@unbrained/pm-cli 2026.9.7 → 2026.9.9

package/dist/sdk/governance/defect-recurrence.js

@@ -1,624 +1,2 @@
-/**
- * @module sdk/defect-recurrence
- *
- * Compiles versioned defect-recurrence policy into an incremental index and
- * explains which local and hosted checks a proposed change must run.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e3a44417-3835-504e-9ccd-0fef674b437c")}catch(e){}}();
-import { createHash } from "node:crypto";
-import { stableStringify } from "../../core/shared/serialization.js";
-import { defectRecurrenceItemSignals } from "./defect-recurrence-signals.js";
-import { buildDefectRecurrenceGraph, readDefectRecurrenceRecord, } from "./defect-recurrence-graph.js";
-/** Stable defect escape taxonomy used by project policy and PM metadata. */
-export const DEFECT_ESCAPE_CLASSES = [
-    "production_defect",
-    "nightly_regression",
-    "scanner_finding",
-    "review_caught_late",
-];
-/** Evidence dispositions accepted by the fail-closed defect gate. */
-export const DEFECT_GATE_EVIDENCE_DISPOSITIONS = [
-    "gate_added",
-    "gate_strengthened",
-    "explicit_waiver",
-];
-const MAX_FILE_PATTERN_LENGTH = 256;
-const MAX_COMPILED_PATH_PATTERNS = 1_024;
-const compiledPathPatterns = new Map();
-const CHANGE_INPUT_FIELDS = [
-    "files",
-    "package_names",
-    "item_ids",
-    "tags",
-    "error_codes",
-];
-function uniqueSorted(values) {
-    return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((left, right) => (left < right ? -1 : 1));
-}
-function fingerprint(value) {
-    return createHash("sha256").update(stableStringify(value)).digest("hex");
-}
-function assertNonEmpty(value, field) {
-    if (typeof value !== "string" || !value.trim()) {
-        throw new TypeError(`${field} must be a non-empty string`);
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isStringArray(value) {
-    return (Array.isArray(value) && value.every((entry) => typeof entry === "string"));
-}
-function assertChangeInput(value, field) {
-    if (!isRecord(value))
-        throw new TypeError(`${field} must be an object`);
-    for (const key of CHANGE_INPUT_FIELDS) {
-        if (value[key] !== undefined && !isStringArray(value[key])) {
-            throw new TypeError(`${field}.${key} must be an array of strings`);
-        }
-    }
-    return value;
-}
-function assertTriggers(value, familyId) {
-    if (!isRecord(value)) {
-        throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`);
-    }
-    for (const key of [
-        "package_names",
-        "item_ids",
-        "tags",
-        "error_codes",
-    ]) {
-        if (value[key] !== undefined && !isStringArray(value[key])) {
-            throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`);
-        }
-    }
-    const filePatterns = value.file_patterns;
-    if (filePatterns !== undefined && !isStringArray(filePatterns)) {
-        throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`);
-    }
-    for (const pattern of filePatterns ?? []) {
-        if (pattern.length > MAX_FILE_PATTERN_LENGTH) {
-            throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`);
-        }
-    }
-}
-/** Validate stable identity fields and reject duplicate family ids. */
-function assertFamilyIdentity(family, ids) {
-    assertNonEmpty(family.id, "defect recurrence family id");
-    if (ids.has(family.id)) {
-        throw new TypeError(`Duplicate defect recurrence family ${family.id}`);
-    }
-    ids.add(family.id);
-    if (!Number.isInteger(family.version) || family.version < 1) {
-        throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`);
-    }
-    if (!DEFECT_ESCAPE_CLASSES.includes(family.escape_class)) {
-        throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`);
-    }
-    assertNonEmpty(family.title, `defect recurrence family ${family.id} title`);
-    assertNonEmpty(family.owner_item_id, `defect recurrence family ${family.id} owner_item_id`);
-}
-/** Validate historical lineage and executable local and hosted check references. */
-function assertFamilyEvidenceContracts(family) {
-    if (!isStringArray(family.historical_item_ids) ||
-        family.historical_item_ids.length === 0 ||
-        family.historical_item_ids.some((itemId) => !itemId.trim())) {
-        throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`);
-    }
-    assertTriggers(family.triggers, family.id);
-    if (!isRecord(family.checks) ||
-        !isStringArray(family.checks.local) ||
-        !isStringArray(family.checks.hosted) ||
-        family.checks.local.length === 0 ||
-        family.checks.hosted.length === 0 ||
-        family.checks.local.some((check) => !check.trim()) ||
-        family.checks.hosted.some((check) => !check.trim())) {
-        throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`);
-    }
-}
-/** Validate finite normalized escape and false-positive budgets. */
-function assertFamilyBudget(family) {
-    if (!isRecord(family.budget) ||
-        typeof family.budget.max_escape_rate !== "number" ||
-        !Number.isFinite(family.budget.max_escape_rate) ||
-        typeof family.budget.max_false_positive_rate !== "number" ||
-        !Number.isFinite(family.budget.max_false_positive_rate)) {
-        throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`);
-    }
-    if (family.budget.max_escape_rate < 0 ||
-        family.budget.max_escape_rate > 1 ||
-        family.budget.max_false_positive_rate < 0 ||
-        family.budget.max_false_positive_rate > 1) {
-        throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`);
-    }
-}
-/** Validate that a structurally safe negative control selects its own family. */
-function assertFamilyNegativeControl(family) {
-    const negativeControl = assertChangeInput(family.negative_control, `defect recurrence family ${family.id} negative_control`);
-    if (familyReasons(family, negativeControl, {}).length === 0) {
-        throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`);
-    }
-}
-/** Validate the complete recurrence policy before indexing or analysis. */
-function validatePolicy(policy) {
-    if (policy.version !== 1) {
-        throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`);
-    }
-    if (typeof policy.evidence_epoch !== "string" ||
-        !Number.isFinite(Date.parse(policy.evidence_epoch))) {
-        throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp");
-    }
-    const ids = new Set();
-    for (const family of policy.families) {
-        if (!isRecord(family))
-            throw new TypeError("defect recurrence family must be an object");
-        assertFamilyIdentity(family, ids);
-        assertFamilyEvidenceContracts(family);
-        assertFamilyBudget(family);
-        assertFamilyNegativeControl(family);
-    }
-}
-function pathMatches(pattern, value) {
-    let compiled = compiledPathPatterns.get(pattern);
-    if (compiled === undefined) {
-        if (compiledPathPatterns.size >= MAX_COMPILED_PATH_PATTERNS) {
-            const oldest = compiledPathPatterns.keys().next().value;
-            compiledPathPatterns.delete(oldest);
-        }
-        const escaped = pattern
-            .replaceAll("**", "\u0000")
-            .replaceAll(/[|\\{}()[\]^$+?./]/gu, "\\$&")
-            .replaceAll("*", "[^/]*")
-            .replaceAll("\u0000", ".*");
-        compiled = new RegExp(`^${escaped}$`, "u");
-        compiledPathPatterns.set(pattern, compiled);
-    }
-    return compiled.test(value);
-}
-function fileReasons(family, input) {
-    const reasons = [];
-    const patterns = uniqueSorted(family.triggers.file_patterns ?? []);
-    for (const file of uniqueSorted(input.files ?? [])) {
-        for (const pattern of patterns) {
-            if (pathMatches(pattern, file))
-                reasons.push({ signal: "file", value: file, matched: pattern });
-        }
-    }
-    return reasons;
-}
-function exactReasons(family, input) {
-    const exactSignals = [
-        {
-            signal: "package",
-            values: uniqueSorted(input.package_names ?? []),
-            triggers: uniqueSorted(family.triggers.package_names ?? []),
-        },
-        {
-            signal: "tag",
-            values: uniqueSorted(input.tags ?? []),
-            triggers: uniqueSorted(family.triggers.tags ?? []),
-        },
-        {
-            signal: "error_code",
-            values: uniqueSorted(input.error_codes ?? []),
-            triggers: uniqueSorted(family.triggers.error_codes ?? []),
-        },
-    ];
-    const reasons = [];
-    for (const exact of exactSignals) {
-        const triggerSet = new Set(exact.triggers);
-        for (const value of exact.values) {
-            if (triggerSet.has(value))
-                reasons.push({ signal: exact.signal, value, matched: value });
-        }
-    }
-    return reasons;
-}
-/** Explain item-trigger matches from explicit policy IDs or inherited index membership. */
-function itemReasons(family, input, itemFamilies) {
-    const directItemIds = new Set(family.triggers.item_ids ?? []);
-    return uniqueSorted(input.item_ids ?? []).flatMap((itemId) => directItemIds.has(itemId) ||
-        (Object.hasOwn(itemFamilies, itemId) &&
-            itemFamilies[itemId].includes(family.id))
-        ? [{ signal: "item", value: itemId, matched: family.id }]
-        : []);
-}
-/** Collect direct policy matches without sorting intermediate selection-only results. */
-function familyReasons(family, input, itemFamilies) {
-    return [
-        ...fileReasons(family, input),
-        ...exactReasons(family, input),
-        ...itemReasons(family, input, itemFamilies),
-    ];
-}
-function readRiskCursorOffset(cursor, indexFingerprint) {
-    if (!cursor)
-        return 0;
-    let parsed;
-    try {
-        parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-    }
-    catch {
-        throw new TypeError("defect change-risk cursor is invalid");
-    }
-    if (typeof parsed !== "object" ||
-        parsed === null ||
-        Array.isArray(parsed) ||
-        parsed.index_fingerprint !==
-            indexFingerprint ||
-        !Number.isInteger(parsed.offset) ||
-        parsed.offset < 0) {
-        throw new TypeError("defect change-risk cursor does not match this index");
-    }
-    return parsed.offset;
-}
-function changeSignalCount(input) {
-    return [
-        input.files,
-        input.package_names,
-        input.item_ids,
-        input.tags,
-        input.error_codes,
-    ].reduce((total, values) => total + (values?.length ?? 0), 0);
-}
-/** Apply registered lineage membership to item and exact linked-file risk triggers. */
-function inheritRecurrenceFamilies(families, recurrenceRecords, itemFamilies) {
-    const graph = buildDefectRecurrenceGraph(families, recurrenceRecords);
-    const fileFamilies = new Map();
-    for (const lineage of graph.lineages) {
-        if (lineage.family_ids.length === 0)
-            continue;
-        for (const id of lineage.item_ids) {
-            itemFamilies[id] = uniqueSorted([
-                ...(Object.hasOwn(itemFamilies, id) ? itemFamilies[id] : []),
-                ...lineage.family_ids,
-            ]);
-            for (const file of recurrenceRecords.get(id)?.files ?? []) {
-                const matched = fileFamilies.get(file) ?? new Set();
-                for (const familyId of lineage.family_ids)
-                    matched.add(familyId);
-                fileFamilies.set(file, matched);
-            }
-        }
-    }
-    return fileFamilies;
-}
-/** Refresh changed sparse records, deleting evidence no longer present on an item. */
-function refreshRecurrenceRecords(recurrenceRecords, items) {
-    for (const item of items) {
-        const record = readDefectRecurrenceRecord(item);
-        if (record === undefined)
-            recurrenceRecords.delete(item.id);
-        else
-            recurrenceRecords.set(item.id, record);
-    }
-}
-/** Compile exact identifier contributions once rather than expanding every family per item. */
-function compileDirectItemSeeds(families) {
-    const historical = new Map();
-    const triggers = new Map();
-    for (const family of families) {
-        for (const [index, ids] of [
-            [historical, family.historical_item_ids],
-            [triggers, family.triggers.item_ids ?? []],
-        ]) {
-            for (const id of ids) {
-                const matches = index.get(id) ?? new Set();
-                matches.add(family.id);
-                index.set(id, matches);
-            }
-        }
-    }
-    return { historical, triggers };
-}
-/** Match identifier-only items without allocating per-family explanation records. */
-function directItemMatches(item, families, seeds) {
-    const signals = defectRecurrenceItemSignals(item);
-    const hasContext = [
-        signals.files,
-        signals.package_names,
-        signals.tags,
-        signals.error_codes,
-    ].some((values) => values && values.length > 0);
-    if (hasContext) {
-        return families
-            .filter((family) => family.historical_item_ids.includes(item.id) ||
-            familyReasons(family, signals, {}).length > 0)
-            .map((family) => family.id);
-    }
-    return uniqueSorted([
-        ...(seeds.historical.get(item.id) ?? []),
-        ...(seeds.triggers.get(item.id.trim()) ?? []),
-    ]);
-}
-/** Compile deterministic policy and PM metadata into a sparse incremental index. */
-export function buildDefectRecurrenceIndex(policy, items, options = {}) {
-    validatePolicy(policy);
-    const families = [...policy.families].sort((left, right) => left.id < right.id ? -1 : 1);
-    const policyFingerprint = fingerprint({ ...policy, families });
-    const changed = new Set(options.changed_item_ids ?? []);
-    const canReuse = options.previous_index?.policy_fingerprint === policyFingerprint;
-    const itemFamilies = Object.assign(Object.create(null), canReuse
-        ? Object.fromEntries(Object.entries(options.previous_index?.direct_item_families ??
-            options.previous_index?.item_families ??
-            {}).filter(([itemId]) => !changed.has(itemId)))
-        : {});
-    const itemsReused = canReuse ? Object.keys(itemFamilies).length : 0;
-    const seeds = compileDirectItemSeeds(families);
-    for (const item of items) {
-        const matched = directItemMatches(item, families, seeds);
-        if (matched.length > 0)
-            itemFamilies[item.id] = matched;
-        else
-            delete itemFamilies[item.id];
-    }
-    const directItemFamilies = Object.fromEntries(Object.entries(itemFamilies).sort(([left], [right]) => left < right ? -1 : 1));
-    const recurrenceRecords = new Map(canReuse
-        ? Object.entries(options.previous_index?.recurrence_records ?? {}).filter(([id]) => !changed.has(id))
-        : []);
-    refreshRecurrenceRecords(recurrenceRecords, items);
-    const fileFamilies = inheritRecurrenceFamilies(families, recurrenceRecords, itemFamilies);
-    const sortedRecords = Object.fromEntries([...recurrenceRecords].sort(([left], [right]) => (left < right ? -1 : 1)));
-    const sortedFileFamilies = Object.fromEntries([...fileFamilies]
-        .sort(([left], [right]) => (left < right ? -1 : 1))
-        .map(([file, matches]) => [file, [...matches].sort()]));
-    const sortedItemFamilies = Object.fromEntries(Object.entries(itemFamilies)
-        .sort(([left], [right]) => (left < right ? -1 : 1))
-        .map(([itemId, familyIds]) => [itemId, uniqueSorted(familyIds)]));
-    return {
-        version: 1,
-        policy_fingerprint: policyFingerprint,
-        index_fingerprint: fingerprint({
-            policy_fingerprint: policyFingerprint,
-            item_families: sortedItemFamilies,
-            direct_item_families: directItemFamilies,
-            recurrence_records: sortedRecords,
-            file_families: sortedFileFamilies,
-        }),
-        families,
-        item_families: sortedItemFamilies,
-        direct_item_families: directItemFamilies,
-        recurrence_records: sortedRecords,
-        file_families: sortedFileFamilies,
-        build: {
-            items_scanned: items.length,
-            items_reused: itemsReused,
-            items_indexed: Object.keys(sortedItemFamilies).length,
-        },
-    };
-}
-/** Explain recurrence families and shared local/hosted checks for one change. */
-export function analyzeDefectChangeRisk(index, input, options = {}) {
-    const limit = options.limit ?? 25;
-    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
-        throw new TypeError("defect change-risk limit must be an integer from 1 through 100");
-    }
-    const offset = readRiskCursorOffset(options.cursor, index.index_fingerprint);
-    const matches = index.families.flatMap((family) => {
-        const reasons = familyReasons(family, input, index.item_families);
-        for (const file of uniqueSorted(input.files ?? [])) {
-            if (index.file_families &&
-                Object.hasOwn(index.file_families, file) &&
-                index.file_families[file].includes(family.id)) {
-                reasons.push({
-                    signal: "file",
-                    value: file,
-                    matched: `recurs_from:${family.id}`,
-                });
-            }
-        }
-        reasons.sort((left, right) => left.signal !== right.signal
-            ? left.signal.localeCompare(right.signal)
-            : left.value !== right.value
-                ? left.value.localeCompare(right.value)
-                : left.matched.localeCompare(right.matched));
-        return reasons.length === 0
-            ? []
-            : [
-                {
-                    family_id: family.id,
-                    family_version: family.version,
-                    owner_item_id: family.owner_item_id,
-                    escape_class: family.escape_class,
-                    reasons,
-                    local_checks: uniqueSorted(family.checks.local),
-                    hosted_checks: uniqueSorted(family.checks.hosted),
-                    budget: family.budget,
-                },
-            ];
-    });
-    const page = matches.slice(offset, offset + limit);
-    const nextOffset = offset + page.length;
-    const nextCursor = nextOffset < matches.length
-        ? Buffer.from(JSON.stringify({
-            index_fingerprint: index.index_fingerprint,
-            offset: nextOffset,
-        })).toString("base64url")
-        : undefined;
-    const reportWithoutCost = {
-        risk_detected: matches.length > 0,
-        index_fingerprint: index.index_fingerprint,
-        items: page,
-        total: matches.length,
-        ...(nextCursor ? { next_cursor: nextCursor } : {}),
-        required_local_checks: uniqueSorted(matches.flatMap((match) => match.local_checks)),
-        required_hosted_checks: uniqueSorted(matches.flatMap((match) => match.hosted_checks)),
-        row_contract: {
-            row_keys: ["items"],
-            jq_selector: ".items[]",
-        },
-    };
-    return {
-        ...reportWithoutCost,
-        cost: {
-            families_evaluated: index.families.length,
-            signals_evaluated: changeSignalCount(input),
-            families_selected: matches.length,
-            estimated_output_tokens: Math.ceil(JSON.stringify(reportWithoutCost).length / 4),
-        },
-    };
-}
-function isDefectItem(item) {
-    return ((typeof item.type === "string" && item.type.toLowerCase() === "issue") ||
-        (Array.isArray(item.tags) ? item.tags : []).some((tag) => typeof tag === "string" &&
-            ["bug", "defect", "security"].includes(tag.toLowerCase())));
-}
-function nonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function nonEmptyStringArray(value) {
-    return (Array.isArray(value) && value.length > 0 && value.every(nonEmptyString));
-}
-function validEvidence(value, nowMs) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        return { valid: false, expired: false };
-    }
-    const evidence = value;
-    if (!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition) ||
-        typeof evidence.owner !== "string" ||
-        !evidence.owner.trim()) {
-        return { valid: false, expired: false };
-    }
-    if (evidence.disposition === "explicit_waiver") {
-        const expiry = Date.parse(evidence.waiver_expires_at ?? "");
-        return {
-            valid: nonEmptyString(evidence.waiver_reason) &&
-                Number.isFinite(expiry) &&
-                expiry >= nowMs,
-            expired: Number.isFinite(expiry) && expiry < nowMs,
-        };
-    }
-    return {
-        valid: nonEmptyString(evidence.gate_id) &&
-            nonEmptyString(evidence.negative_control) &&
-            nonEmptyStringArray(evidence.local_checks) &&
-            nonEmptyStringArray(evidence.hosted_checks),
-        expired: false,
-    };
-}
-function evidenceFindings(item, nowMs) {
-    const findings = [];
-    if (!Number.isFinite(Date.parse(typeof item.completed_at === "string" ? item.completed_at : "")) &&
-        !Number.isFinite(Date.parse(typeof item.closed_at === "string" ? item.closed_at : ""))) {
-        findings.push({
-            item_id: item.id,
-            kind: "invalid_completion_timestamp",
-            detail: `${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`,
-        });
-    }
-    if (typeof item.escape_class !== "string") {
-        findings.push({
-            item_id: item.id,
-            kind: "missing_escape_class",
-            detail: `${item.id} requires escape_class after the defect-evidence epoch.`,
-        });
-    }
-    else if (!DEFECT_ESCAPE_CLASSES.includes(item.escape_class)) {
-        findings.push({
-            item_id: item.id,
-            kind: "invalid_escape_class",
-            detail: `${item.id} has unsupported escape_class ${item.escape_class}.`,
-        });
-    }
-    if (item.gate_evidence === undefined) {
-        findings.push({
-            item_id: item.id,
-            kind: "missing_gate_evidence",
-            detail: `${item.id} requires structured gate_evidence after the defect-evidence epoch.`,
-        });
-        return findings;
-    }
-    const result = validEvidence(item.gate_evidence, nowMs);
-    if (!result.valid) {
-        findings.push({
-            item_id: item.id,
-            kind: result.expired ? "expired_waiver" : "invalid_gate_evidence",
-            detail: result.expired
-                ? `${item.id} carries an expired gate-evidence waiver.`
-                : `${item.id} gate_evidence does not prove a gate or explicit waiver.`,
-        });
-    }
-    return findings;
-}
-/** Enforce structured escape classification and gate evidence on new terminal defects. */
-export function evaluateDefectGateEvidence(items, policy, terminalStatuses, now = new Date()) {
-    validatePolicy(policy);
-    const epochMs = Date.parse(policy.evidence_epoch);
-    const terminal = new Set(terminalStatuses);
-    const terminalDefects = items.filter((item) => terminal.has(item.status) && isDefectItem(item));
-    const governed = terminalDefects.filter((item) => {
-        const completedAt = Date.parse(typeof item.completed_at === "string" ? item.completed_at : "");
-        if (Number.isFinite(completedAt))
-            return completedAt >= epochMs;
-        const closedAt = Date.parse(typeof item.closed_at === "string" ? item.closed_at : "");
-        if (Number.isFinite(closedAt))
-            return closedAt >= epochMs;
-        const createdAt = Date.parse(typeof item.created_at === "string" ? item.created_at : "");
-        return !Number.isFinite(createdAt) || createdAt >= epochMs;
-    });
-    const classCounts = Object.fromEntries(DEFECT_ESCAPE_CLASSES.map((escapeClass) => [escapeClass, 0]));
-    const evidenceDispositionCounts = Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map((disposition) => [disposition, 0]));
-    const classified = terminalDefects.filter((item) => typeof item.escape_class === "string" &&
-        DEFECT_ESCAPE_CLASSES.includes(item.escape_class));
-    for (const item of classified) {
-        classCounts[item.escape_class] += 1;
-        if (typeof item.gate_evidence === "object" &&
-            item.gate_evidence !== null &&
-            !Array.isArray(item.gate_evidence)) {
-            const disposition = item.gate_evidence
-                .disposition;
-            if (typeof disposition === "string" &&
-                DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)) {
-                evidenceDispositionCounts[disposition] += 1;
-            }
-        }
-    }
-    const findings = governed.flatMap((item) => evidenceFindings(item, now.getTime()));
-    findings.sort((left, right) => left.item_id !== right.item_id
-        ? left.item_id.localeCompare(right.item_id)
-        : left.kind.localeCompare(right.kind));
-    return {
-        ok: findings.length === 0,
-        governed_item_count: governed.length,
-        classified_item_count: classified.length,
-        class_counts: classCounts,
-        evidence_disposition_counts: evidenceDispositionCounts,
-        findings,
-    };
-}
-/** Parse an untrusted serialized policy without weakening runtime validation. */
-export function parseDefectRecurrencePolicy(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new TypeError("defect recurrence policy must be an object");
-    }
-    const policy = value;
-    if (!Array.isArray(policy.families)) {
-        throw new TypeError("defect recurrence policy families must be an array");
-    }
-    validatePolicy(policy);
-    return policy;
-}
-/** Parse an untrusted cross-transport change-risk request. */
-export function parseDefectChangeRiskRequest(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new TypeError("defect change-risk request must be an object");
-    }
-    const request = value;
-    const change = assertChangeInput(request.change, "defect change-risk request.change");
-    if (request.cursor !== undefined && typeof request.cursor !== "string") {
-        throw new TypeError("defect change-risk request.cursor must be a string");
-    }
-    if (request.limit !== undefined && !Number.isInteger(request.limit)) {
-        throw new TypeError("defect change-risk request.limit must be an integer");
-    }
-    return {
-        policy: parseDefectRecurrencePolicy(request.policy),
-        change,
-        ...(request.cursor === undefined ? {} : { cursor: request.cursor }),
-        ...(request.limit === undefined ? {} : { limit: request.limit }),
-    };
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12a0ee7f-508d-5e6e-b59d-24bc0aba22aa")}catch(e2){}})();import{createHash}from"node:crypto";import{stableStringify}from"../../core/shared/serialization.js";import{defectRecurrenceItemSignals}from"./defect-recurrence-signals.js";import{buildDefectRecurrenceGraph,readDefectRecurrenceRecord}from"./defect-recurrence-graph.js";const DEFECT_ESCAPE_CLASSES=["production_defect","nightly_regression","scanner_finding","review_caught_late"];const DEFECT_GATE_EVIDENCE_DISPOSITIONS=["gate_added","gate_strengthened","explicit_waiver"];const MAX_FILE_PATTERN_LENGTH=256;const MAX_COMPILED_PATH_PATTERNS=1024;const compiledPathPatterns=new Map;const CHANGE_INPUT_FIELDS=["files","package_names","item_ids","tags","error_codes"];function uniqueSorted(values){return[...new Set(values.map(value=>value.trim()).filter(Boolean))].sort((left,right)=>left<right?-1:1)}function fingerprint(value){return createHash("sha256").update(stableStringify(value)).digest("hex")}function assertNonEmpty(value,field){if(typeof value!=="string"||!value.trim()){throw new TypeError(`${field} must be a non-empty string`)}}function isRecord(value){return typeof value==="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(entry=>typeof entry==="string")}function assertChangeInput(value,field){if(!isRecord(value))throw new TypeError(`${field} must be an object`);for(const key of CHANGE_INPUT_FIELDS){if(value[key]!==void 0&&!isStringArray(value[key])){throw new TypeError(`${field}.${key} must be an array of strings`)}}return value}function assertTriggers(value,familyId){if(!isRecord(value)){throw new TypeError(`defect recurrence family ${familyId} triggers must be an object`)}for(const key of["package_names","item_ids","tags","error_codes"]){if(value[key]!==void 0&&!isStringArray(value[key])){throw new TypeError(`defect recurrence family ${familyId} triggers.${key} must be an array of strings`)}}const filePatterns=value.file_patterns;if(filePatterns!==void 0&&!isStringArray(filePatterns)){throw new TypeError(`defect recurrence family ${familyId} triggers.file_patterns must be an array of strings`)}for(const pattern of filePatterns??[]){if(pattern.length>MAX_FILE_PATTERN_LENGTH){throw new TypeError(`defect recurrence family ${familyId} file pattern exceeds ${MAX_FILE_PATTERN_LENGTH} characters`)}}}function assertFamilyIdentity(family,ids){assertNonEmpty(family.id,"defect recurrence family id");if(ids.has(family.id)){throw new TypeError(`Duplicate defect recurrence family ${family.id}`)}ids.add(family.id);if(!Number.isInteger(family.version)||family.version<1){throw new TypeError(`defect recurrence family ${family.id} version must be a positive integer`)}if(!DEFECT_ESCAPE_CLASSES.includes(family.escape_class)){throw new TypeError(`defect recurrence family ${family.id} has an invalid escape class`)}assertNonEmpty(family.title,`defect recurrence family ${family.id} title`);assertNonEmpty(family.owner_item_id,`defect recurrence family ${family.id} owner_item_id`)}function assertFamilyEvidenceContracts(family){if(!isStringArray(family.historical_item_ids)||family.historical_item_ids.length===0||family.historical_item_ids.some(itemId=>!itemId.trim())){throw new TypeError(`defect recurrence family ${family.id} requires historical_item_ids`)}assertTriggers(family.triggers,family.id);if(!isRecord(family.checks)||!isStringArray(family.checks.local)||!isStringArray(family.checks.hosted)||family.checks.local.length===0||family.checks.hosted.length===0||family.checks.local.some(check=>!check.trim())||family.checks.hosted.some(check=>!check.trim())){throw new TypeError(`defect recurrence family ${family.id} checks must contain nonempty local and hosted string arrays`)}}function assertFamilyBudget(family){if(!isRecord(family.budget)||typeof family.budget.max_escape_rate!=="number"||!Number.isFinite(family.budget.max_escape_rate)||typeof family.budget.max_false_positive_rate!=="number"||!Number.isFinite(family.budget.max_false_positive_rate)){throw new TypeError(`defect recurrence family ${family.id} requires numeric budgets`)}if(family.budget.max_escape_rate<0||family.budget.max_escape_rate>1||family.budget.max_false_positive_rate<0||family.budget.max_false_positive_rate>1){throw new TypeError(`defect recurrence family ${family.id} budgets must be between 0 and 1`)}}function assertFamilyNegativeControl(family){const negativeControl=assertChangeInput(family.negative_control,`defect recurrence family ${family.id} negative_control`);if(familyReasons(family,negativeControl,{}).length===0){throw new TypeError(`defect recurrence family ${family.id} negative_control must select its own family`)}}function validatePolicy(policy){if(policy.version!==1){throw new TypeError(`Unsupported defect recurrence policy version ${policy.version}`)}if(typeof policy.evidence_epoch!=="string"||!Number.isFinite(Date.parse(policy.evidence_epoch))){throw new TypeError("defect recurrence evidence_epoch must be an ISO timestamp")}const ids=new Set;for(const family of policy.families){if(!isRecord(family))throw new TypeError("defect recurrence family must be an object");assertFamilyIdentity(family,ids);assertFamilyEvidenceContracts(family);assertFamilyBudget(family);assertFamilyNegativeControl(family)}}function pathMatches(pattern,value){let compiled=compiledPathPatterns.get(pattern);if(compiled===void 0){if(compiledPathPatterns.size>=MAX_COMPILED_PATH_PATTERNS){const oldest=compiledPathPatterns.keys().next().value;compiledPathPatterns.delete(oldest)}const escaped=pattern.replaceAll("**","\0").replaceAll(/[|\\{}()[\]^$+?./]/gu,"\\$&").replaceAll("*","[^/]*").replaceAll("\0",".*");compiled=new RegExp(`^${escaped}$`,"u");compiledPathPatterns.set(pattern,compiled)}return compiled.test(value)}function fileReasons(family,input){const reasons=[];const patterns=uniqueSorted(family.triggers.file_patterns??[]);for(const file of uniqueSorted(input.files??[])){for(const pattern of patterns){if(pathMatches(pattern,file))reasons.push({signal:"file",value:file,matched:pattern})}}return reasons}function exactReasons(family,input){const exactSignals=[{signal:"package",values:uniqueSorted(input.package_names??[]),triggers:uniqueSorted(family.triggers.package_names??[])},{signal:"tag",values:uniqueSorted(input.tags??[]),triggers:uniqueSorted(family.triggers.tags??[])},{signal:"error_code",values:uniqueSorted(input.error_codes??[]),triggers:uniqueSorted(family.triggers.error_codes??[])}];const reasons=[];for(const exact of exactSignals){const triggerSet=new Set(exact.triggers);for(const value of exact.values){if(triggerSet.has(value))reasons.push({signal:exact.signal,value,matched:value})}}return reasons}function itemReasons(family,input,itemFamilies){const directItemIds=new Set(family.triggers.item_ids??[]);return uniqueSorted(input.item_ids??[]).flatMap(itemId=>directItemIds.has(itemId)||Object.hasOwn(itemFamilies,itemId)&&itemFamilies[itemId].includes(family.id)?[{signal:"item",value:itemId,matched:family.id}]:[])}function familyReasons(family,input,itemFamilies){return[...fileReasons(family,input),...exactReasons(family,input),...itemReasons(family,input,itemFamilies)]}function readRiskCursorOffset(cursor,indexFingerprint){if(!cursor)return 0;let parsed;try{parsed=JSON.parse(Buffer.from(cursor,"base64url").toString("utf8"))}catch{throw new TypeError("defect change-risk cursor is invalid")}if(typeof parsed!=="object"||parsed===null||Array.isArray(parsed)||parsed.index_fingerprint!==indexFingerprint||!Number.isInteger(parsed.offset)||parsed.offset<0){throw new TypeError("defect change-risk cursor does not match this index")}return parsed.offset}function changeSignalCount(input){return[input.files,input.package_names,input.item_ids,input.tags,input.error_codes].reduce((total,values)=>total+(values?.length??0),0)}function inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies){const graph=buildDefectRecurrenceGraph(families,recurrenceRecords);const fileFamilies=new Map;for(const lineage of graph.lineages){if(lineage.family_ids.length===0)continue;for(const id of lineage.item_ids){itemFamilies[id]=uniqueSorted([...Object.hasOwn(itemFamilies,id)?itemFamilies[id]:[],...lineage.family_ids]);for(const file of recurrenceRecords.get(id)?.files??[]){const matched=fileFamilies.get(file)??new Set;for(const familyId of lineage.family_ids)matched.add(familyId);fileFamilies.set(file,matched)}}}return fileFamilies}function refreshRecurrenceRecords(recurrenceRecords,items){for(const item of items){const record=readDefectRecurrenceRecord(item);if(record===void 0)recurrenceRecords.delete(item.id);else recurrenceRecords.set(item.id,record)}}function compileDirectItemSeeds(families){const historical=new Map;const triggers=new Map;for(const family of families){for(const[index,ids]of[[historical,family.historical_item_ids],[triggers,family.triggers.item_ids??[]]]){for(const id of ids){const matches=index.get(id)??new Set;matches.add(family.id);index.set(id,matches)}}}return{historical,triggers}}function directItemMatches(item,families,seeds){const signals=defectRecurrenceItemSignals(item);const hasContext=[signals.files,signals.package_names,signals.tags,signals.error_codes].some(values=>values&&values.length>0);if(hasContext){return families.filter(family=>family.historical_item_ids.includes(item.id)||familyReasons(family,signals,{}).length>0).map(family=>family.id)}return uniqueSorted([...seeds.historical.get(item.id)??[],...seeds.triggers.get(item.id.trim())??[]])}function buildDefectRecurrenceIndex(policy,items,options={}){validatePolicy(policy);const families=[...policy.families].sort((left,right)=>left.id<right.id?-1:1);const policyFingerprint=fingerprint({...policy,families});const changed=new Set(options.changed_item_ids??[]);const canReuse=options.previous_index?.policy_fingerprint===policyFingerprint;const itemFamilies=Object.assign(Object.create(null),canReuse?Object.fromEntries(Object.entries(options.previous_index?.direct_item_families??options.previous_index?.item_families??{}).filter(([itemId])=>!changed.has(itemId))):{});const itemsReused=canReuse?Object.keys(itemFamilies).length:0;const seeds=compileDirectItemSeeds(families);for(const item of items){const matched=directItemMatches(item,families,seeds);if(matched.length>0)itemFamilies[item.id]=matched;else delete itemFamilies[item.id]}const directItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1));const recurrenceRecords=new Map(canReuse?Object.entries(options.previous_index?.recurrence_records??{}).filter(([id])=>!changed.has(id)):[]);refreshRecurrenceRecords(recurrenceRecords,items);const fileFamilies=inheritRecurrenceFamilies(families,recurrenceRecords,itemFamilies);const sortedRecords=Object.fromEntries([...recurrenceRecords].sort(([left],[right])=>left<right?-1:1));const sortedFileFamilies=Object.fromEntries([...fileFamilies].sort(([left],[right])=>left<right?-1:1).map(([file,matches])=>[file,[...matches].sort()]));const sortedItemFamilies=Object.fromEntries(Object.entries(itemFamilies).sort(([left],[right])=>left<right?-1:1).map(([itemId,familyIds])=>[itemId,uniqueSorted(familyIds)]));return{version:1,policy_fingerprint:policyFingerprint,index_fingerprint:fingerprint({policy_fingerprint:policyFingerprint,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies}),families,item_families:sortedItemFamilies,direct_item_families:directItemFamilies,recurrence_records:sortedRecords,file_families:sortedFileFamilies,build:{items_scanned:items.length,items_reused:itemsReused,items_indexed:Object.keys(sortedItemFamilies).length}}}function analyzeDefectChangeRisk(index,input,options={}){const limit=options.limit??25;if(!Number.isInteger(limit)||limit<1||limit>100){throw new TypeError("defect change-risk limit must be an integer from 1 through 100")}const offset=readRiskCursorOffset(options.cursor,index.index_fingerprint);const matches=index.families.flatMap(family=>{const reasons=familyReasons(family,input,index.item_families);for(const file of uniqueSorted(input.files??[])){if(index.file_families&&Object.hasOwn(index.file_families,file)&&index.file_families[file].includes(family.id)){reasons.push({signal:"file",value:file,matched:`recurs_from:${family.id}`})}}reasons.sort((left,right)=>left.signal!==right.signal?left.signal.localeCompare(right.signal):left.value!==right.value?left.value.localeCompare(right.value):left.matched.localeCompare(right.matched));return reasons.length===0?[]:[{family_id:family.id,family_version:family.version,owner_item_id:family.owner_item_id,escape_class:family.escape_class,reasons,local_checks:uniqueSorted(family.checks.local),hosted_checks:uniqueSorted(family.checks.hosted),budget:family.budget}]});const page=matches.slice(offset,offset+limit);const nextOffset=offset+page.length;const nextCursor=nextOffset<matches.length?Buffer.from(JSON.stringify({index_fingerprint:index.index_fingerprint,offset:nextOffset})).toString("base64url"):void 0;const reportWithoutCost={risk_detected:matches.length>0,index_fingerprint:index.index_fingerprint,items:page,total:matches.length,...nextCursor?{next_cursor:nextCursor}:{},required_local_checks:uniqueSorted(matches.flatMap(match=>match.local_checks)),required_hosted_checks:uniqueSorted(matches.flatMap(match=>match.hosted_checks)),row_contract:{row_keys:["items"],jq_selector:".items[]"}};return{...reportWithoutCost,cost:{families_evaluated:index.families.length,signals_evaluated:changeSignalCount(input),families_selected:matches.length,estimated_output_tokens:Math.ceil(JSON.stringify(reportWithoutCost).length/4)}}}function isDefectItem(item){return typeof item.type==="string"&&item.type.toLowerCase()==="issue"||(Array.isArray(item.tags)?item.tags:[]).some(tag=>typeof tag==="string"&&["bug","defect","security"].includes(tag.toLowerCase()))}function nonEmptyString(value){return typeof value==="string"&&value.trim().length>0}function nonEmptyStringArray(value){return Array.isArray(value)&&value.length>0&&value.every(nonEmptyString)}function validEvidence(value,nowMs){if(typeof value!=="object"||value===null||Array.isArray(value)){return{valid:false,expired:false}}const evidence=value;if(!DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(evidence.disposition)||typeof evidence.owner!=="string"||!evidence.owner.trim()){return{valid:false,expired:false}}if(evidence.disposition==="explicit_waiver"){const expiry=Date.parse(evidence.waiver_expires_at??"");return{valid:nonEmptyString(evidence.waiver_reason)&&Number.isFinite(expiry)&&expiry>=nowMs,expired:Number.isFinite(expiry)&&expiry<nowMs}}return{valid:nonEmptyString(evidence.gate_id)&&nonEmptyString(evidence.negative_control)&&nonEmptyStringArray(evidence.local_checks)&&nonEmptyStringArray(evidence.hosted_checks),expired:false}}function evidenceFindings(item,nowMs){const findings=[];if(!Number.isFinite(Date.parse(typeof item.completed_at==="string"?item.completed_at:""))&&!Number.isFinite(Date.parse(typeof item.closed_at==="string"?item.closed_at:""))){findings.push({item_id:item.id,kind:"invalid_completion_timestamp",detail:`${item.id} requires a valid completed_at or closed_at timestamp after the defect-evidence epoch.`})}if(typeof item.escape_class!=="string"){findings.push({item_id:item.id,kind:"missing_escape_class",detail:`${item.id} requires escape_class after the defect-evidence epoch.`})}else if(!DEFECT_ESCAPE_CLASSES.includes(item.escape_class)){findings.push({item_id:item.id,kind:"invalid_escape_class",detail:`${item.id} has unsupported escape_class ${item.escape_class}.`})}if(item.gate_evidence===void 0){findings.push({item_id:item.id,kind:"missing_gate_evidence",detail:`${item.id} requires structured gate_evidence after the defect-evidence epoch.`});return findings}const result=validEvidence(item.gate_evidence,nowMs);if(!result.valid){findings.push({item_id:item.id,kind:result.expired?"expired_waiver":"invalid_gate_evidence",detail:result.expired?`${item.id} carries an expired gate-evidence waiver.`:`${item.id} gate_evidence does not prove a gate or explicit waiver.`})}return findings}function evaluateDefectGateEvidence(items,policy,terminalStatuses,now=new Date){validatePolicy(policy);const epochMs=Date.parse(policy.evidence_epoch);const terminal=new Set(terminalStatuses);const terminalDefects=items.filter(item=>terminal.has(item.status)&&isDefectItem(item));const governed=terminalDefects.filter(item=>{const completedAt=Date.parse(typeof item.completed_at==="string"?item.completed_at:"");if(Number.isFinite(completedAt))return completedAt>=epochMs;const closedAt=Date.parse(typeof item.closed_at==="string"?item.closed_at:"");if(Number.isFinite(closedAt))return closedAt>=epochMs;const createdAt=Date.parse(typeof item.created_at==="string"?item.created_at:"");return!Number.isFinite(createdAt)||createdAt>=epochMs});const classCounts=Object.fromEntries(DEFECT_ESCAPE_CLASSES.map(escapeClass=>[escapeClass,0]));const evidenceDispositionCounts=Object.fromEntries(DEFECT_GATE_EVIDENCE_DISPOSITIONS.map(disposition=>[disposition,0]));const classified=terminalDefects.filter(item=>typeof item.escape_class==="string"&&DEFECT_ESCAPE_CLASSES.includes(item.escape_class));for(const item of classified){classCounts[item.escape_class]+=1;if(typeof item.gate_evidence==="object"&&item.gate_evidence!==null&&!Array.isArray(item.gate_evidence)){const disposition=item.gate_evidence.disposition;if(typeof disposition==="string"&&DEFECT_GATE_EVIDENCE_DISPOSITIONS.includes(disposition)){evidenceDispositionCounts[disposition]+=1}}}const findings=governed.flatMap(item=>evidenceFindings(item,now.getTime()));findings.sort((left,right)=>left.item_id!==right.item_id?left.item_id.localeCompare(right.item_id):left.kind.localeCompare(right.kind));return{ok:findings.length===0,governed_item_count:governed.length,classified_item_count:classified.length,class_counts:classCounts,evidence_disposition_counts:evidenceDispositionCounts,findings}}function parseDefectRecurrencePolicy(value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("defect recurrence policy must be an object")}const policy=value;if(!Array.isArray(policy.families)){throw new TypeError("defect recurrence policy families must be an array")}validatePolicy(policy);return policy}function parseDefectChangeRiskRequest(value){if(typeof value!=="object"||value===null||Array.isArray(value)){throw new TypeError("defect change-risk request must be an object")}const request=value;const change=assertChangeInput(request.change,"defect change-risk request.change");if(request.cursor!==void 0&&typeof request.cursor!=="string"){throw new TypeError("defect change-risk request.cursor must be a string")}if(request.limit!==void 0&&!Number.isInteger(request.limit)){throw new TypeError("defect change-risk request.limit must be an integer")}return{policy:parseDefectRecurrencePolicy(request.policy),change,...request.cursor===void 0?{}:{cursor:request.cursor},...request.limit===void 0?{}:{limit:request.limit}}}export{DEFECT_ESCAPE_CLASSES,DEFECT_GATE_EVIDENCE_DISPOSITIONS,analyzeDefectChangeRisk,buildDefectRecurrenceIndex,evaluateDefectGateEvidence,parseDefectChangeRiskRequest,parseDefectRecurrencePolicy};
 //# sourceMappingURL=defect-recurrence.js.map
-//# debugId=e3a44417-3835-504e-9ccd-0fef674b437c