@zigrivers/scaffold 3.28.0 → 3.30.0

package/dist/knowledge-freshness/audit-apply-pr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-apply-pr.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-apply-pr.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;CAClB;AA6BD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAcjE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAS3D;AAmBD,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,GAAE,eAAoB,GAAG,MAAM,CAsDtF;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAK1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,GAAE,eAAoB,GAAG,UAAU,CAM/F;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOlF;AAOD,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAqBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA+H7G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYvE"}

package/dist/knowledge-freshness/audit-apply-pr.js

@@ -0,0 +1,309 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import yaml from 'js-yaml';
+/**
+ * One-sentence summary of the verdict's source list. Used in the PR title
+ * (which has length limits) so the operator sees at a glance which doc the
+ * audit is calibrated against.
+ */
+function oneSentenceSourceSummary(verdict) {
+    const urls = verdict.sources_checked.map((s) => s.url);
+    if (urls.length === 0)
+        return '(no sources)';
+    if (urls.length === 1)
+        return urls[0];
+    return `${urls[0]} and ${urls.length - 1} other source(s)`;
+}
+/**
+ * Markdown-escape a cell so a stray `|` or backtick in a finding doesn't
+ * break the table layout. We don't try to render arbitrary markdown — the
+ * cell is a single line of plain text.
+ */
+function escapeCell(s) {
+    // Round-7 F-004 follow-through: collapse ALL JS line terminators so
+    // table cells can't smuggle in a BREAKING CHANGE: footer via lone \r
+    // or Unicode line separators.
+    return s
+        .replace(/\|/g, '\\|')
+        .replace(/[\r\n\u2028\u2029]+/g, ' ')
+        .trim();
+}
+export function renderFindingsTable(verdict) {
+    if (verdict.findings.length === 0) {
+        return '_No findings._';
+    }
+    const header = '| severity | drift_kind | claim_in_entry | evidence_url |';
+    const sep = '|---|---|---|---|';
+    const rows = verdict.findings.map((f) => {
+        const severity = escapeCell(f.severity);
+        const driftKind = escapeCell(f.drift_kind);
+        const claim = escapeCell(f.claim_in_entry);
+        const evidence = escapeCell(f.evidence_url);
+        return `| ${severity} | ${driftKind} | ${claim} | ${evidence} |`;
+    });
+    return [header, sep, ...rows].join('\n');
+}
+export function renderPrTitle(verdict) {
+    // Round-8 F-002: sanitize ALL title components — both entry_name and
+    // the source summary — so an LLM-injected `\nBREAKING CHANGE:` (via
+    // verdict.entry_name or sources_checked[*].url) cannot turn a
+    // chore-refresh title into a major-bump signal. The body sanitization
+    // alone wasn't enough; deriveBumpKind also reads the title.
+    const name = sanitizeLlmField(verdict.entry_name);
+    const summary = sanitizeLlmField(oneSentenceSourceSummary(verdict));
+    return `chore(knowledge): refresh ${name} against ${summary}`;
+}
+/**
+ * Collapse ALL JavaScript line terminators in LLM-controlled text before
+ * splicing into the PR body. F-003 round-4 introduced this for `\r\n`/`\n`;
+ * F-002/F-003/F-004 round-7 extends it to lone `\r` and the Unicode line
+ * separators `<U+2028>` / `<U+2029>`, since JS regex multiline-mode `^` treats
+ * those as line starts. Without exhaustive sanitization, an LLM-controlled
+ * field carrying `\rBREAKING CHANGE:` or `<U+2028>BREAKING CHANGE:` would
+ * still inject a major-bump footer that the version-bump workflow honors.
+ *
+ * Citations of "BREAKING CHANGE:" in evidence text mid-line remain
+ * legitimate; the round-2 start-of-line anchor on deriveBumpKind plus the
+ * collapsing here ensure such mentions never become footers.
+ */
+function sanitizeLlmField(s) {
+    return s.replace(/[\r\n\u2028\u2029]+/g, ' ').trim();
+}
+export function renderPrBody(verdict, opts = {}) {
+    const sourceList = verdict.sources_checked.length === 0
+        ? '_No sources._'
+        : verdict.sources_checked.map((s) => `- ${sanitizeLlmField(s.url)}`).join('\n');
+    const provenance = verdict.sources_checked.length === 0
+        ? '_No sources._'
+        : verdict.sources_checked
+            .map((s) => {
+            const u = sanitizeLlmField(s.url);
+            const h = sanitizeLlmField(s.content_hash);
+            const r = sanitizeLlmField(s.retrieved_at);
+            return `- ${u} (${h}, retrieved ${r})`;
+        })
+            .join('\n');
+    const preserveSection = verdict.preserve_warnings.length === 0
+        ? '_None._'
+        : verdict.preserve_warnings.map((w) => `- ${sanitizeLlmField(w)}`).join('\n');
+    const mmrLine = opts.mmrJobId
+        ? `job_id: ${opts.mmrJobId}`
+        : '_Not run inline — see knowledge-freshness CI gates._';
+    // F-003 round-6: every LLM-controlled scalar that's spliced into the PR
+    // body gets `sanitizeLlmField` applied. The Zod schema permits arbitrary
+    // strings for `entry_name`/`audit_date`/`model`/`content_hash`/`retrieved_at`,
+    // so a verdict containing "\nBREAKING CHANGE:" in any of those would
+    // otherwise create a start-of-line footer that deriveBumpKind treats as a
+    // real major bump signal. Sanitizing collapses newlines so the rendered
+    // body cannot inject a footer regardless of model output.
+    return [
+        '## Summary',
+        `Grounded audit of ${sanitizeLlmField(verdict.entry_name)}.md against:`,
+        sourceList,
+        '',
+        '## Verdict',
+        `- verdict: ${sanitizeLlmField(verdict.verdict)}`,
+        `- audit_date: ${sanitizeLlmField(verdict.audit_date)}`,
+        `- model: ${sanitizeLlmField(verdict.model)}`,
+        '',
+        '## Findings',
+        renderFindingsTable(verdict),
+        '',
+        '## MMR',
+        mmrLine,
+        '',
+        '## Sources',
+        provenance,
+        '',
+        '## Preserve warnings',
+        preserveSection,
+        '',
+    ].join('\n');
+}
+/** UTC YYYY-MM-DD for branch naming. Separate so tests can pin the date. */
+export function todayUtcYmd(now = new Date()) {
+    const y = now.getUTCFullYear().toString().padStart(4, '0');
+    const m = (now.getUTCMonth() + 1).toString().padStart(2, '0');
+    const d = now.getUTCDate().toString().padStart(2, '0');
+    return `${y}-${m}-${d}`;
+}
+/**
+ * Sanitize an entry name for use as a git branch component. We never
+ * interpolate raw user-controlled strings into a shell command, but the
+ * entry name does become a branch ref — disallow whitespace, slashes
+ * (already a path separator in the prefix), and non-ascii. The on-disk
+ * entry names in `content/knowledge/*` are all kebab-case ASCII so this
+ * is a safety net, not a transformation.
+ */
+export function sanitizeForBranch(entryName) {
+    const cleaned = entryName.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+    if (cleaned.length === 0)
+        throw new Error(`entry name "${entryName}" sanitized to empty string`);
+    return cleaned;
+}
+export function branchNameForEntry(entryName, ymd) {
+    return `knowledge-freshness/${sanitizeForBranch(entryName)}-${ymd}`;
+}
+export function renderFreshnessPr(verdict, opts = {}) {
+    return {
+        title: renderPrTitle(verdict),
+        body: renderPrBody(verdict, opts),
+        entryName: verdict.entry_name,
+    };
+}
+/** Volatility-tier → PR label mapping. Used for triage/filtering. */
+export function volatilityLabel(volatility) {
+    switch (volatility) {
+        case 'fast-moving': return 'volatility:fast-moving';
+        case 'evolving': return 'volatility:evolving';
+        case 'stable': return 'volatility:stable';
+        default: return undefined;
+    }
+}
+/**
+ * Run a subprocess synchronously and throw on non-zero exit. Captures stdout
+ * + stderr in the thrown error so failures surface a useful message rather
+ * than a bare exit code.
+ */
+function runOrThrow(cmd, args) {
+    const result = spawnSync(cmd, args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        const stderr = result.stderr?.trim() ?? '';
+        const stdout = result.stdout?.trim() ?? '';
+        throw new Error(`command failed: ${cmd} ${args.join(' ')} (exit ${result.status})\n` +
+            (stdout ? `stdout: ${stdout}\n` : '') +
+            (stderr ? `stderr: ${stderr}` : ''));
+    }
+    return result.stdout ?? '';
+}
+/**
+ * Open a freshness PR. Pre-conditions:
+ *   - The on-disk entry at `entryPath` already has the verdict applied.
+ *   - The git working tree must show ONLY `entryPath` as modified (no other
+ *     unrelated changes). This is a safety guard so a manual run can't
+ *     accidentally sweep in unrelated work.
+ *   - `gh` CLI is authenticated.
+ */
+export function openFreshnessPr(verdict, opts) {
+    // Working-tree safety. `git status --porcelain` lists changed paths with a
+    // 2-char status prefix. We require exactly one entry, and it must be the
+    // entry path. Untracked files outside the entry path are also disallowed —
+    // they'd be carried along by `git add <entryPath>` only if the path matches,
+    // but a porcelain check is the cleanest precondition.
+    const porcelain = runOrThrow('git', ['status', '--porcelain']).split('\n').filter((l) => l.length > 0);
+    // Path normalization (round-4 F-001 + round-9 F-002): `git status
+    // --porcelain` outputs paths relative to the GIT REPOSITORY ROOT.
+    // `opts.entryPath` can be:
+    //   - absolute → path.resolve is a no-op
+    //   - relative to cwd → resolve against process.cwd()
+    // Always resolve porcelain output against the repo root.
+    const repoRoot = runOrThrow('git', ['rev-parse', '--show-toplevel']).trim();
+    const targetEntry = path.resolve(process.cwd(), opts.entryPath);
+    const relevant = porcelain.filter((line) => {
+        // Tolerate any 2-char status (M, A, D, ??, etc.); we just need the path.
+        const filePath = line.slice(3).trim();
+        return path.resolve(repoRoot, filePath) === targetEntry;
+    });
+    if (porcelain.length === 0) {
+        throw new Error('refusing to open PR: working tree has no changes (did you forget to apply the verdict?)');
+    }
+    if (porcelain.length !== relevant.length) {
+        const offenders = porcelain.filter((l) => !relevant.includes(l)).map((l) => l.slice(3).trim());
+        throw new Error(`refusing to open PR: working tree has unrelated changes:\n${offenders.map((o) => `  - ${o}`).join('\n')}\n` +
+            'Commit/stash unrelated changes before running --open-pr.');
+    }
+    const ymd = todayUtcYmd(opts.now);
+    const branch = branchNameForEntry(verdict.entry_name, ymd);
+    const rendered = renderFreshnessPr(verdict, { mmrJobId: opts.mmrJobId });
+    // Branch off main so the PR is against the same base regardless of which
+    // local branch the operator was on. `-C` forcefully creates or resets the
+    // branch — needed for re-runs on the same date (workflow_dispatch retry
+    // after a cron failure), where `-c` would fail because the branch already
+    // exists. F-001.
+    runOrThrow('git', ['fetch', 'origin', 'main']);
+    runOrThrow('git', ['switch', '-C', branch, 'origin/main']);
+    // Re-stage the file. After switching branches, the file's working-tree
+    // contents are preserved (since the change wasn't committed), but the
+    // index gets reset; `git add` re-stages explicitly.
+    runOrThrow('git', ['add', '--', opts.entryPath]);
+    // Conventional-commits commit. We pass the body via stdin (-F -) so the
+    // multi-line body survives shell quoting.
+    const commitMsg = `${rendered.title}\n\n${rendered.body}`;
+    const commit = spawnSync('git', ['commit', '-F', '-'], { input: commitMsg, encoding: 'utf8' });
+    if (commit.status !== 0) {
+        throw new Error(`git commit failed (exit ${commit.status})\nstdout: ${commit.stdout}\nstderr: ${commit.stderr}`);
+    }
+    // Force-push so re-runs on the same date overwrite the prior bot-run
+    // branch state instead of erroring (F-002 + F-001 follow-through). This
+    // is safe because branches under `knowledge-freshness/*` are bot-owned;
+    // human edits live on other branches.
+    runOrThrow('git', ['push', '--force-with-lease', '-u', 'origin', branch]);
+    // If a PR already exists for this branch, UPDATE it instead of trying to
+    // create a new one (F-002). gh pr create errors when a PR is already open
+    // for the head ref, which would crash the daily cron on retry.
+    const existingPrList = spawnSync('gh', ['pr', 'list', '--head', branch, '--state', 'open', '--json', 'number,url'], { encoding: 'utf8' });
+    let prUrl = '';
+    if (existingPrList.status === 0) {
+        try {
+            const parsed = JSON.parse(existingPrList.stdout || '[]');
+            if (parsed.length > 0) {
+                const existing = parsed[0];
+                // Update title + body on the existing PR via `gh pr edit`.
+                const editResult = spawnSync('gh', ['pr', 'edit', String(existing.number), '--title', rendered.title, '--body', rendered.body], { encoding: 'utf8' });
+                if (editResult.status !== 0) {
+                    throw new Error(`gh pr edit failed (exit ${editResult.status})\nstdout: ${editResult.stdout}\nstderr: ${editResult.stderr}`);
+                }
+                prUrl = existing.url;
+            }
+        }
+        catch (err) {
+            throw new Error(`failed to parse gh pr list output: ${err.message}`);
+        }
+    }
+    if (!prUrl) {
+        // No existing PR — open a new one. Labels are best-effort and added below.
+        const ghArgs = [
+            'pr', 'create', '--base', 'main', '--head', branch,
+            '--title', rendered.title, '--body', rendered.body,
+        ];
+        const ghResult = spawnSync('gh', ghArgs, { encoding: 'utf8' });
+        if (ghResult.status !== 0) {
+            throw new Error(`gh pr create failed (exit ${ghResult.status})\nstdout: ${ghResult.stdout}\nstderr: ${ghResult.stderr}`);
+        }
+        prUrl = (ghResult.stdout ?? '').trim().split('\n').pop() ?? '';
+    }
+    // Best-effort label attachment. `gh pr edit --add-label` will create
+    // the labels in the repo on first use only if they exist; the workflow's
+    // first manual dispatch should seed them. We swallow errors so a missing
+    // label doesn't fail the PR.
+    const labels = ['knowledge-freshness'];
+    const volLabel = volatilityLabel(opts.volatility);
+    if (volLabel)
+        labels.push(volLabel);
+    const labelArgs = ['pr', 'edit', prUrl, ...labels.flatMap((l) => ['--add-label', l])];
+    const labelResult = spawnSync('gh', labelArgs, { encoding: 'utf8' });
+    if (labelResult.status !== 0) {
+        process.stderr.write(`warning: failed to attach labels (${labels.join(', ')}): ${labelResult.stderr?.trim()}\n`);
+    }
+    return { branch, prUrl };
+}
+/**
+ * Extract `volatility` from an entry's frontmatter. We can't import the
+ * knowledge-loader here because it pulls in the full assembly stack;
+ * a minimal yaml-only read keeps this surface lean.
+ */
+export function readVolatility(entryContent) {
+    // F-004 round-4: tolerate optional UTF-8 BOM (U+FEFF) and CRLF line
+    // endings. The strict /^---\n.../ regex would silently miss-match a
+    // file authored on Windows or with a BOM, leaving the PR without its
+    // volatility label. We strip a leading BOM defensively, then match
+    // both LF and CRLF line endings via \r?\n.
+    const BOM = '';
+    const noBom = entryContent.startsWith(BOM) ? entryContent.slice(BOM.length) : entryContent;
+    const match = noBom.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return undefined;
+    const fm = yaml.load(match[1], { schema: yaml.JSON_SCHEMA });
+    return fm?.volatility;
+}
+//# sourceMappingURL=audit-apply-pr.js.map

package/dist/knowledge-freshness/audit-apply-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-apply-pr.js","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-apply-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,IAAI,MAAM,SAAS,CAAA;AAqB1B;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAqB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IACrC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,OAAO,CAAC;SACL,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC;SACpC,IAAI,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,2DAA2D,CAAA;IAC1E,MAAM,GAAG,GAAG,mBAAmB,CAAA;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAC3C,OAAO,KAAK,QAAQ,MAAM,SAAS,MAAM,KAAK,MAAM,QAAQ,IAAI,CAAA;IAClE,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnE,OAAO,6BAA6B,IAAI,YAAY,OAAO,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,OAAwB,EAAE;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjF,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,OAAO,CAAC,eAAe;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjC,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;YAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAA;QACxC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC5D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE/E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;QAC3B,CAAC,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;QAC5B,CAAC,CAAC,sDAAsD,CAAA;IAE1D,wEAAwE;IACxE,yEAAyE;IACzE,+EAA+E;IAC/E,qEAAqE;IACrE,0EAA0E;IAC1E,wEAAwE;IACxE,0DAA0D;IAC1D,OAAO;QACL,YAAY;QACZ,qBAAqB,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc;QACvE,UAAU;QACV,EAAE;QACF,YAAY;QACZ,cAAc,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACjD,iBAAiB,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QACvD,YAAY,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC7C,EAAE;QACF,aAAa;QACb,mBAAmB,CAAC,OAAO,CAAC;QAC5B,EAAE;QACF,QAAQ;QACR,OAAO;QACP,EAAE;QACF,YAAY;QACZ,UAAU;QACV,EAAE;QACF,sBAAsB;QACtB,eAAe;QACf,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,MAAY,IAAI,IAAI,EAAE;IAChD,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACnF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,6BAA6B,CAAC,CAAA;IAChG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,GAAW;IAC/D,OAAO,uBAAuB,iBAAiB,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,OAAwB,EAAE;IACjF,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;QAC7B,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC5D,QAAQ,UAAU,EAAE,CAAC;QACrB,KAAK,aAAa,CAAC,CAAC,OAAO,wBAAwB,CAAA;QACnD,KAAK,UAAU,CAAC,CAAC,OAAO,qBAAqB,CAAA;QAC7C,KAAK,QAAQ,CAAC,CAAC,OAAO,mBAAmB,CAAA;QACzC,OAAO,CAAC,CAAC,OAAO,SAAS,CAAA;IACzB,CAAC;AACH,CAAC;AAkBD;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC1C,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,MAAM,KAAK;YACpE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAqB,EAAE,IAAmB;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACtG,kEAAkE;IAClE,kEAAkE;IAClE,2BAA2B;IAC3B,yCAAyC;IACzC,sDAAsD;IACtD,yDAAyD;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,WAAW,CAAA;IACzD,CAAC,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA;IAC5G,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9F,MAAM,IAAI,KAAK,CACb,6DAA6D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5G,0DAA0D,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAExE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,iBAAiB;IACjB,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IAE1D,uEAAuE;IACvE,sEAAsE;IACtE,oDAAoD;IACpD,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IAEhD,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,CAChG,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,wEAAwE;IACxE,sCAAsC;IACtC,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IAEzE,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,cAAc,GAAG,SAAS,CAC9B,IAAI,EACJ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,EAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;IACD,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,IAAI,IAAI,CAA2C,CAAA;YAClG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC1B,2DAA2D;gBAC3D,MAAM,UAAU,GAAG,SAAS,CAC1B,IAAI,EACJ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAC3F,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;gBACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,2BAA2B,UAAU,CAAC,MAAM,cAAc,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,EAAE,CAC5G,CAAA;gBACH,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAA;YACtB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,2EAA2E;QAC3E,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YAClD,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI;SACnD,CAAA;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,MAAM,EAAE,CACxG,CAAA;QACH,CAAC;QACD,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IAChE,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACrF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAC3F,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAA;IACf,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAA4B,CAAA;IACvF,OAAO,EAAE,EAAE,UAAU,CAAA;AACvB,CAAC"}

package/dist/knowledge-freshness/audit-apply-pr.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-apply-pr.test.d.ts.map

package/dist/knowledge-freshness/audit-apply-pr.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-apply-pr.test.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-apply-pr.test.ts"],"names":[],"mappings":""}

package/dist/knowledge-freshness/audit-apply-pr.test.js

@@ -0,0 +1,211 @@
+import { describe, it, expect } from 'vitest';
+import { renderPrTitle, renderPrBody, renderFindingsTable, renderFreshnessPr, branchNameForEntry, sanitizeForBranch, todayUtcYmd, volatilityLabel, readVolatility, } from './audit-apply-pr.js';
+const baseVerdict = {
+    entry_name: 'security-owasp',
+    audit_date: '2026-05-25',
+    model: 'claude-opus-4-7',
+    verdict: 'major-drift',
+    sources_checked: [
+        {
+            url: 'https://owasp.org/Top10/',
+            retrieved_at: '2026-05-25',
+            content_hash: 'sha256:abc123',
+            summary: 'OWASP Top 10 landing page',
+        },
+    ],
+    findings: [
+        {
+            claim_in_entry: 'OWASP Top 10 was last updated in 2021.',
+            evidence_url: 'https://owasp.org/Top10/2025/',
+            evidence_date: '2026-05-25',
+            source_excerpt: 'The 2025 edition adds A11 Software Supply Chain Failures.',
+            severity: 'P1',
+            drift_kind: 'edition-supersession',
+        },
+    ],
+    proposed_changes: [
+        {
+            location: '## Summary',
+            kind: 'replace',
+            rationale: 'Note new 2025 edition',
+            new_text: '## Summary\n\n> 2025 edition adds A11.',
+        },
+    ],
+    preserve_warnings: ['Keep ## Deep Guidance heading.'],
+};
+describe('renderPrTitle', () => {
+    it('uses the conventional-commits chore(knowledge) prefix', () => {
+        const title = renderPrTitle(baseVerdict);
+        expect(title.startsWith('chore(knowledge): refresh security-owasp against ')).toBe(true);
+        expect(title).toContain('https://owasp.org/Top10/');
+    });
+    it('summarizes multi-source verdicts with "and N other source(s)"', () => {
+        const v = {
+            ...baseVerdict,
+            sources_checked: [
+                ...baseVerdict.sources_checked,
+                { url: 'https://example.com/a', retrieved_at: '2026-05-25', content_hash: 'sha256:1', summary: '' },
+                { url: 'https://example.com/b', retrieved_at: '2026-05-25', content_hash: 'sha256:2', summary: '' },
+            ],
+        };
+        expect(renderPrTitle(v)).toContain('and 2 other source(s)');
+    });
+});
+describe('renderFindingsTable', () => {
+    it('renders a markdown table with one row per finding', () => {
+        const table = renderFindingsTable(baseVerdict);
+        expect(table).toContain('| severity | drift_kind | claim_in_entry | evidence_url |');
+        expect(table).toContain('|---|---|---|---|');
+        expect(table).toContain('| P1 | edition-supersession |');
+        expect(table).toContain('https://owasp.org/Top10/2025/');
+    });
+    it('escapes pipes and collapses newlines so a stray bar does not break the row', () => {
+        const v = {
+            ...baseVerdict,
+            findings: [{
+                    claim_in_entry: 'has | a pipe and\nnewline',
+                    evidence_url: 'https://x',
+                    evidence_date: '2026-05-25',
+                    source_excerpt: '',
+                    severity: 'P2',
+                    drift_kind: 'fact-change',
+                }],
+        };
+        const table = renderFindingsTable(v);
+        // Pipe must be escaped; newline must collapse to a space.
+        expect(table).toContain('has \\| a pipe and newline');
+        // Exactly 3 rows: header + sep + 1 finding (no extra rows from the newline).
+        expect(table.split('\n').length).toBe(3);
+    });
+    it('emits "_No findings._" when the verdict has no findings', () => {
+        const v = { ...baseVerdict, findings: [] };
+        expect(renderFindingsTable(v)).toBe('_No findings._');
+    });
+});
+describe('renderPrBody', () => {
+    it('contains all required sections in order', () => {
+        const body = renderPrBody(baseVerdict);
+        const sections = ['## Summary', '## Verdict', '## Findings', '## MMR', '## Sources', '## Preserve warnings'];
+        let cursor = -1;
+        for (const s of sections) {
+            const idx = body.indexOf(s);
+            expect(idx).toBeGreaterThan(cursor);
+            cursor = idx;
+        }
+    });
+    it('includes verdict fields verbatim', () => {
+        const body = renderPrBody(baseVerdict);
+        expect(body).toContain('- verdict: major-drift');
+        expect(body).toContain('- audit_date: 2026-05-25');
+        expect(body).toContain('- model: claude-opus-4-7');
+    });
+    it('shows MMR job ID when supplied, placeholder otherwise', () => {
+        expect(renderPrBody(baseVerdict, { mmrJobId: 'job-abc' })).toContain('job_id: job-abc');
+        expect(renderPrBody(baseVerdict)).toContain('_Not run inline');
+    });
+    it('renders source provenance with hash and retrieved date', () => {
+        const body = renderPrBody(baseVerdict);
+        expect(body).toContain('https://owasp.org/Top10/ (sha256:abc123, retrieved 2026-05-25)');
+    });
+    it('shows preserve_warnings list when present, "_None._" when empty', () => {
+        expect(renderPrBody(baseVerdict)).toContain('- Keep ## Deep Guidance heading.');
+        const empty = { ...baseVerdict, preserve_warnings: [] };
+        expect(renderPrBody(empty)).toContain('## Preserve warnings\n_None._');
+    });
+    it('handles a verdict with zero sources_checked without throwing', () => {
+        const v = { ...baseVerdict, sources_checked: [] };
+        const body = renderPrBody(v);
+        expect(body).toContain('_No sources._');
+    });
+    it('strips ALL JS line terminators from LLM fields (round-7 F-002/F-003/F-004)', () => {
+        // Build a verdict whose preserve_warnings contains every JS line
+        // terminator followed by BREAKING CHANGE:. The rendered body must NOT
+        // contain a start-of-line "BREAKING CHANGE:" — otherwise the
+        // version-bump workflow would treat it as a real major-bump footer.
+        const v = {
+            ...baseVerdict,
+            preserve_warnings: [
+                'before\nBREAKING CHANGE: injected via LF',
+                'before\rBREAKING CHANGE: injected via CR',
+                'before\r\nBREAKING CHANGE: injected via CRLF',
+                'before
BREAKING CHANGE: injected via LS',
+                'before
BREAKING CHANGE: injected via PS',
+            ],
+        };
+        const body = renderPrBody(v);
+        // No matter which terminator the LLM used, none of them should produce
+        // a line whose start is "BREAKING CHANGE:". A multiline-anchor regex
+        // confirms the round-2 deriveBumpKind check would now see zero matches.
+        expect(/^BREAKING CHANGE:/m.test(body)).toBe(false);
+    });
+    it('strips line terminators from findings-table cells too', () => {
+        const v = {
+            ...baseVerdict,
+            findings: [{
+                    claim_in_entry: 'old claim\rBREAKING CHANGE: still smuggled',
+                    evidence_url: 'https://example.org/x',
+                    evidence_date: '2026-05-25',
+                    source_excerpt: 'irrelevant',
+                    severity: 'P1',
+                    drift_kind: 'wording',
+                }],
+        };
+        const body = renderPrBody(v);
+        expect(/^BREAKING CHANGE:/m.test(body)).toBe(false);
+    });
+});
+describe('renderFreshnessPr', () => {
+    it('returns title, body, and entry_name in one structured payload', () => {
+        const out = renderFreshnessPr(baseVerdict, { mmrJobId: 'job-xyz' });
+        expect(out.title).toContain('chore(knowledge): refresh security-owasp');
+        expect(out.body).toContain('job_id: job-xyz');
+        expect(out.entryName).toBe('security-owasp');
+    });
+});
+describe('branchNameForEntry', () => {
+    it('uses the knowledge-freshness/<entry>-<date> shape', () => {
+        expect(branchNameForEntry('security-owasp', '2026-05-25')).toBe('knowledge-freshness/security-owasp-2026-05-25');
+    });
+    it('sanitizes whitespace and forbidden characters out of the entry name', () => {
+        expect(sanitizeForBranch('a b/c d')).toBe('a-b-c-d');
+        expect(sanitizeForBranch('--leading-trailing--')).toBe('leading-trailing');
+        expect(() => sanitizeForBranch('/// ')).toThrow(/empty string/);
+    });
+});
+describe('todayUtcYmd', () => {
+    it('formats UTC date as YYYY-MM-DD with leading zeros', () => {
+        expect(todayUtcYmd(new Date('2026-01-05T23:59:59Z'))).toBe('2026-01-05');
+    });
+    it('uses UTC, not local time (boundary case)', () => {
+        // 2026-05-25 23:30 UTC is still 2026-05-25 in UTC regardless of local TZ.
+        expect(todayUtcYmd(new Date('2026-05-25T23:30:00Z'))).toBe('2026-05-25');
+    });
+});
+describe('volatilityLabel', () => {
+    it('maps known volatility values to labels', () => {
+        expect(volatilityLabel('fast-moving')).toBe('volatility:fast-moving');
+        expect(volatilityLabel('evolving')).toBe('volatility:evolving');
+        expect(volatilityLabel('stable')).toBe('volatility:stable');
+    });
+    it('returns undefined for unknown values so we do not attach a bogus label', () => {
+        expect(volatilityLabel(undefined)).toBeUndefined();
+        expect(volatilityLabel('something-else')).toBeUndefined();
+    });
+});
+describe('readVolatility', () => {
+    it('parses volatility from a frontmatter block', () => {
+        const entry = `---
+name: x
+volatility: fast-moving
+sources: []
+---
+
+body
+`;
+        expect(readVolatility(entry)).toBe('fast-moving');
+    });
+    it('returns undefined when there is no frontmatter', () => {
+        expect(readVolatility('# no frontmatter')).toBeUndefined();
+    });
+});
+//# sourceMappingURL=audit-apply-pr.test.js.map

package/dist/knowledge-freshness/audit-apply-pr.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-apply-pr.test.js","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-apply-pr.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,qBAAqB,CAAA;AAG5B,MAAM,WAAW,GAAiB;IAChC,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,YAAY;IACxB,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,aAAa;IACtB,eAAe,EAAE;QACf;YACE,GAAG,EAAE,0BAA0B;YAC/B,YAAY,EAAE,YAAY;YAC1B,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,2BAA2B;SACrC;KACF;IACD,QAAQ,EAAE;QACR;YACE,cAAc,EAAE,wCAAwC;YACxD,YAAY,EAAE,+BAA+B;YAC7C,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE,2DAA2D;YAC3E,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,sBAAsB;SACnC;KACF;IACD,gBAAgB,EAAE;QAChB;YACE,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,uBAAuB;YAClC,QAAQ,EAAE,wCAAwC;SACnD;KACF;IACD,iBAAiB,EAAE,CAAC,gCAAgC,CAAC;CACtD,CAAA;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAiB;YACtB,GAAG,WAAW;YACd,eAAe,EAAE;gBACf,GAAG,WAAW,CAAC,eAAe;gBAC9B,EAAE,GAAG,EAAE,uBAAuB,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnG,EAAE,GAAG,EAAE,uBAAuB,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;aACpG;SACF,CAAA;QACD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAA;QACpF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,GAAiB;YACtB,GAAG,WAAW;YACd,QAAQ,EAAE,CAAC;oBACT,cAAc,EAAE,2BAA2B;oBAC3C,YAAY,EAAE,WAAW;oBACzB,aAAa,EAAE,YAAY;oBAC3B,cAAc,EAAE,EAAE;oBAClB,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,aAAa;iBAC1B,CAAC;SACH,CAAA;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACpC,0DAA0D;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAA;QACrD,6EAA6E;QAC7E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAiB,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;QACxD,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAA;QAC5G,IAAI,MAAM,GAAG,CAAC,CAAC,CAAA;QACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACvF,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gEAAgE,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAiB,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;QACrE,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAiB,EAAE,GAAG,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,iEAAiE;QACjE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,MAAM,CAAC,GAAiB;YACtB,GAAG,WAAW;YACd,iBAAiB,EAAE;gBACjB,0CAA0C;gBAC1C,0CAA0C;gBAC1C,8CAA8C;gBAC9C;iCACyB;gBACzB;iCACyB;aAC1B;SACF,CAAA;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC5B,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAiB;YACtB,GAAG,WAAW;YACd,QAAQ,EAAE,CAAC;oBACT,cAAc,EAAE,4CAA4C;oBAC5D,YAAY,EAAE,uBAAuB;oBACrC,aAAa,EAAE,YAAY;oBAC3B,cAAc,EAAE,YAAY;oBAC5B,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,SAAS;iBACtB,CAAC;SACH,CAAA;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAClH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,0EAA0E;QAC1E,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACrE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC/D,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAClD,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG;;;;;;;CAOjB,CAAA;QACG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/audit-apply.d.ts

@@ -0,0 +1,16 @@
+import type { AuditVerdict } from './audit-runner.js';
+/** Strip a URL fragment/anchor so verdict sources match frontmatter sources reliably. */
+export declare function normalizeUrl(u: string): string;
+export interface ApplyOptions {
+    /**
+     * Optional map of normalized-url → fresh sha256 hash, computed deterministically
+     * by the caller (typically the CLI wrapper, which re-fetches each
+     * `verdict.sources_checked.url` before calling apply). When provided, these
+     * hashes are persisted to frontmatter instead of the LLM-claimed
+     * `content_hash` (which is not deterministically verifiable). When omitted —
+     * e.g. in unit tests — apply falls back to the LLM-claimed hash.
+     */
+    trustedHashes?: Map<string, string>;
+}
+export declare function applyVerdictToEntry(original: string, verdict: AuditVerdict, opts?: ApplyOptions): string;
+//# sourceMappingURL=audit-apply.d.ts.map

package/dist/knowledge-freshness/audit-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-apply.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAyBrD,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9C;AAKD,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,EACrB,IAAI,GAAE,YAAiB,GACtB,MAAM,CAqKR"}