limit must be an integer from 1 through 100");const offset=readRiskCursorOffset(options.cursor,index.index_fingerprint),matches=index.families.flatMap(family=>{const reasons=familyReasons(family,input,index.item_families);for(const file of uniqueSorted(input.files??[]))index.file_families&&Object.hasOwn(index.file_families,file)&&index.file_families[file].includes(family.id)&&reasons.push({signal:"file",value:file,matched:`recurs_from:${family.id}`});return reasons.sort((left,right)=>left.signal!==right.signal?left.signal.localeCompare(right.signal):left.value!==right.value?left.value.localeCompare(right.value):left.matched.localeCompare(right.matched)),reasons.length===0?[]:[{family_id:family.id,family_version:family.version,owner_item_id:family.owner_item_id,escape_class:family.escape_class,reasons,local_checks:uniqueSorted(family.checks.local),hosted_checks:uniqueSorted(family.checks.hosted),budget:family.budget}]}),page=matches.slice(offset,offset+limit),nextOffset=offset+page.length,nextCursor=nextOffset<matches.length?Buffer.from(JSON.stringify({index_fingerprint:index.index_fingerprint,offset:nextOffset})).toString("base64url"):void 0,reportWithoutCost={risk_detected:matches.length>0,index_fingerprint:index.index_fingerprint,items:page,total:matches.length,...nextCursor?{next_cursor:nextCursor}:{},required_local_checks:uniqueSorted(matches.flatMap(match=>match.local_checks)),required_hosted_checks:uniqueSorted(matches.flatMap(match=>match.hosted_checks)),row_contract:{row_keys:["items"],jq_selector:".items[]"}};return{...reportWithoutCost,cost:{families_evaluated:index.families.length,signals_evaluated:changeSignalCount(input),families_selected:matches.length,estimated_output_tokens:Math.ceil(JSON.stringify(reportWithoutCost).length/4)}}}function isDefectItem(item){return typeof item.type=="string"&&item.type.toLowerCase()==="issue"||(Array.isArray(item.tags)?item.tags:[]).some(tag=>typeof tag=="string"&&["bug","defect","security"].includes(tag.toLowerCase()))}function nonEmptyString(value){return typeof value=="string"&&value.trim().length>0}function nonEmptyStringArray(value){return Array.isArray(value)&&value.length>0&&value.every(nonEmptyString)}function validEvidence(value,nowMs){if(typeof value!="object"||value===null||Array.isArray(value))return{valid:!1,expired:!1};const evidence=value;if(!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition)||typeof evidence.owner!="string"||!evidence.owner.trim())return{valid:!1,expired:!1};if(evidence.disposition==="explicit_waiver"){const expiry=Date.parse(evidence.waiver_expires_at??"");return{valid:nonEmptyString(evidence.waiver_reason)&&Number.isFinite(expiry)&&expiry>=nowMs,expired:Number.isFinite(expiry)&&expiry<nowMs}}return{valid:nonEmptyString(evidence.gate_id)&&nonEmptyString(evidence.negative_control)&&nonEmptyStringArray(evidence.local_checks)&&nonEmptyStringArray(evidence.hosted_checks),expired:!1}}function evidenceFindings(item,nowMs){const findings=[];if(!Number.isFinite(Date.parse(typeof item.completed_at=="string"?item.completed_at:""))&&!Number.isFinite(Date.parse(typeof item.closed_at=="string"?item.closed_at:""))&&findings.push({item_id:item.id,kind:"invalid_completion_timestamp",detail:`${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`}),typeof item.escape_class!="string"?findings.push({item_id:item.id,kind:"missing_escape_class",detail:`${item.id} requires escape_class after the defect-evidence epoch.`}):DEFECT_ESCAPE_CLASSES.includes(item.escape_class)||findings.push({item_id:item.id,kind:"invalid_escape_class",detail:`${item.id} has unsupported escape_class ${item.escape_class}.`}),item.gate_evidence===void 0)return findings.push({item_id:item.id,kind:"missing_gate_evidence",detail:`${item.id} requires structured gate_evidence after the defect-evidence epoch.`}),findings;const result=validEvidence(item.gate_evidence,nowMs);return result.valid||findings.push({item_id:item.id,kind:result.expired?"expired_waiver":"invalid_gate_evidence",detail:result.expired?`${item.id} carries an expired gate-evidence waiver.`:`${item.id} gate_evidence does not prove a gate or explicit waiver.`}),findings}function evaluateDefectGateEvidence(items,policy,terminalStatuses,now=new Date){validatePolicy(policy);const epochMs=Date.parse(policy.evidence_epoch),terminal=new Set(terminalStatuses),terminalDefects=items.filter(item=>terminal.has(item.status)&&isDefectItem(item)),governed=terminalDefects.filter(item=>{const completedAt=Date.parse(typeof item.completed_at=="string"?item.completed_at:"");if(Number.isFinite(completedAt))return completedAt>=epochMs;const closedAt=Date.parse(typeof item.closed_at=="string"?item.closed_at:"");if(Number.isFinite(closedAt))return closedAt>=epochMs;const createdAt=Date.parse(typeof item.created_at=="string"?item.created_at:"");return!Number.isFinite(createdAt)||createdAt>=epochMs}),classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(escapeClass=>[escapeClass,0])),evidenceDispositionCounts=Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map(disposition=>[disposition,0])),classified=terminalDefects.filter(item=>typeof item.escape_class=="string"&&DEFECT_ESCAPE_CLASSES.includes(item.escape_class));for(const item of classified)if(classCounts[item.escape_class]+=1,typeof item.gate_evidence=="object"&&item.gate_evidence!==null&&!Array.isArray(item.gate_evidence)){const disposition=item.gate_evidence.disposition;typeof disposition=="string"&&DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)&&(evidenceDispositionCounts[disposition]+=1)}const findings=governed.flatMap(item=>evidenceFindings(item,now.getTime()));return findings.sort((left,right)=>left.item_id!==right.item_id?left.item_id.localeCompare(right.item_id):left.kind.localeCompare(right.kind)),{ok:findings.length===0,governed_item_count:governed.length,classified_item_count:classified.length,class_counts:classCounts,evidence_disposition_counts:evidenceDispositionCounts,findings}}function parseDefectRecurrencePolicy(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect recurrence policy must be an object");const policy=value;if(!Array.isArray(policy.families))throw new TypeError("defect recurrence policy families must be an array");return validatePolicy(policy),policy}function parseDefectChangeRiskRequest(value){if(typeof value!="object"||value===null||Array.isArray(value))throw new TypeError("defect change-risk request must be an object");const request=value,change=assertChangeInput(request.change,"defect change-risk request.change");if(request.cursor!==void 0&&typeof request.cursor!="string")throw new TypeError("defect change-risk request.cursor must be a string");if(request.limit!==void 0&&!Number.isInteger(request.limit))throw new TypeError("defect change-risk request.limit must be an integer");return{policy:parseDefectRecurrencePolicy(request.policy),change,...request.cursor===void 0?{}:{cursor:request.cursor},...request.limit===void 0?{}:{limit:request.limit}}}export{DEFECT_ESCAPE_CLASSES,DEFECT_GATE_EVIDENCE_DISPOSITIONS,analyzeDefectChangeRisk,buildDefectRecurrenceIndex,evaluateDefectGateEvidence,parseDefectChangeRiskRequest,parseDefectRecurrencePolicy};
 //# sourceMappingURL=defect-recurrence.js.map

package/dist/sdk/governance/extension-host-version.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a0014621-9e3d-5620-8f36-081811054843")}catch(e2){}})();import fs from"node:fs/promises";import{createRequire}from"node:module";import path from"node:path";import{resolvePmPackageRootFromModule}from"../../core/packages/root.js";function displayPackagePath(packageJsonPath,workspaceRoot){const relative=path.relative(workspaceRoot,packageJsonPath);if(relative.length>0&&relative!==".."&&!relative.startsWith(`..${path.sep}`)&&!path.isAbsolute(relative)){return relative.split(path.sep).join("/")}const externalPath=path.resolve(packageJsonPath);let fingerprint=0xcbf29ce484222325n;for(let index=0;index<externalPath.length;index+=1){fingerprint^=BigInt(externalPath.charCodeAt(index));fingerprint=BigInt.asUintN(64,fingerprint*0x100000001b3n)}const installationId=fingerprint.toString(16).padStart(16,"0");return`<external>/${installationId}/${path.basename(path.dirname(packageJsonPath))}/package.json`}function dependencyLayout(packageJsonPath){if(packageJsonPath.includes(`${path.sep}.pnpm${path.sep}`))return"pnpm";if(packageJsonPath.includes(`${path.sep}node_modules${path.sep}`)){return"npm"}return"other"}async function readPackageVersion(packageJsonPath){try{const parsed=JSON.parse(await fs.readFile(packageJsonPath,"utf8"));return parsed.name==="@unbrained/pm-cli"&&typeof parsed.version==="string"&&parsed.version.trim().length>0?parsed.version.trim():void 0}catch{return void 0}}async function canonicalPath(candidate){try{return await fs.realpath(candidate)}catch{return path.resolve(candidate)}}async function scanExtensionHostVersions(loadedExtensions,workspaceRoot,hostPackageRoot=resolvePmPackageRootFromModule(import.meta.url,["../../.."])){const canonicalWorkspaceRoot=await canonicalPath(workspaceRoot);const hostPackageJson=await canonicalPath(path.join(hostPackageRoot,"package.json"));const hostVersion=await readPackageVersion(hostPackageJson);const copies=new Map;if(hostVersion!==void 0){copies.set(hostPackageJson,{version:hostVersion,path:displayPackagePath(hostPackageJson,canonicalWorkspaceRoot),layout:"host",consumers:["pm-cli-host"]})}for(const extension of loadedExtensions){try{const resolved=createRequire(extension.entry_path).resolve("@unbrained/pm-cli/package.json");const canonicalPackageJson=await canonicalPath(resolved);const version=await readPackageVersion(canonicalPackageJson);if(version===void 0)continue;const key=canonicalPackageJson;const existing=copies.get(key);if(existing){if(!existing.consumers.includes(extension.name)){existing.consumers.push(extension.name);existing.consumers.sort((left,right)=>left.localeCompare(right))}continue}copies.set(key,{version,path:displayPackagePath(canonicalPackageJson,canonicalWorkspaceRoot),layout:dependencyLayout(canonicalPackageJson),consumers:[extension.name]})}catch{}}const sortedCopies=[...copies.values()].sort((left,right)=>left.path.localeCompare(right.path));const mismatches=hostVersion===void 0?[]:sortedCopies.filter(copy=>copy.version!==hostVersion);return{host_version:hostVersion??null,copies:sortedCopies,mismatches,warnings:mismatches.map(copy=>`extension_host_pm_cli_version_skew:${hostVersion}:${copy.version}:${copy.consumers.join("+")}`)}}export{scanExtensionHostVersions};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="32adaa7c-f0aa-5aff-8d88-d7c0ccfbd971")}catch{}})();import fs from"node:fs/promises";import{createRequire}from"node:module";import path from"node:path";import{resolvePmPackageRootFromModule}from"../../core/packages/root.js";function displayPackagePath(packageJsonPath,workspaceRoot){const relative=path.relative(workspaceRoot,packageJsonPath);if(relative.length>0&&relative!==".."&&!relative.startsWith(`..${path.sep}`)&&!path.isAbsolute(relative))return relative.split(path.sep).join("/");const externalPath=path.resolve(packageJsonPath);let fingerprint=0xcbf29ce484222325n;for(let index=0;index<externalPath.length;index+=1)fingerprint^=BigInt(externalPath.charCodeAt(index)),fingerprint=BigInt.asUintN(64,fingerprint*0x100000001b3n);return`<external>/${fingerprint.toString(16).padStart(16,"0")}/${path.basename(path.dirname(packageJsonPath))}/package.json`}function dependencyLayout(packageJsonPath){return packageJsonPath.includes(`${path.sep}.pnpm${path.sep}`)?"pnpm":packageJsonPath.includes(`${path.sep}node_modules${path.sep}`)?"npm":"other"}async function readPackageVersion(packageJsonPath){try{const parsed=JSON.parse(await fs.readFile(packageJsonPath,"utf8"));return parsed.name==="@unbrained/pm-cli"&&typeof parsed.version=="string"&&parsed.version.trim().length>0?parsed.version.trim():void 0}catch{return}}async function canonicalPath(candidate){try{return await fs.realpath(candidate)}catch{return path.resolve(candidate)}}async function scanExtensionHostVersions(loadedExtensions,workspaceRoot,hostPackageRoot=resolvePmPackageRootFromModule(import.meta.url,["../../.."])){const canonicalWorkspaceRoot=await canonicalPath(workspaceRoot),hostPackageJson=await canonicalPath(path.join(hostPackageRoot,"package.json")),hostVersion=await readPackageVersion(hostPackageJson),copies=new Map;hostVersion!==void 0&&copies.set(hostPackageJson,{version:hostVersion,path:displayPackagePath(hostPackageJson,canonicalWorkspaceRoot),layout:"host",consumers:["pm-cli-host"]});for(const extension of loadedExtensions)try{const resolved=createRequire(extension.entry_path).resolve("@unbrained/pm-cli/package.json"),canonicalPackageJson=await canonicalPath(resolved),version=await readPackageVersion(canonicalPackageJson);if(version===void 0)continue;const key=canonicalPackageJson,existing=copies.get(key);if(existing){existing.consumers.includes(extension.name)||(existing.consumers.push(extension.name),existing.consumers.sort((left,right)=>left.localeCompare(right)));continue}copies.set(key,{version,path:displayPackagePath(canonicalPackageJson,canonicalWorkspaceRoot),layout:dependencyLayout(canonicalPackageJson),consumers:[extension.name]})}catch{}const sortedCopies=[...copies.values()].sort((left,right)=>left.path.localeCompare(right.path)),mismatches=hostVersion===void 0?[]:sortedCopies.filter(copy=>copy.version!==hostVersion);return{host_version:hostVersion??null,copies:sortedCopies,mismatches,warnings:mismatches.map(copy=>`extension_host_pm_cli_version_skew:${hostVersion}:${copy.version}:${copy.consumers.join("+")}`)}}export{scanExtensionHostVersions};
 //# sourceMappingURL=extension-host-version.js.map

package/dist/sdk/governance/gc.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8e2e3b62-5eb1-5773-96bf-866b26a59345")}catch(e2){}})();import{assertInitializedTracker}from"../environment/tracker-preflight.js";import fs from"node:fs/promises";import path from"node:path";import{runCheckpointGc}from"../../core/checkpoint/checkpoint-gc.js";import{runWorkspaceTransactionGc}from"../workspace-transaction-gc.js";import{runActiveOnIndexHooks,runActiveOnReadHooks,runActiveOnWriteHooks}from"../../core/extensions/index.js";import{isFileMissingError,pathExists}from"../../core/fs/fs-utils.js";import{runLockGc}from"../../core/lock/lock-gc.js";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{nowIso}from"../../core/shared/time.js";import{resolvePmRoot}from"../../core/store/paths.js";import{readSettings}from"../../core/store/settings.js";const GC_SCOPE_VALUES=["index","embeddings","runtime","locks","checkpoints","transactions"];const WORKSPACE_SNAPSHOT_TEMP_RETENTION_MS=24*60*60*1e3;const GC_TARGETS=[{scope:"index",relativePath:"index/manifest.json",kind:"file"},{scope:"embeddings",relativePath:"search/embeddings.jsonl",kind:"file"},{scope:"embeddings",relativePath:"search/vectorization-status.json",kind:"file"},{scope:"embeddings",relativePath:"search/lancedb",kind:"directory"},{scope:"embeddings",relativePath:"search/pending-refresh.json",kind:"file"},{scope:"embeddings",relativePath:"search/pending-refresh.gate.lock",kind:"directory"},{scope:"runtime",relativePath:"runtime/test-runs",kind:"directory"},{scope:"runtime",relativePath:"runtime/history-drift-cache.json",kind:"file"}];async function removeCacheFile(pmRoot,target,dryRun){const relativePath=target.relativePath;const absolutePath=path.join(pmRoot,relativePath);const warnings=await runActiveOnReadHooks({path:absolutePath,scope:"project"});try{const stats=await fs.stat(absolutePath);if(target.kind==="file"&&!stats.isFile()){return{removed:false,warnings:[...warnings,`not_a_file:${relativePath}`]}}if(target.kind==="directory"&&!stats.isDirectory()){return{removed:false,warnings:[...warnings,`not_a_directory:${relativePath}`]}}if(dryRun){return{removed:true,warnings}}if(target.kind==="file"){await fs.unlink(absolutePath)}else{await fs.rm(absolutePath,{recursive:true,force:true})}const writeWarnings=await runActiveOnWriteHooks({path:absolutePath,scope:"project",op:"gc:remove"});return{removed:true,warnings:[...warnings,...writeWarnings]}}catch(error){if(isFileMissingError(error)){return{removed:false,warnings}}throw error}}async function sweepWorkspaceSnapshotTemps(pmRoot,dryRun){const roots=[{relativePath:"runtime/workspace-snapshots/objects",prefix:".create-"},{relativePath:"runtime/workspace-snapshots/refs",prefix:".ref-"}];const removed=[];const retained=[];const warnings=[];const staleBefore=Date.now()-WORKSPACE_SNAPSHOT_TEMP_RETENTION_MS;for(const root of roots){const absoluteRoot=path.join(pmRoot,root.relativePath);if(!await pathExists(absoluteRoot)){continue}const names=(await fs.readdir(absoluteRoot)).filter(name=>name.startsWith(root.prefix)).sort();for(const name of names){const relativePath=path.posix.join(root.relativePath,name);const absolutePath=path.join(absoluteRoot,name);warnings.push(...await runActiveOnReadHooks({path:absolutePath,scope:"project"}));const stats=await fs.stat(absolutePath).catch(error=>{if(isFileMissingError(error)){return void 0}throw error});if(!stats){continue}if(stats.mtimeMs>staleBefore){retained.push(relativePath);continue}removed.push(relativePath);if(dryRun){continue}await fs.rm(absolutePath,{recursive:true,force:true});warnings.push(...await runActiveOnWriteHooks({path:absolutePath,scope:"project",op:"gc:workspace_snapshot_temp_remove"}))}}return{removed,retained,warnings}}function parseScopes(raw){if(!raw||raw.length===0){return[...GC_SCOPE_VALUES]}const tokens=raw.flatMap(entry=>entry.split(",")).map(entry=>entry.trim().toLowerCase()).filter(entry=>entry.length>0);if(tokens.length===0){throw new PmCliError(`--scope requires at least one value (${GC_SCOPE_VALUES.join(",")})`,EXIT_CODE.USAGE)}const resolved=new Set;for(const token of tokens){if(!GC_SCOPE_VALUES.includes(token)){throw new PmCliError(`Invalid --scope value "${token}". Expected one or more of: ${GC_SCOPE_VALUES.join(", ")}`,EXIT_CODE.USAGE)}resolved.add(token)}return GC_SCOPE_VALUES.filter(scope=>resolved.has(scope))}function buildGcGuidance(params){const guidance=[];if(params.dryRun){guidance.push("Dry-run preview only: no cache artifacts were deleted.")}const searchScopeSelected=params.scopes.includes("index")||params.scopes.includes("embeddings");const searchArtifactsAffected=params.removed.some(entry=>entry==="index/manifest.json"||entry==="search/embeddings.jsonl"||entry==="search/vectorization-status.json"||entry==="search/lancedb"||entry==="search/pending-refresh.json"||entry==="search/pending-refresh.gate.lock");if(searchScopeSelected&&searchArtifactsAffected){guidance.push('Search artifacts were removed; the semantic index (including any queued background refresh) is invalidated. Run "pm install search-advanced --project" if reindex is unavailable, then "pm reindex --mode keyword" (and "--mode semantic" when semantic search is enabled) before search-heavy workflows.')}if(params.removed.includes("runtime/history-drift-cache.json")){guidance.push('History drift cache was removed; the next "pm health" run performs a full history-drift re-scan.')}if(!params.dryRun&&params.removed.some(entry=>entry.startsWith("checkpoints/"))){guidance.push('Aged rollback checkpoints were removed; their "pm update-many"/"pm close-many --rollback" windows are no longer recoverable.')}if(!params.dryRun&&params.removed.some(entry=>entry.startsWith("transactions/"))){guidance.push("Aged terminal workspace-transaction journals were removed; replaying those transactionIds re-executes their idempotent steps instead of short-circuiting.")}return guidance}async function runGc(global2,options={}){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await assertInitializedTracker(pmRoot);const settings=await readSettings(pmRoot);const dryRun=options.dryRun===true;const scopes=parseScopes(options.scope);const selectedTargets=GC_TARGETS.filter(target=>scopes.includes(target.scope));const removed=[];const retained=[];const warnings=[];for(const target of selectedTargets){const result=await removeCacheFile(pmRoot,target,dryRun);if(result.removed){removed.push(target.relativePath)}else{retained.push(target.relativePath)}warnings.push(...result.warnings)}if(scopes.includes("runtime")){const snapshotTempResult=await sweepWorkspaceSnapshotTemps(pmRoot,dryRun);removed.push(...snapshotTempResult.removed);retained.push(...snapshotTempResult.retained);warnings.push(...snapshotTempResult.warnings)}let locksSummary;if(scopes.includes("locks")){const lockResult=await runLockGc(pmRoot,{dryRun,hooks:{onRead:lockPath=>runActiveOnReadHooks({path:lockPath,scope:"project"}),onWrite:lockPath=>runActiveOnWriteHooks({path:lockPath,scope:"project",op:"gc:lock_remove"})}});removed.push(...lockResult.removed);retained.push(...lockResult.retained);warnings.push(...lockResult.warnings);locksSummary={scanned:lockResult.scanned,removed:lockResult.removed.length,retained:lockResult.retained.length}}let transactionsSummary;if(scopes.includes("transactions")){const retentionDays=settings.checkpoints.retention_days;const transactionResult=await runWorkspaceTransactionGc(pmRoot,{dryRun,retentionDays,hooks:{onRead:journalPath=>runActiveOnReadHooks({path:journalPath,scope:"project"}),onWrite:journalPath=>runActiveOnWriteHooks({path:journalPath,scope:"project",op:"gc:transaction_journal_remove"})}});removed.push(...transactionResult.removed);retained.push(...transactionResult.retained);warnings.push(...transactionResult.warnings);transactionsSummary={scanned:transactionResult.scanned,removed:transactionResult.removed.length,retained:transactionResult.retained.length,retention_days:retentionDays}}let checkpointsSummary;if(scopes.includes("checkpoints")){const retentionDays=settings.checkpoints.retention_days;const checkpointResult=await runCheckpointGc(pmRoot,{dryRun,retentionDays,hooks:{onRead:checkpointPath=>runActiveOnReadHooks({path:checkpointPath,scope:"project"}),onWrite:checkpointPath=>runActiveOnWriteHooks({path:checkpointPath,scope:"project",op:"gc:checkpoint_remove"})}});removed.push(...checkpointResult.removed);retained.push(...checkpointResult.retained);warnings.push(...checkpointResult.warnings);checkpointsSummary={scanned:checkpointResult.scanned,removed:checkpointResult.removed.length,retained:checkpointResult.retained.length,retention_days:retentionDays}}warnings.push(...await runActiveOnIndexHooks({mode:dryRun?"gc:dry-run":"gc",total_items:selectedTargets.length}));const guidance=buildGcGuidance({dryRun,scopes,removed});return{ok:warnings.length===0,dry_run:dryRun,scope:scopes,removed,retained,warnings,...locksSummary?{locks:locksSummary}:{},...checkpointsSummary?{checkpoints:checkpointsSummary}:{},...transactionsSummary?{transactions:transactionsSummary}:{},guidance,generated_at:nowIso()}}export{runGc};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="38736716-2644-5166-bfec-4ed4bca951b9")}catch{}})();import{assertInitializedTracker}from"../environment/tracker-preflight.js";import fs from"node:fs/promises";import path from"node:path";import{runCheckpointGc}from"../../core/checkpoint/checkpoint-gc.js";import{runWorkspaceTransactionGc}from"../workspace-transaction-gc.js";import{runActiveOnIndexHooks,runActiveOnReadHooks,runActiveOnWriteHooks}from"../../core/extensions/index.js";import{isFileMissingError,pathExists}from"../../core/fs/fs-utils.js";import{runLockGc}from"../../core/lock/lock-gc.js";import{EXIT_CODE}from"../../core/shared/constants.js";import{PmCliError}from"../../core/shared/errors.js";import{nowIso}from"../../core/shared/time.js";import{resolvePmRoot}from"../../core/store/paths.js";import{readSettings}from"../../core/store/settings.js";const GC_SCOPE_VALUES=["index","embeddings","runtime","locks","checkpoints","transactions"],WORKSPACE_SNAPSHOT_TEMP_RETENTION_MS=1440*60*1e3,GC_TARGETS=[{scope:"index",relativePath:"index/manifest.json",kind:"file"},{scope:"embeddings",relativePath:"search/embeddings.jsonl",kind:"file"},{scope:"embeddings",relativePath:"search/vectorization-status.json",kind:"file"},{scope:"embeddings",relativePath:"search/lancedb",kind:"directory"},{scope:"embeddings",relativePath:"search/pending-refresh.json",kind:"file"},{scope:"embeddings",relativePath:"search/pending-refresh.gate.lock",kind:"directory"},{scope:"runtime",relativePath:"runtime/test-runs",kind:"directory"},{scope:"runtime",relativePath:"runtime/history-drift-cache.json",kind:"file"}];async function removeCacheFile(pmRoot,target,dryRun){const relativePath=target.relativePath,absolutePath=path.join(pmRoot,relativePath),warnings=await runActiveOnReadHooks({path:absolutePath,scope:"project"});try{const stats=await fs.stat(absolutePath);if(target.kind==="file"&&!stats.isFile())return{removed:!1,warnings:[...warnings,`not_a_file:${relativePath}`]};if(target.kind==="directory"&&!stats.isDirectory())return{removed:!1,warnings:[...warnings,`not_a_directory:${relativePath}`]};if(dryRun)return{removed:!0,warnings};target.kind==="file"?await fs.unlink(absolutePath):await fs.rm(absolutePath,{recursive:!0,force:!0});const writeWarnings=await runActiveOnWriteHooks({path:absolutePath,scope:"project",op:"gc:remove"});return{removed:!0,warnings:[...warnings,...writeWarnings]}}catch(error){if(isFileMissingError(error))return{removed:!1,warnings};throw error}}async function sweepWorkspaceSnapshotTemps(pmRoot,dryRun){const roots=[{relativePath:"runtime/workspace-snapshots/objects",prefix:".create-"},{relativePath:"runtime/workspace-snapshots/refs",prefix:".ref-"}],removed=[],retained=[],warnings=[],staleBefore=Date.now()-WORKSPACE_SNAPSHOT_TEMP_RETENTION_MS;for(const root of roots){const absoluteRoot=path.join(pmRoot,root.relativePath);if(!await pathExists(absoluteRoot))continue;const names=(await fs.readdir(absoluteRoot)).filter(name=>name.startsWith(root.prefix)).sort();for(const name of names){const relativePath=path.posix.join(root.relativePath,name),absolutePath=path.join(absoluteRoot,name);warnings.push(...await runActiveOnReadHooks({path:absolutePath,scope:"project"}));const stats=await fs.stat(absolutePath).catch(error=>{if(!isFileMissingError(error))throw error});if(stats){if(stats.mtimeMs>staleBefore){retained.push(relativePath);continue}removed.push(relativePath),!dryRun&&(await fs.rm(absolutePath,{recursive:!0,force:!0}),warnings.push(...await runActiveOnWriteHooks({path:absolutePath,scope:"project",op:"gc:workspace_snapshot_temp_remove"})))}}}return{removed,retained,warnings}}function parseScopes(raw){if(!raw||raw.length===0)return[...GC_SCOPE_VALUES];const tokens=raw.flatMap(entry=>entry.split(",")).map(entry=>entry.trim().toLowerCase()).filter(entry=>entry.length>0);if(tokens.length===0)throw new PmCliError(`--scope requires at least one value (${GC_SCOPE_VALUES.join(",")})`,EXIT_CODE.USAGE);const resolved=new Set;for(const token of tokens){if(!GC_SCOPE_VALUES.includes(token))throw new PmCliError(`Invalid --scope value "${token}". Expected one or more of: ${GC_SCOPE_VALUES.join(", ")}`,EXIT_CODE.USAGE);resolved.add(token)}return GC_SCOPE_VALUES.filter(scope=>resolved.has(scope))}function buildGcGuidance(params){const guidance=[];params.dryRun&&guidance.push("Dry-run preview only: no cache artifacts were deleted.");const searchScopeSelected=params.scopes.includes("index")||params.scopes.includes("embeddings"),searchArtifactsAffected=params.removed.some(entry=>entry==="index/manifest.json"||entry==="search/embeddings.jsonl"||entry==="search/vectorization-status.json"||entry==="search/lancedb"||entry==="search/pending-refresh.json"||entry==="search/pending-refresh.gate.lock");return searchScopeSelected&&searchArtifactsAffected&&guidance.push('Search artifacts were removed; the semantic index (including any queued background refresh) is invalidated. Run "pm install search-advanced --project" if reindex is unavailable, then "pm reindex --mode keyword" (and "--mode semantic" when semantic search is enabled) before search-heavy workflows.'),params.removed.includes("runtime/history-drift-cache.json")&&guidance.push('History drift cache was removed; the next "pm health" run performs a full history-drift re-scan.'),!params.dryRun&&params.removed.some(entry=>entry.startsWith("checkpoints/"))&&guidance.push('Aged rollback checkpoints were removed; their "pm update-many"/"pm close-many --rollback" windows are no longer recoverable.'),!params.dryRun&&params.removed.some(entry=>entry.startsWith("transactions/"))&&guidance.push("Aged terminal workspace-transaction journals were removed; replaying those transactionIds re-executes their idempotent steps instead of short-circuiting."),guidance}async function runGc(global2,options={}){const pmRoot=resolvePmRoot(process.cwd(),global2.path);await assertInitializedTracker(pmRoot);const settings=await readSettings(pmRoot),dryRun=options.dryRun===!0,scopes=parseScopes(options.scope),selectedTargets=GC_TARGETS.filter(target=>scopes.includes(target.scope)),removed=[],retained=[],warnings=[];for(const target of selectedTargets){const result=await removeCacheFile(pmRoot,target,dryRun);result.removed?removed.push(target.relativePath):retained.push(target.relativePath),warnings.push(...result.warnings)}if(scopes.includes("runtime")){const snapshotTempResult=await sweepWorkspaceSnapshotTemps(pmRoot,dryRun);removed.push(...snapshotTempResult.removed),retained.push(...snapshotTempResult.retained),warnings.push(...snapshotTempResult.warnings)}let locksSummary;if(scopes.includes("locks")){const lockResult=await runLockGc(pmRoot,{dryRun,hooks:{onRead:lockPath=>runActiveOnReadHooks({path:lockPath,scope:"project"}),onWrite:lockPath=>runActiveOnWriteHooks({path:lockPath,scope:"project",op:"gc:lock_remove"})}});removed.push(...lockResult.removed),retained.push(...lockResult.retained),warnings.push(...lockResult.warnings),locksSummary={scanned:lockResult.scanned,removed:lockResult.removed.length,retained:lockResult.retained.length}}let transactionsSummary;if(scopes.includes("transactions")){const retentionDays=settings.checkpoints.retention_days,transactionResult=await runWorkspaceTransactionGc(pmRoot,{dryRun,retentionDays,hooks:{onRead:journalPath=>runActiveOnReadHooks({path:journalPath,scope:"project"}),onWrite:journalPath=>runActiveOnWriteHooks({path:journalPath,scope:"project",op:"gc:transaction_journal_remove"})}});removed.push(...transactionResult.removed),retained.push(...transactionResult.retained),warnings.push(...transactionResult.warnings),transactionsSummary={scanned:transactionResult.scanned,removed:transactionResult.removed.length,retained:transactionResult.retained.length,retention_days:retentionDays}}let checkpointsSummary;if(scopes.includes("checkpoints")){const retentionDays=settings.checkpoints.retention_days,checkpointResult=await runCheckpointGc(pmRoot,{dryRun,retentionDays,hooks:{onRead:checkpointPath=>runActiveOnReadHooks({path:checkpointPath,scope:"project"}),onWrite:checkpointPath=>runActiveOnWriteHooks({path:checkpointPath,scope:"project",op:"gc:checkpoint_remove"})}});removed.push(...checkpointResult.removed),retained.push(...checkpointResult.retained),warnings.push(...checkpointResult.warnings),checkpointsSummary={scanned:checkpointResult.scanned,removed:checkpointResult.removed.length,retained:checkpointResult.retained.length,retention_days:retentionDays}}warnings.push(...await runActiveOnIndexHooks({mode:dryRun?"gc:dry-run":"gc",total_items:selectedTargets.length}));const guidance=buildGcGuidance({dryRun,scopes,removed});return{ok:warnings.length===0,dry_run:dryRun,scope:scopes,removed,retained,warnings,...locksSummary?{locks:locksSummary}:{},...checkpointsSummary?{checkpoints:checkpointsSummary}:{},...transactionsSummary?{transactions:transactionsSummary}:{},guidance,generated_at:nowIso()}}export{runGc};
 //# sourceMappingURL=gc.js.map

package/dist/sdk/governance/health-merge-evidence.js

@@ -1,2 +1,2 @@
-!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fb0133ea-dd0c-5412-bd4d-440d1c40f055")}catch(e2){}})();import{auditMergeAttributeFence,resolveProjectMergeTypeFolders}from"../merge/install.js";async function resolveMergeFenceHealthEvidence(pmRoot,gitWorkspaceRoot,settings,required){if(gitWorkspaceRoot===null){return{audit:null,count:0,warnings:[]}}const audit=await auditMergeAttributeFence(pmRoot,resolveProjectMergeTypeFolders(settings));if(audit.status==="ok"){return{audit,count:0,warnings:[]}}const count=Math.max(1,audit.missing_patterns.length+audit.stale_patterns.length);return{audit,count,warnings:required?[`merge_fence_${audit.status==="not_installed"?"missing":"drift"}:${count}`]:[]}}function buildMergeReceiptEvidenceWarnings(params){const warnings=[];if(params.invalidEvidenceCount>0){warnings.push(`merge_receipt_evidence_invalid:${params.invalidEvidenceCount}`)}if(params.missingHistoryReferenceCount>0){warnings.push(`merge_receipt_history_reference_missing:${params.missingHistoryReferenceCount}`)}return warnings}export{buildMergeReceiptEvidenceWarnings,resolveMergeFenceHealthEvidence};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2e510b32-f27f-5ba5-94b2-8268343359dc")}catch{}})();import{auditMergeAttributeFence,resolveProjectMergeTypeFolders}from"../merge/install.js";async function resolveMergeFenceHealthEvidence(pmRoot,gitWorkspaceRoot,settings,required){if(gitWorkspaceRoot===null)return{audit:null,count:0,warnings:[]};const audit=await auditMergeAttributeFence(pmRoot,resolveProjectMergeTypeFolders(settings));if(audit.status==="ok")return{audit,count:0,warnings:[]};const count=Math.max(1,audit.missing_patterns.length+audit.stale_patterns.length);return{audit,count,warnings:required?[`merge_fence_${audit.status==="not_installed"?"missing":"drift"}:${count}`]:[]}}function buildMergeReceiptEvidenceWarnings(params){const warnings=[];return params.invalidEvidenceCount>0&&warnings.push(`merge_receipt_evidence_invalid:${params.invalidEvidenceCount}`),params.missingHistoryReferenceCount>0&&warnings.push(`merge_receipt_history_reference_missing:${params.missingHistoryReferenceCount}`),warnings}export{buildMergeReceiptEvidenceWarnings,resolveMergeFenceHealthEvidence};
 //# sourceMappingURL=health-merge-evidence.js.map