@voltro/plan 0.85.0 → 0.86.0

package/dist/index.js

@@ -1,1034 +1,14 @@
-import { Cause as e, Exit as t, Schema as n, SchemaIssue as r } from "effect";
-//#region src/ids.ts
-var i = /^[A-Z][A-Z0-9]{1,9}$/, a = (e) => {
-	if (!i.test(e)) throw Error(`plan id prefix "${e}" is not 2 to 10 capital letters or digits, starting with a letter`);
-	return {
-		prefix: e,
-		plan: RegExp(`^${e}-PLAN-[0-9]{2}$`),
-		workItem: RegExp(`^${e}-[0-9]{2}-[0-9]{3}$`),
-		acceptance: RegExp(`^${e}-[0-9]{2}-[0-9]{3}-A[0-9]{2}$`),
-		requirement: RegExp(`^${e}-[0-9]{2}-[0-9]{3}-E[0-9]{2}$`),
-		source: RegExp(`^SRC-${e}-[0-9]{2}-[0-9]{3}-[0-9]{3}$`),
-		evidence: RegExp(`^EVD-${e}-[0-9]{2}-[0-9]{3}-[0-9]{3}$`),
-		finding: RegExp(`^FND-${e}-[0-9]{2}-[0-9]{3}-[0-9]{3}$`),
-		adr: RegExp(`^ADR-${e}-[0-9]{3}$`),
-		closureRun: RegExp(`^CLR-${e}-[0-9]{2}-[0-9]{3}$`),
-		certificate: RegExp(`^CRT-${e}-[0-9]{2}-[0-9]{3}$`)
-	};
-}, o = (e) => {
-	let t = /-(?:PLAN-)?([0-9]{2})(?:-|$)/.exec(e);
-	return t === null ? null : t[1];
-}, s = (e, t) => {
-	let n = RegExp(`(?:^|-)(${e.prefix}-[0-9]{2}-[0-9]{3})(?:-|$)`).exec(t);
-	return n === null ? null : n[1];
-}, c = (e) => JSON.stringify(l(e)), l = (e) => {
-	if (Array.isArray(e)) return e.map(l);
-	if (typeof e == "object" && e) {
-		let t = {};
-		for (let n of Object.keys(e).sort()) {
-			let r = e[n];
-			r !== void 0 && (t[n] = l(r));
-		}
-		return t;
-	}
-	return e;
-}, u = new Uint32Array([
-	1116352408,
-	1899447441,
-	3049323471,
-	3921009573,
-	961987163,
-	1508970993,
-	2453635748,
-	2870763221,
-	3624381080,
-	310598401,
-	607225278,
-	1426881987,
-	1925078388,
-	2162078206,
-	2614888103,
-	3248222580,
-	3835390401,
-	4022224774,
-	264347078,
-	604807628,
-	770255983,
-	1249150122,
-	1555081692,
-	1996064986,
-	2554220882,
-	2821834349,
-	2952996808,
-	3210313671,
-	3336571891,
-	3584528711,
-	113926993,
-	338241895,
-	666307205,
-	773529912,
-	1294757372,
-	1396182291,
-	1695183700,
-	1986661051,
-	2177026350,
-	2456956037,
-	2730485921,
-	2820302411,
-	3259730800,
-	3345764771,
-	3516065817,
-	3600352804,
-	4094571909,
-	275423344,
-	430227734,
-	506948616,
-	659060556,
-	883997877,
-	958139571,
-	1322822218,
-	1537002063,
-	1747873779,
-	1955562222,
-	2024104815,
-	2227730452,
-	2361852424,
-	2428436474,
-	2756734187,
-	3204031479,
-	3329325298
-]), d = (e) => {
-	let t = new TextEncoder().encode(e), n = t.length * 8, r = new Uint8Array(t.length + 9 + 63 >> 6 << 6);
-	r.set(t), r[t.length] = 128;
-	let i = new DataView(r.buffer);
-	i.setUint32(r.length - 8, Math.floor(n / 4294967296)), i.setUint32(r.length - 4, n >>> 0);
-	let a = new Uint32Array([
-		1779033703,
-		3144134277,
-		1013904242,
-		2773480762,
-		1359893119,
-		2600822924,
-		528734635,
-		1541459225
-	]), o = /* @__PURE__ */ new Uint32Array(64), s = (e, t) => e >>> t | e << 32 - t;
-	for (let e = 0; e < r.length; e += 64) {
-		for (let t = 0; t < 16; t++) o[t] = i.getUint32(e + t * 4);
-		for (let e = 16; e < 64; e++) {
-			let t = s(o[e - 15], 7) ^ s(o[e - 15], 18) ^ o[e - 15] >>> 3, n = s(o[e - 2], 17) ^ s(o[e - 2], 19) ^ o[e - 2] >>> 10;
-			o[e] = o[e - 16] + t + o[e - 7] + n >>> 0;
-		}
-		let [t, n, r, c, l, d, f, p] = [
-			a[0],
-			a[1],
-			a[2],
-			a[3],
-			a[4],
-			a[5],
-			a[6],
-			a[7]
-		];
-		for (let e = 0; e < 64; e++) {
-			let i = p + (s(l, 6) ^ s(l, 11) ^ s(l, 25)) + (l & d ^ ~l & f) + u[e] + o[e] >>> 0, a = (s(t, 2) ^ s(t, 13) ^ s(t, 22)) + (t & n ^ t & r ^ n & r) >>> 0;
-			p = f, f = d, d = l, l = c + i >>> 0, c = r, r = n, n = t, t = i + a >>> 0;
-		}
-		a[0] = a[0] + t >>> 0, a[1] = a[1] + n >>> 0, a[2] = a[2] + r >>> 0, a[3] = a[3] + c >>> 0, a[4] = a[4] + l >>> 0, a[5] = a[5] + d >>> 0, a[6] = a[6] + f >>> 0, a[7] = a[7] + p >>> 0;
-	}
-	return [...a].map((e) => e.toString(16).padStart(8, "0")).join("");
-}, f = (e) => `sha256:${d(c(e))}`, p = n.String.pipe(n.check(n.isMinLength(1))), m = n.String.pipe(n.check(n.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/))), h = n.String.pipe(n.check(n.isPattern(/^sha256:[a-f0-9]{64}$/))), g = (e) => n.Array(e).pipe(n.check(n.makeFilter((e) => new Set(e).size === e.length || "items are listed twice"))), _ = (e) => n.Array(e).pipe(n.check(n.isMinLength(1))), v = n.String.pipe(n.check(n.isPattern(/^[a-z0-9]+(?:[.:/-][a-z0-9]+)*$/))), y = [
-	"proposed",
-	"ready",
-	"active",
-	"blocked",
-	"verified",
-	"closed"
-], b = [
-	"proposed",
-	"decomposing",
-	"ready",
-	"active",
-	"verifying",
-	"closure-1",
-	"closure-2",
-	"complete"
-], x = [
-	"commit",
-	"typecheck",
-	"unit-test",
-	"integration-test",
-	"e2e",
-	"browser",
-	"schema",
-	"migration",
-	"roundtrip",
-	"documentation",
-	"agent-guide",
-	"template",
-	"security",
-	"privacy",
-	"accessibility",
-	"rights",
-	"operations",
-	"performance",
-	"research",
-	"review",
-	"artifact"
-], ee = [
-	"P0",
-	"P1",
-	"P2",
-	"P3"
-], S = [
-	"architecture",
-	"feature",
-	"framework",
-	"integration",
-	"migration",
-	"operations",
-	"security",
-	"documentation",
-	"research",
-	"tooling"
-], C = (e) => n.String.pipe(n.check(n.isPattern(e))), w = (e) => {
-	let t = e.grammar, r = g(C(t.evidence)), i = n.Struct({
-		id: C(t.source),
-		uri: p,
-		locator: p,
-		excerpt: p,
-		lineHint: n.optional(n.Int.pipe(n.check(n.isGreaterThanOrEqualTo(1)))),
-		contentHash: h,
-		disposition: n.Literals([
-			"owned-by",
-			"referenced-by",
-			"decision",
-			"non-goal"
-		]),
-		targetId: n.optional(n.Union([C(t.workItem), C(t.adr)]))
-	}), a = n.Struct({
-		id: C(t.acceptance),
-		statement: p,
-		status: n.Literals([
-			"pending",
-			"passed",
-			"failed"
-		]),
-		evidenceRefs: r
-	}), o = n.Struct({
-		rationale: p,
-		reviewer: p,
-		expiresAt: m,
-		compensatingControl: p
-	}), s = n.Struct({
-		id: C(t.requirement),
-		statement: p,
-		kinds: _(n.Literals(x)),
-		status: n.Literals([
-			"open",
-			"satisfied",
-			"waived"
-		]),
-		evidenceRefs: r,
-		waiver: n.optional(o)
-	}), c = n.Struct({
-		capabilities: n.Array(p),
-		journeys: n.Array(p),
-		adrs: g(C(t.adr)),
-		risks: n.Array(p),
-		relatedTo: g(C(t.workItem))
-	}), l = n.Struct({
-		reason: p,
-		owner: p,
-		nextAction: p,
-		recheckTrigger: p,
-		since: m
-	}), u = n.Struct({
-		from: n.NullOr(n.Literals(y)),
-		to: n.Literals(y),
-		reason: p,
-		actor: p,
-		at: m,
-		evidenceRefs: r
-	}), d = n.Struct({
-		id: C(t.workItem),
-		title: p,
-		ownerPlan: C(t.plan),
-		slice: p,
-		kind: n.Literals(S),
-		priority: n.Literals(ee),
-		mandatory: n.Boolean,
-		status: n.Literals(y),
-		owners: n.Array(p),
-		repos: _(n.Literals(e.repos)),
-		sourceRefs: _(i),
-		dependsOn: g(C(t.workItem)),
-		links: c,
-		acceptance: _(a),
-		evidenceRequirements: _(s),
-		evidenceRefs: r,
-		impactTags: _(v),
-		statusHistory: _(u),
-		blocker: n.optional(l),
-		supersededBy: n.optional(C(t.workItem)),
-		createdAt: m,
-		updatedAt: m
-	}), f = n.Struct({
-		id: C(t.plan),
-		number: n.String.pipe(n.check(n.isPattern(/^[0-9]{2}$/))),
-		title: p,
-		source: p,
-		sourceRevision: h,
-		status: n.Literals(b),
-		decompositionComplete: n.Boolean,
-		updatedAt: m
-	}), w = n.Struct({
-		rulesVersion: p,
-		sourceRevision: h,
-		blockKinds: n.Array(p),
-		extractedAt: m
-	}), T = n.Struct({
-		extractedSources: n.Int,
-		disposedSources: n.Int,
-		unmatchedSources: n.Int,
-		duplicateSources: n.Int,
-		sourceIdsHash: h,
-		result: n.Literals(["complete", "incomplete"])
-	});
-	return n.Struct({
-		schemaVersion: n.Literal(e.instanceVersion),
-		plan: f,
-		extraction: w,
-		workItems: n.Array(d),
-		coverage: T
-	});
-}, T = (e) => n.Struct({
-	id: C(e.grammar.evidence),
-	kind: n.Literals(x),
-	title: p,
-	uri: p,
-	fingerprint: n.optional(h),
-	result: n.Literals([
-		"passed",
-		"failed",
-		"informational"
-	]),
-	subjectRefs: n.Array(p),
-	command: n.optional(p),
-	environment: n.optional(p),
-	producedBy: p,
-	reviewedBy: n.optional(p),
-	observedAt: m,
-	idempotencyKey: n.optional(p)
-}), E = (e) => n.Struct({
-	id: C(e.grammar.finding),
-	title: p,
-	severity: n.Literals([
-		"critical",
-		"high",
-		"medium",
-		"low"
-	]),
-	status: n.Literals([
-		"open",
-		"resolved",
-		"accepted-risk"
-	]),
-	source: n.Literals([
-		"contract-reconciliation",
-		"adversarial-audit",
-		"test",
-		"incident",
-		"research",
-		"review",
-		"production"
-	]),
-	targetWorkItems: _(C(e.grammar.workItem)),
-	impactTags: n.Array(p),
-	evidenceRefs: n.optional(g(C(e.grammar.evidence))),
-	openedAt: m,
-	resolvedAt: n.optional(m)
-}), D = {
-	security: 0,
-	error: 1,
-	warning: 2
-}, O = (e, t) => (e ?? "") < (t ?? "") ? -1 : +((e ?? "") > (t ?? "")), te = (e) => [...e].sort((e, t) => D[e.severity] - D[t.severity] || O(e.locator.plan, t.locator.plan) || O(e.locator.workItem, t.locator.workItem) || O(e.ruleId, t.ruleId) || O(e.locator.file, t.locator.file) || O(e.locator.path, t.locator.path) || O(e.message, t.message)), ne = (e, t = !1) => e.some((e) => e.severity !== "warning" || t), k = {
-	proposed: ["ready", "blocked"],
-	ready: [
-		"active",
-		"blocked",
-		"proposed"
-	],
-	active: [
-		"blocked",
-		"verified",
-		"ready"
-	],
-	blocked: [
-		"proposed",
-		"ready",
-		"active"
-	],
-	verified: ["closed", "active"],
-	closed: ["active"]
-}, A = /* @__PURE__ */ new Set(["verified", "closed"]), j = (e, t) => {
-	let n = /* @__PURE__ */ new Map();
-	for (let e of t) if (e.status === "open") for (let t of e.targetWorkItems) {
-		let r = n.get(t);
-		r === void 0 ? n.set(t, [e]) : r.push(e);
-	}
-	let r = /* @__PURE__ */ new Map();
-	for (let t of e) for (let e of new Set(t.subjectRefs)) {
-		let n = r.get(e);
-		n === void 0 ? r.set(e, [t]) : n.push(t);
-	}
-	return {
-		evidence: new Map(e.map((e) => [e.id, e])),
-		bySubject: r,
-		openFindings: n
-	};
-}, M = (e, t, n, r) => e.result === "passed" && e.subjectRefs.includes(n) && (r === void 0 || r.includes(e.kind)) && Date.parse(e.observedAt) >= Date.parse(t.updatedAt), N = (e, t, n, r) => {
-	let i = [], a = t.bySubject.get(e.id) ?? [], o;
-	if (e.acceptance.length > 4 || e.acceptance.length + e.evidenceRequirements.length > 4 && e.acceptance.length + e.evidenceRequirements.filter((e) => e.status !== "waived").length > 4) {
-		let t = /* @__PURE__ */ new Set([...e.acceptance.map((e) => e.id), ...e.evidenceRequirements.filter((e) => e.status !== "waived").map((e) => e.id)]);
-		o = /* @__PURE__ */ new Map();
-		let n = Date.parse(e.updatedAt);
-		for (let e of a) if (e.result === "passed" && Date.parse(e.observedAt) >= n) for (let n of e.subjectRefs) {
-			if (!t.has(n)) continue;
-			let r = o.get(n);
-			r === void 0 ? o.set(n, /* @__PURE__ */ new Set([e.kind])) : r.add(e.kind);
-		}
-	}
-	let s = (t, n) => {
-		if (o === void 0) return a.some((r) => M(r, e, t, n));
-		let r = o.get(t);
-		return r !== void 0 && (n === void 0 || n.some((e) => r.has(e)));
-	}, c = (n, r) => n.some((n) => {
-		let i = t.evidence.get(n);
-		return i !== void 0 && M(i, e, e.id, r);
-	});
-	for (let t of e.acceptance) !s(t.id) && !(t.status === "passed" && c(t.evidenceRefs)) && i.push(`acceptance ${t.id} has no passing evidence`);
-	for (let t of e.evidenceRequirements) t.status === "waived" ? (t.waiver === void 0 || Date.parse(t.waiver.expiresAt) <= r.now().getTime()) && i.push(`the waiver of ${t.id} has expired`) : !s(t.id, t.kinds) && !c(t.evidenceRefs, t.kinds) && i.push(`requirement ${t.id} has no passing ${t.kinds.join("/")} evidence`);
-	for (let n of t.openFindings.get(e.id) ?? []) i.push(`finding ${n.id} is open`);
-	for (let t of e.dependsOn) {
-		let e = n(t);
-		e !== "verified" && e !== "closed" && i.push(`dependency ${t} is ${e ?? "missing"}`);
-	}
-	return i;
-}, P = (e, t) => t.length === 0 ? "verified" : A.has(e.status) ? "active" : e.status, F = "voltro-plan-closure/v1", I = n.String.pipe(n.check(n.isMinLength(1))), L = n.String.pipe(n.check(n.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/))), R = n.String.pipe(n.check(n.isPattern(/^sha256:[a-f0-9]{64}$/))), z = (e) => {
-	let t = e.grammar, r = (e) => n.String.pipe(n.check(n.isPattern(e))), i = n.Struct({
-		id: r(t.closureRun),
-		pass: n.Literals(["contract", "adversarial"]),
-		reviewer: I,
-		reviewContext: I,
-		planRevision: R,
-		completedAt: L,
-		findingRefs: n.Array(r(t.finding)),
-		result: n.Literals(["passed", "findings"]),
-		toolVersion: I
-	}), a = n.Struct({
-		id: r(t.certificate),
-		plan: r(t.plan),
-		planRevision: R,
-		workItems: n.Array(r(t.workItem)),
-		evidenceRefs: n.Array(r(t.evidence)),
-		closureRuns: n.Array(r(t.closureRun)).pipe(n.check(n.isBetweenLength(2, 2))),
-		confirmedBy: I,
-		issuedAt: L,
-		toolVersion: I
-	});
-	return n.Struct({
-		schemaVersion: n.Literal(F),
-		plan: r(t.plan),
-		runs: n.Array(i),
-		certificates: n.Array(a)
-	});
-}, B = (e, t, n, r = () => void 0, i = /* @__PURE__ */ new Map()) => {
-	let a = new Set(e.workItems.map((e) => e.id));
-	return f({
-		instance: e,
-		dependencies: [...new Set(e.workItems.flatMap((e) => e.dependsOn).filter((e) => !a.has(e)))].sort().map((e) => {
-			let t = r(e);
-			return [e, t === "closed" ? "verified" : t ?? "missing"];
-		}),
-		decisions: [...new Set(e.workItems.flatMap((e) => e.links.adrs))].sort().map((e) => [e, i.get(e) ?? null]),
-		evidence: t.filter((e) => e.subjectRefs.some((e) => a.has(e))).map((e) => e.id).sort(),
-		findings: n.filter((e) => e.targetWorkItems.some((e) => a.has(e))).map((e) => [e.id, e.status]).sort()
-	});
-}, V = (e, t) => {
-	if (e === void 0) return { state: "open" };
-	let n = new Map(e.runs.map((e) => [e.id, e])), r = [...e.certificates].reverse().find((e) => e.planRevision === t && e.closureRuns.every((e) => n.get(e)?.result === "passed" && n.get(e)?.planRevision === t));
-	if (r !== void 0) return {
-		state: "certified",
-		certificate: r
-	};
-	let i = [...e.runs].reverse().find((e) => e.pass === "contract" && e.result === "passed" && e.planRevision === t);
-	return i === void 0 ? { state: "open" } : {
-		state: "closure-1",
-		run: i
-	};
-}, H = (e, t, n, r) => ({
-	outcome: "refused",
-	diagnostic: {
-		ruleId: e,
-		severity: "error",
-		message: t,
-		locator: { plan: r },
-		related: [],
-		nextAction: n
-	}
-}), U = (e, t) => `${e}${String(Math.max(0, ...t.filter((t) => t.startsWith(e)).map((t) => Number(t.slice(e.length)))) + 1).padStart(3, "0")}`, re = (e, t, n, r, i, a, o, s) => {
-	let c = t.plan.id, l = t.workItems.filter((e) => e.mandatory && e.supersededBy === void 0), u = l.filter((e) => i(e.id) !== "verified" && i(e.id) !== "closed");
-	if (s.findings.length === 0 && u.length > 0) return H("closure/unverified-items", `${u.length} of ${l.length} mandatory items of ${c} are not verified (${u.slice(0, 3).map((e) => e.id).join(", ")}${u.length > 3 ? ", …" : ""})`, "Verify every mandatory item first: voltro plan status, voltro plan evidence add.", c);
-	let d = new Set(t.workItems.map((e) => e.id)), f = o.filter((e) => e.status === "open" && e.targetWorkItems.some((e) => d.has(e)));
-	for (let e of s.findings) if (!f.some((t) => t.id === e)) return H("closure/unknown-finding", `${e} is not an open finding against ${c}`, "Record the finding first, against the items it concerns.", c);
-	if (s.findings.length === 0 && f.length > 0) return H("closure/open-findings", `${f.length} finding(s) against ${c} are open (${f.map((e) => e.id).slice(0, 3).join(", ")})`, "Resolve them or accept the risk; then close again.", c);
-	let p = n?.runs ?? [];
-	if (s.pass === "adversarial" && s.findings.length === 0) {
-		let e = [...p].reverse().find((e) => e.pass === "contract" && e.result === "passed" && e.planRevision === r);
-		if (e === void 0) return H("closure/order", `${c} has no passed contract pass on its current revision`, "Run the contract pass first: voltro plan close <plan> --pass contract.", c);
-		if (e.reviewer === s.reviewer || e.reviewContext === s.reviewContext) return H("closure/same-context", `the adversarial pass needs another reviewer and another context than ${e.id} (${e.reviewer}, ${e.reviewContext})`, "Have someone else audit it, in their own context.", c);
-	}
-	let m = t.plan.number, h = {
-		id: U(`CLR-${e.prefix}-${m}-`, p.map((e) => e.id)),
-		pass: s.pass,
-		reviewer: s.reviewer,
-		reviewContext: s.reviewContext,
-		planRevision: r,
-		completedAt: s.at,
-		findingRefs: [...s.findings].sort(),
-		result: s.findings.length === 0 ? "passed" : "findings",
-		toolVersion: s.toolVersion
-	}, g = null;
-	if (s.pass === "adversarial" && h.result === "passed") {
-		let t = [...p].reverse().find((e) => e.pass === "contract" && e.result === "passed" && e.planRevision === r);
-		g = {
-			id: U(`CRT-${e.prefix}-${m}-`, (n?.certificates ?? []).map((e) => e.id)),
-			plan: c,
-			planRevision: r,
-			workItems: l.map((e) => e.id).sort(),
-			evidenceRefs: a.filter((e) => e.subjectRefs.some((e) => d.has(e))).map((e) => e.id).sort(),
-			closureRuns: [t.id, h.id],
-			confirmedBy: s.reviewer,
-			issuedAt: s.at,
-			toolVersion: s.toolVersion
-		};
-	}
-	return {
-		outcome: "recorded",
-		file: {
-			schemaVersion: F,
-			plan: c,
-			runs: [...p, h],
-			certificates: [...n?.certificates ?? [], ...g === null ? [] : [g]]
-		},
-		run: h,
-		certificate: g
-	};
-}, W = (e, t, n, r, i, a = []) => ({
-	ruleId: e,
-	severity: t,
-	message: n,
-	locator: r,
-	related: [...a].sort(),
-	nextAction: i
-}), ie = r.makeFormatterStandardSchemaV1(), G = (r, i, a, o) => {
-	let s = n.decodeUnknownExit(i, {
-		onExcessProperty: "error",
-		errors: "all"
-	}), c = [];
-	for (let n of r) {
-		let r = s(n.content);
-		if (t.isSuccess(r)) {
-			c.push({
-				file: n.file,
-				value: r.value
-			});
-			continue;
-		}
-		let i = e.findErrorOption(r.cause), l = i._tag === "Some" ? ie(i.value.issue).issues : [{
-			message: e.pretty(r.cause),
-			path: []
-		}];
-		for (let e of l) {
-			let t = (e.path ?? []).map((e) => String(typeof e == "object" ? e.key : e));
-			o.push(W("schema/invalid", "error", `${a}: ${e.message}`, {
-				file: n.file,
-				path: t.join(".") || "(root)"
-			}, "Correct the field to the v1 contract; unknown fields are not allowed."));
-		}
-	}
-	return c;
-}, ae = [
-	["private key", /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
-	["Stripe key", /\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/],
-	["GitHub token", /\bgh[pousr]_[A-Za-z0-9]{30,}/],
-	["AWS access key", /\bAKIA[0-9A-Z]{16}\b/],
-	["Slack token", /\bxox[abprs]-[A-Za-z0-9-]{10,}/],
-	["bearer token", /\bBearer\s+[A-Za-z0-9._~+/-]{20,}/]
-], K = (e, t, n, r) => {
-	if (typeof e == "string") for (let [i, a] of ae) a.test(e) && r.push(W("security/secret", "security", `a ${i} is in the plan artefact`, {
-		file: t,
-		path: n
-	}, "Remove the secret, rotate it, and reference where it is kept instead."));
-	else if (Array.isArray(e)) e.forEach((e, i) => K(e, t, `${n}[${i}]`, r));
-	else if (typeof e == "object" && e) for (let [i, a] of Object.entries(e)) K(a, t, n === "" ? i : `${n}.${i}`, r);
-}, q = (e) => {
-	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Map(), r = (r) => {
-		let i = [], a = /* @__PURE__ */ new Set(), o = (r) => {
-			i.push(r), a.add(r);
-			for (let s of [...e.get(r) ?? []].sort()) if (e.has(s)) {
-				if (a.has(s)) {
-					let e = i.slice(i.indexOf(s)), t = e.reduce((e, t) => t < e ? t : e), r = [...e.slice(e.indexOf(t)), ...e.slice(0, e.indexOf(t))];
-					n.set(r.join(">"), r);
-				} else t.has(s) || o(s);
-			}
-			i.pop(), a.delete(r), t.add(r);
-		};
-		o(r);
-	};
-	for (let n of [...e.keys()].sort()) t.has(n) || r(n);
-	return [...n.values()].sort((e, t) => e.join(">") < t.join(">") ? -1 : 1);
-}, oe = (e) => {
-	let { shape: t, clock: n } = e, r = t.grammar, i = [];
-	for (let t of [
-		...e.instances,
-		...e.evidence ?? [],
-		...e.findings ?? [],
-		...e.closures ?? []
-	]) K(t.content, t.file, "", i);
-	let a = G(e.instances, w(t), "plan instance", i).map(({ file: e, value: t }) => ({
-		file: e,
-		instance: t
-	})), c = (e.evidence ?? []).flatMap((e) => G(Array.isArray(e.content) ? e.content.map((t, n) => ({
-		file: `${e.file}#${n}`,
-		content: t
-	})) : [e], T(t), "evidence", i).map((e) => e.value)), l = (e.findings ?? []).flatMap((e) => G(Array.isArray(e.content) ? e.content.map((t, n) => ({
-		file: `${e.file}#${n}`,
-		content: t
-	})) : [e], E(t), "finding", i).map((e) => e.value)), u = /* @__PURE__ */ new Map(), d = /* @__PURE__ */ new Map(), f = /* @__PURE__ */ new Map();
-	for (let { file: t, instance: n } of a) {
-		let a = n.plan;
-		u.has(a.id) && i.push(W("identity/duplicate-plan", "error", `${a.id} is declared in two files`, {
-			file: t,
-			plan: a.id
-		}, "Keep one instance file per plan.", [u.get(a.id)])), u.set(a.id, t), o(a.id) !== a.number && i.push(W("identity/plan-number", "error", `${a.id} has number ${a.number}`, {
-			file: t,
-			plan: a.id,
-			path: "plan.number"
-		}, "Make the number match the plan id."));
-		for (let e of n.workItems) {
-			let n = {
-				file: t,
-				plan: a.id,
-				workItem: e.id
-			};
-			d.has(e.id) ? i.push(W("identity/duplicate-work-item", "error", `${e.id} is declared twice`, n, "Give the second item its own id; ids are never reused.", [d.get(e.id).file])) : d.set(e.id, {
-				file: t,
-				item: e
-			}), (e.ownerPlan !== a.id || o(e.id) !== a.number) && i.push(W("identity/owner-mismatch", "error", `${e.id} is owned by ${e.ownerPlan} but lives in ${a.id}`, n, "Move the item to its plan’s file or correct ownerPlan."));
-			let c = [
-				...e.acceptance.map((e) => e.id),
-				...e.evidenceRequirements.map((e) => e.id),
-				...e.sourceRefs.map((e) => e.id)
-			];
-			for (let t of c) s(r, t) !== e.id && i.push(W("identity/child-id", "error", `${t} does not belong to ${e.id}`, n, `Number it under ${e.id}.`));
-			for (let t of e.sourceRefs) f.has(t.id) && i.push(W("source/duplicate", "error", `source ${t.id} is disposed twice`, n, "Dispose each source block exactly once.", [f.get(t.id)])), f.set(t.id, e.id), t.disposition !== "owned-by" && t.targetId === void 0 && i.push(W("source/missing-target", "error", `source ${t.id} is ${t.disposition} without a target`, {
-				...n,
-				path: `sourceRefs.${t.id}`
-			}, "Name the work item or decision it points to."));
-		}
-		if (e.sources !== void 0) {
-			let r = e.sources.get(a.source);
-			r == null ? i.push(W("source/missing", "error", `${a.id}'s source ${a.source} cannot be read`, {
-				file: t,
-				plan: a.id,
-				path: "plan.source"
-			}, "Restore the source or point the plan at it.")) : (r !== a.sourceRevision || r !== n.extraction.sourceRevision) && i.push(W("source/stale", "error", `${a.source} changed since ${a.id} was decomposed (${a.sourceRevision.slice(0, 19)}… → ${r.slice(0, 19)}…)`, {
-				file: t,
-				plan: a.id,
-				path: "plan.sourceRevision"
-			}, "Regenerate the plan’s decomposition from its source; closure waits until then."));
-		}
-		let c = n.workItems.reduce((e, t) => e + t.sourceRefs.length, 0);
-		(n.coverage.disposedSources !== c || n.coverage.unmatchedSources > 0 || n.coverage.duplicateSources > 0 || a.decompositionComplete && n.coverage.result !== "complete") && i.push(W("source/coverage", "error", `${a.id} claims ${n.coverage.disposedSources} disposed sources (${n.coverage.unmatchedSources} unmatched, ${n.coverage.duplicateSources} duplicate, ${n.coverage.result}) and holds ${c}`, {
-			file: t,
-			plan: a.id,
-			path: "coverage"
-		}, "Regenerate the plan’s decomposition from its source."));
-	}
-	let p = new Set(c.map((e) => e.id));
-	for (let { file: t, item: n } of d.values()) {
-		let r = {
-			file: t,
-			plan: n.ownerPlan,
-			workItem: n.id
-		};
-		for (let e of n.dependsOn) e === n.id ? i.push(W("graph/self-dependency", "error", `${n.id} depends on itself`, r, "Remove the dependency.")) : d.has(e) || i.push(W("graph/missing-dependency", "error", `${n.id} depends on ${e}, which does not exist`, r, "Point at an existing item or remove the dependency.", [e]));
-		if (e.decisions !== void 0) for (let t of n.links.adrs) e.decisions.has(t) || i.push(W("graph/missing-decision", "error", `${n.id} links ${t}, which the decision records do not hold`, r, "Add the decision record or correct the link.", [t]));
-		for (let e of n.links.relatedTo) d.has(e) || i.push(W("graph/missing-related", "error", `${n.id} relates to ${e}, which does not exist`, r, "Point at an existing item.", [e]));
-		n.supersededBy !== void 0 && !d.has(n.supersededBy) && i.push(W("graph/missing-successor", "error", `${n.id} is superseded by ${n.supersededBy}, which does not exist`, r, "Name the item that replaces it.", [n.supersededBy]));
-		let a = [
-			...n.evidenceRefs,
-			...n.acceptance.flatMap((e) => e.evidenceRefs),
-			...n.evidenceRequirements.flatMap((e) => e.evidenceRefs),
-			...n.statusHistory.flatMap((e) => e.evidenceRefs)
-		];
-		for (let e of [...new Set(a)].sort()) p.has(e) || i.push(W("evidence/missing", "error", `${n.id} names evidence ${e}, which does not exist`, r, "Add the evidence with `voltro plan evidence add` or remove the reference.", [e]));
-		n.owners.length === 0 && i.push(W("quality/no-owner", "warning", `${n.id} has no owner`, r, "Name who owns the item."));
-	}
-	for (let e of q(new Map([...d.values()].map(({ item: e }) => [e.id, e.dependsOn])))) {
-		let t = d.get(e[0]);
-		i.push(W("graph/cycle", "error", `dependency cycle: ${[...e, e[0]].join(" → ")}`, {
-			file: t.file,
-			plan: t.item.ownerPlan,
-			workItem: e[0]
-		}, "Break the cycle: one of these items must not wait for the others.", e));
-	}
-	for (let e of l) for (let t of e.targetWorkItems) d.has(t) || i.push(W("graph/missing-finding-target", "error", `finding ${e.id} targets ${t}, which does not exist`, { workItem: t }, "Point the finding at an existing item.", [e.id]));
-	for (let { file: e, item: t } of d.values()) {
-		let n = {
-			file: e,
-			plan: t.ownerPlan,
-			workItem: t.id
-		};
-		for (let e of t.acceptance) e.status !== "pending" && e.evidenceRefs.length === 0 && i.push(W("acceptance/decided-without-evidence", "error", `${e.id} is ${e.status} without evidence`, {
-			...n,
-			path: e.id
-		}, "Name the evidence the decision rests on."));
-		for (let e of t.evidenceRequirements) e.status === "satisfied" && e.evidenceRefs.length === 0 && i.push(W("acceptance/satisfied-without-evidence", "error", `${e.id} is satisfied without evidence`, {
-			...n,
-			path: e.id
-		}, "Name the evidence that satisfies it.")), e.status === "waived" && e.waiver === void 0 && i.push(W("acceptance/waived-without-waiver", "error", `${e.id} is waived without a waiver`, {
-			...n,
-			path: e.id
-		}, "Write the waiver: rationale, reviewer, expiry and compensating control."));
-	}
-	let m = j(c, l), h = /* @__PURE__ */ new Map(), g = /* @__PURE__ */ new Map(), _ = /* @__PURE__ */ new Set(), v = (e) => {
-		let t = h.get(e);
-		if (t !== void 0) return t;
-		let r = d.get(e);
-		if (r === void 0 || _.has(e)) return;
-		_.add(e);
-		let i = N(r.item, m, v, n);
-		_.delete(e);
-		let a = P(r.item, i);
-		return h.set(e, a), g.set(e, i), a;
-	};
-	for (let { file: e, item: t } of [...d.values()].sort((e, t) => e.item.id < t.item.id ? -1 : 1)) {
-		let n = {
-			file: e,
-			plan: t.ownerPlan,
-			workItem: t.id
-		}, r = null;
-		t.statusHistory.forEach((e, a) => {
-			e.from === r ? e.from !== null && !k[e.from].includes(e.to) && i.push(W("state/forbidden-transition", "error", `${t.id} went ${e.from} → ${e.to}`, {
-				...n,
-				path: `statusHistory[${a}]`
-			}, `From ${e.from} an item goes to ${k[e.from].join(", ")}.`)) : i.push(W("state/history-break", "error", `${t.id} history step ${a + 1} starts at ${e.from ?? "nothing"}, after ${r ?? "nothing"}`, {
-				...n,
-				path: `statusHistory[${a}]`
-			}, "Record every transition in order.")), r = e.to;
-		}), r !== t.status && i.push(W("state/history-end", "error", `${t.id} is ${t.status} but its history ends at ${r ?? "nothing"}`, {
-			...n,
-			path: "status"
-		}, "Record the transition that led to the current state.")), t.status === "blocked" && t.blocker === void 0 && i.push(W("state/blocked-without-blocker", "error", `${t.id} is blocked without a blocker`, {
-			...n,
-			path: "blocker"
-		}, "Write down reason, owner, next action and recheck trigger.")), t.status !== "blocked" && t.blocker !== void 0 && i.push(W("state/blocker-not-blocked", "error", `${t.id} carries a blocker but is ${t.status}`, {
-			...n,
-			path: "blocker"
-		}, "Remove the blocker or record the block.")), v(t.id);
-	}
-	let y = /* @__PURE__ */ new Map();
-	for (let { file: n, value: r } of G(e.closures ?? [], z(t), "closure record", i)) u.has(r.plan) ? y.has(r.plan) ? i.push(W("closure/duplicate", "error", `${r.plan} has two closure records`, {
-		file: n,
-		plan: r.plan
-	}, "Keep one closure record per plan.", [y.get(r.plan).file])) : y.set(r.plan, {
-		file: n,
-		record: r
-	}) : i.push(W("closure/unknown-plan", "error", `a closure record names ${r.plan}, which does not exist`, {
-		file: n,
-		plan: r.plan
-	}, "Remove it or correct the plan id."));
-	let b = /* @__PURE__ */ new Map(), x = /* @__PURE__ */ new Map();
-	for (let { instance: t } of a) {
-		let n = B(t, c, l, (e) => h.get(e), e.decisions);
-		b.set(t.plan.id, n);
-		let r = y.get(t.plan.id), a = V(r?.record, n);
-		if (x.set(t.plan.id, a), r !== void 0 && r.record.certificates.length > 0 && a.state !== "certified" && i.push(W("closure/stale-certificate", "warning", `${t.plan.id} changed after its certificate ${r.record.certificates.at(-1).id}: it is open again`, {
-			file: r.file,
-			plan: t.plan.id
-		}, "Verify what changed and run both closure passes again.")), a.state === "certified") for (let e of t.workItems) h.get(e.id) === "verified" && h.set(e.id, "closed");
-		t.plan.status === "complete" && a.state !== "certified" && i.push(W("state/manual-derived", "error", `${t.plan.id} says complete without a certificate on its current revision`, {
-			plan: t.plan.id,
-			path: "plan.status"
-		}, "Close it with both passes: voltro plan close <plan>."));
-	}
-	for (let { file: e, item: t } of [...d.values()].sort((e, t) => e.item.id < t.item.id ? -1 : 1)) {
-		let n = h.get(t.id);
-		A.has(t.status) && n !== t.status && (t.status !== "verified" || n !== "closed") && i.push(W("state/manual-derived", "error", `${t.id} says ${t.status}; the evidence says ${n}: ${(g.get(t.id) ?? []).slice(0, 3).join("; ") || "its plan holds no certificate on its current revision"}`, {
-			file: e,
-			plan: t.ownerPlan,
-			workItem: t.id,
-			path: "status"
-		}, "Add the missing evidence; verified and closed are derived, never set."));
-	}
-	return {
-		program: {
-			instances: a,
-			items: d,
-			evidence: c,
-			findings: l,
-			status: h,
-			gaps: g,
-			closures: y,
-			revisions: b,
-			closure: x
-		},
-		diagnostics: te(i)
-	};
-}, J = () => Object.fromEntries(y.map((e) => [e, 0])), se = (e) => {
-	let t = J();
-	return {
-		plans: e.instances.map(({ file: n, instance: r }) => {
-			let i = J(), a = J(), o = [];
-			for (let n of r.workItems) {
-				let r = e.status.get(n.id) ?? n.status;
-				(n.mandatory ? i : a)[r]++, n.mandatory && t[r]++, r === "blocked" && n.blocker !== void 0 && o.push({
-					workItem: n.id,
-					reason: n.blocker.reason,
-					owner: n.blocker.owner,
-					nextAction: n.blocker.nextAction
-				});
-			}
-			let s = r.workItems.filter((e) => e.mandatory).length, c = i.verified + i.closed, l = e.closure.get(r.plan.id), u = r.plan.decompositionComplete ? l?.state === "certified" ? "complete" : s > 0 && c === s ? l?.state === "closure-1" ? "closure-1" : "verifying" : i.active + i.blocked + c > 0 ? "active" : i.ready > 0 ? "ready" : "decomposing" : "decomposing";
-			return {
-				plan: r.plan.id,
-				title: r.plan.title,
-				file: n,
-				recorded: r.plan.status,
-				derived: u,
-				certificate: l?.state === "certified" ? l.certificate.id : null,
-				mandatory: i,
-				optional: a,
-				blocked: o.sort((e, t) => e.workItem < t.workItem ? -1 : 1)
-			};
-		}).sort((e, t) => e.plan < t.plan ? -1 : 1),
-		mandatory: t,
-		items: e.items.size
-	};
-}, ce = {
-	P0: 0,
-	P1: 1,
-	P2: 2,
-	P3: 3
-}, le = (e, t, n) => {
-	if (n) return {
-		outcome: "invalid",
-		reason: "lint reports blocking diagnostics; fix them first (`voltro plan lint`)"
-	};
-	let r = (t) => e.status.get(t), i = new Set([...e.items.values()].filter(({ item: e }) => [
-		"active",
-		"verified",
-		"closed"
-	].includes(r(e.id) ?? "")).map(({ item: e }) => e.ownerPlan)), a = [...e.items.values()].filter(({ item: e }) => e.mandatory && e.supersededBy === void 0 && (t.plan === void 0 || e.ownerPlan === t.plan || e.ownerPlan.endsWith(`-PLAN-${t.plan}`)) && (t.owner === void 0 || e.owners.includes(t.owner)) && (t.repo === void 0 || e.repos.includes(t.repo)));
-	if (a.every(({ item: e }) => ["verified", "closed"].includes(r(e.id) ?? ""))) return { outcome: "complete" };
-	let o = (e) => e.dependsOn.every((e) => ["verified", "closed"].includes(r(e) ?? "")), s = (e) => [
-		r(e.id) === "active" ? 0 : 1,
-		ce[e.priority],
-		e.kind === "security" ? 0 : 1,
-		+!i.has(e.ownerPlan),
-		+!o(e),
-		e.id
-	], c = (e, t) => {
-		for (let n = 0; n < e.length; n++) if (e[n] !== t[n]) return e[n] < t[n];
-		return !1;
-	}, l = (e) => {
-		let t;
-		for (let n of a) {
-			if (!e.includes(r(n.item.id) ?? "")) continue;
-			let i = s(n.item);
-			(t === void 0 || c(i, t.rank)) && (t = {
-				entry: n,
-				rank: i
-			});
-		}
-		return t;
-	}, u = l(["active", "ready"]);
-	if (u !== void 0) {
-		let e = u.entry, t = r(e.item.id);
-		return {
-			outcome: "item",
-			workItem: e.item,
-			file: e.file,
-			why: [
-				t === "active" ? "it is already active" : "it is ready",
-				`priority ${e.item.priority}`,
-				...e.item.kind === "security" ? ["security work comes first"] : [],
-				i.has(e.item.ownerPlan) ? `${e.item.ownerPlan} is already under way` : "no started plan has workable items",
-				u.rank[4] === 0 ? "its dependencies are verified" : "no dependency-ready item is left, so it waits on its dependencies"
-			]
-		};
-	}
-	let d = l(["proposed"]), f = a.filter(({ item: e }) => r(e.id) === "proposed").length, p = a.filter(({ item: e }) => r(e.id) === "blocked").length;
-	return {
-		outcome: "blocked",
-		reason: `no mandatory item is active or ready: ${f} proposed await readiness${p > 0 ? `, ${p} blocked` : ""}`,
-		prepare: d?.entry.item ?? null,
-		file: d?.entry.file ?? null
-	};
-}, Y = "voltro-plan-command/v1", ue = (e) => ({
-	schemaVersion: Y,
-	...e
-}), X = {
-	ok: 0,
-	failed: 1,
-	usage: 2,
-	input: 3,
-	conflict: 4,
-	provider: 5,
-	security: 6,
-	internal: 70
-}, Z = "voltro-plan-manifest/v1", Q = n.String.pipe(n.check(n.isMinLength(1)), n.check(n.makeFilter((e) => !e.startsWith("/") && !/^[A-Za-z]:/.test(e) && !e.split("/").includes("..") || "a path stays inside the project root"))), de = n.Struct({
-	schemaVersion: n.Literal(Z),
-	prefix: n.String.pipe(n.check(n.isPattern(/^[A-Z][A-Z0-9]{1,9}$/))),
-	instanceVersion: n.String.pipe(n.check(n.isMinLength(1))),
-	repos: n.Array(n.String.pipe(n.check(n.isMinLength(1)))).pipe(n.check(n.isMinLength(1))),
-	instances: n.Array(Q).pipe(n.check(n.isMinLength(1))),
-	evidence: n.optional(n.Array(Q)),
-	evidenceDir: n.optional(Q),
-	closureDir: n.optional(Q),
-	adrDir: n.optional(Q),
-	findings: n.optional(n.Array(Q))
-}), $ = (e, t, n, r, i, a) => ({
-	outcome: "refused",
-	exit: a,
-	diagnostic: {
-		ruleId: e,
-		severity: t,
-		message: n,
-		locator: { workItem: i },
-		related: [],
-		nextAction: r
-	}
-}), fe = [
-	/-----BEGIN [A-Z ]*PRIVATE KEY-----/,
-	/\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/,
-	/\bgh[pousr]_[A-Za-z0-9]{30,}/,
-	/\bAKIA[0-9A-Z]{16}\b/,
-	/\bxox[abprs]-[A-Za-z0-9-]{10,}/,
-	/\bBearer\s+[A-Za-z0-9._~+/-]{20,}/
-], pe = (e, t, n) => {
-	let r = e.items.get(n.workItem)?.item;
-	if (r === void 0) return $("evidence/unknown-target", "error", `${n.workItem} is not a work item of this program`, "Name an existing work item.", n.workItem, X.failed);
-	if ([
-		n.title,
-		n.uri,
-		n.producedBy,
-		n.command ?? "",
-		n.environment ?? ""
-	].some((e) => fe.some((t) => t.test(e))) || /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]*:[^/@\s]*@/i.test(n.uri)) return $("security/secret", "security", "the evidence carries a secret or a credential", "Remove it; reference where the result is kept, never a key.", r.id, X.security);
-	if (!x.includes(n.kind)) return $("evidence/kind", "error", `"${n.kind}" is not an evidence kind`, `Use one of: ${x.join(", ")}.`, r.id, X.usage);
-	if (/^http:\/\//i.test(n.uri)) return $("evidence/uri", "error", `${n.uri} is not https`, "Reference evidence over https, git: or a project-relative path.", r.id, X.failed);
-	if (n.uri.startsWith("/") || /^[A-Za-z]:[\\/]/.test(n.uri) || n.uri.split("/").includes("..")) return $("evidence/uri", "error", `${n.uri} is not portable`, "Use a path relative to the project root, or a URL.", r.id, X.failed);
-	let i = [r.id];
-	for (let e of n.proves) {
-		let t = /^[AE][0-9]{2}$/.test(e) ? `${r.id}-${e}` : e, a = r.acceptance.find((e) => e.id === t), o = r.evidenceRequirements.find((e) => e.id === t);
-		if (a === void 0 && o === void 0) return $("evidence/unknown-target", "error", `${t} is not a check or requirement of ${r.id}`, `Name one of ${[...r.acceptance, ...r.evidenceRequirements].map((e) => e.id).join(", ")}.`, r.id, X.failed);
-		if (o !== void 0 && !o.kinds.includes(n.kind)) return $("evidence/wrong-kind", "error", `${o.id} asks for ${o.kinds.join("/")}, not ${n.kind}`, "Add evidence of a kind the requirement names.", r.id, X.failed);
-		i.push(t);
-	}
-	let a = {
-		kind: n.kind,
-		title: n.title,
-		uri: n.uri,
-		result: n.result,
-		subjectRefs: [...new Set(i)],
-		producedBy: n.producedBy,
-		...n.command === void 0 ? {} : { command: n.command },
-		...n.environment === void 0 ? {} : { environment: n.environment },
-		...n.fingerprint === void 0 ? {} : { fingerprint: n.fingerprint }
-	};
-	if (n.idempotencyKey !== void 0) {
-		let t = e.evidence.find((e) => e.idempotencyKey === n.idempotencyKey);
-		if (t !== void 0) {
-			let { id: e, observedAt: i, idempotencyKey: o, ...s } = t;
-			return c(s) === c(a) ? {
-				outcome: "same",
-				evidence: t
-			} : $("evidence/idempotency-conflict", "error", `the key "${n.idempotencyKey}" was used for other evidence (${t.id})`, "Use a new key for new evidence.", r.id, X.conflict);
-		}
-	}
-	let o = `EVD-${r.id}-`, s = e.evidence.filter((e) => e.id.startsWith(o)).map((e) => Number(e.id.slice(o.length))), l = String(Math.max(0, ...s) + 1).padStart(3, "0");
-	return t.evidence.test(`${o}${l}`) ? {
-		outcome: "add",
-		evidence: {
-			id: `${o}${l}`,
-			...a,
-			observedAt: n.observedAt,
-			...n.idempotencyKey === void 0 ? {} : { idempotencyKey: n.idempotencyKey }
-		}
-	} : $("evidence/exhausted", "error", `${r.id} has no evidence number left`, "Supersede the item.", r.id, X.failed);
-}, me = [
-	".",
-	":",
-	"/",
-	"-"
-], he = (e, t) => e === t || me.some((n) => t.startsWith(e + n) || e.startsWith(t + n)), ge = (e, t) => {
-	let n = /* @__PURE__ */ new Map(), r = (e, t) => {
-		let r = n.get(e) ?? /* @__PURE__ */ new Set();
-		r.add(t), n.set(e, r);
-	};
-	for (let { item: n } of e.items.values()) for (let e of t.tags) for (let t of n.impactTags) he(e, t) && r(n.id, `tag ${t}`);
-	let i = [], a = new Map(e.instances.map(({ file: e, instance: t }) => [e, t])), o = /* @__PURE__ */ new Map();
-	for (let { item: t } of e.items.values()) for (let e of t.sourceRefs) {
-		let n = o.get(e.uri);
-		n === void 0 && (n = /* @__PURE__ */ new Set(), o.set(e.uri, n)), n.add(t.id);
-	}
-	for (let e of [...new Set(t.files)].sort()) {
-		let t = !1, n = a.get(e);
-		if (n !== void 0) {
-			t = !0;
-			for (let t of n.workItems) r(t.id, `its plan file ${e} changed`);
-		}
-		for (let n of o.get(e) ?? []) t = !0, r(n, `its source ${e} changed`);
-		t || i.push(e);
-	}
-	let s = /* @__PURE__ */ new Map();
-	for (let { item: t } of e.items.values()) for (let e of t.dependsOn) {
-		let n = s.get(e);
-		n === void 0 && (n = [], s.set(e, n)), n.push(t.id);
-	}
-	for (let e of s.values()) e.sort();
-	let c = /* @__PURE__ */ new Map(), l = [...n.keys()].sort().map((e) => [e]), u = new Set(n.keys());
-	for (let e = 0; e < l.length; e++) {
-		let t = l[e];
-		for (let e of s.get(t.at(-1)) ?? []) {
-			if (u.has(e)) continue;
-			u.add(e);
-			let n = [...t, e];
-			c.set(e, n), l.push(n);
-		}
-	}
-	let d = [...u], f = [...new Set(d.map((t) => e.items.get(t).item.ownerPlan))].sort(), p = f.flatMap((t) => {
-		let n = e.closure.get(t);
-		return n?.state === "certified" ? [{
-			plan: t,
-			certificate: n.certificate.id
-		}] : [];
-	});
-	return {
-		direct: [...n.entries()].map(([e, t]) => ({
-			workItem: e,
-			because: [...t].sort()
-		})).sort((e, t) => e.workItem < t.workItem ? -1 : 1),
-		transitive: [...c.entries()].map(([e, t]) => ({
-			workItem: e,
-			path: t
-		})).sort((e, t) => e.workItem < t.workItem ? -1 : 1),
-		plans: f,
-		certificates: p,
-		unknown: i
-	};
-};
-//#endregion
-export { F as CLOSURE_SCHEMA_VERSION, Y as COMMAND_SCHEMA_VERSION, A as DERIVED, x as EVIDENCE_KINDS, X as EXIT, S as ITEM_KINDS, Z as MANIFEST_SCHEMA_VERSION, de as Manifest, b as PLAN_STATUSES, ee as PRIORITIES, k as TRANSITIONS, y as WORK_ITEM_STATUSES, ne as blocks, c as canonicalJson, z as closureFileSchema, V as closureState, re as decideClosure, pe as decideEvidence, q as dependencyCycles, P as derivedStatus, ue as envelope, T as evidenceSchema, E as findingSchema, f as fingerprint, a as idGrammar, ge as impactOf, j as indexEvidence, oe as lintProgram, le as nextItem, s as ownerItemOf, w as planInstanceSchema, o as planNumberOf, B as planRevision, se as programStatus, d as sha256Hex, te as sortDiagnostics, N as verificationGaps };
+import { idGrammar as e, ownerItemOf as t, planNumberOf as n } from "./ids.js";
+import { canonicalJson as r, fingerprint as i, sha256Hex as a } from "./canonical.js";
+import { EVIDENCE_KINDS as o, ITEM_KINDS as s, PLAN_STATUSES as c, PRIORITIES as l, WORK_ITEM_STATUSES as u, evidenceSchema as d, findingSchema as f, planInstanceSchema as p } from "./schema.js";
+import { blocks as m, sortDiagnostics as h } from "./diagnostics.js";
+import { DERIVED as g, TRANSITIONS as _, derivedStatus as v, indexEvidence as y, verificationGaps as b } from "./state.js";
+import { CLOSURE_SCHEMA_VERSION as x, closureFileSchema as S, closureState as C, decideClosure as w, planRevision as T } from "./closure.js";
+import { dependencyCycles as E, lintProgram as D } from "./lint.js";
+import { programStatus as O } from "./status.js";
+import { nextItem as k } from "./next.js";
+import { COMMAND_SCHEMA_VERSION as A, EXIT as j, envelope as M } from "./envelope.js";
+import { MANIFEST_SCHEMA_VERSION as N, Manifest as P } from "./manifest.js";
+import { decideEvidence as F } from "./evidence.js";
+import { impactOf as I } from "./impact.js";
+export { x as CLOSURE_SCHEMA_VERSION, A as COMMAND_SCHEMA_VERSION, g as DERIVED, o as EVIDENCE_KINDS, j as EXIT, s as ITEM_KINDS, N as MANIFEST_SCHEMA_VERSION, P as Manifest, c as PLAN_STATUSES, l as PRIORITIES, _ as TRANSITIONS, u as WORK_ITEM_STATUSES, m as blocks, r as canonicalJson, S as closureFileSchema, C as closureState, w as decideClosure, F as decideEvidence, E as dependencyCycles, v as derivedStatus, M as envelope, d as evidenceSchema, f as findingSchema, i as fingerprint, e as idGrammar, I as impactOf, y as indexEvidence, D as lintProgram, k as nextItem, t as ownerItemOf, p as planInstanceSchema, n as planNumberOf, T as planRevision, O as programStatus, a as sha256Hex, h as sortDiagnostics, b as verificationGaps };