circle-ir-ai 2.18.2 → 2.18.3

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.18.3] - 2026-06-24
+
+### Dependencies
+
+- Bump `circle-ir` `3.104.0` → `3.106.0`. Sprints 47 and 48 of the
+  cognium-dev monorepo:
+  - **3.105.0** — Sprint 47 closes the Tier-D policy queue
+    (cognium-dev #161, #163, #164, #165, #168, #177). Introduces the
+    `library-api-surface:caller-responsibility` tag and the central
+    `applyLibraryApiSurfaceDowngrade` hook that downgrades sinks owned
+    by library API surface methods (default-config, factory, accessor
+    patterns) from `high` to `info` while preserving the
+    `original_severity` field on `SastFinding` for restoration.
+  - **3.106.0** — Sprint 48 ships ADR-008 project-profile architecture
+    (cognium-dev#169). New `AnalyzerOptions.projectProfile?:
+    ProjectProfile | Map<string, ProjectProfile>` enables the calling
+    CLI to declare the project's intent (`{ shape: 'library' |
+    'application' | 'cli' | 'server' | 'plugin', env: 'production' |
+    'dev' | 'sample' | 'benchmark' | 'test' }`) so the engine can
+    apply the 5×5 matrix-aware severity transform internally. Wired
+    inside `analyze()`; no new public function exports.
+
+### Engine API surface (additive, opt-in)
+
+- New type-level exports propagate through circle-ir-ai's
+  `export * from 'circle-ir'`: `ProjectShape`, `ProjectEnv`,
+  `ProjectProfile`. These are TypeScript-only (erased at runtime;
+  not enumerable on the imported module object).
+- `analyze()` / `analyzeProject()` accept the new
+  `AnalyzerOptions.projectProfile?: ProjectProfile | Map<string,
+  ProjectProfile>` field (single profile applies to every file, or
+  per-file map for monorepos).
+- The internal helpers `applyLibraryApiSurfaceDowngrade` and
+  `applyProjectProfileTransform` are NOT exposed at the package
+  boundary in 3.106.0 — they are wired inside `analyzer.js` between
+  the verification pass and the response build. Callers consume the
+  behaviour transparently through `analyze()`; downgraded findings
+  carry `library-api-surface:caller-responsibility` in their tag set
+  and the pre-downgrade severity is preserved as
+  `SastFinding.original_severity`.
+- No mastra workflow / scanner changes; this release is a pure
+  dependency cascade. The CLI layer in a follow-up cognium-ai release
+  will wire `cognium.config.json#projectProfile` through to
+  `analyzeOptions`.
+
+### Verification
+
+- `npm run typecheck` — clean.
+- `npm run build` — clean.
+- `npm test` — **900 / 900 pass** (3 skipped, unchanged from 2.18.2).
+- `npm ls circle-ir` — resolves to `3.106.0`.
+
 ## [2.18.2] - 2026-06-24
 
 ### Added

package/dist/agents/mastra/agents.d.ts

@@ -18,7 +18,7 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
         annotations: string;
         imports: string;
     }, {
-        role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+        role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
         confidence: number;
         reasoning: string;
         indicators: string[];
@@ -121,7 +121,7 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         annotations: string;
         imports: string;
     }, {
-        role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+        role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
         confidence: number;
         reasoning: string;
         indicators: string[];
@@ -205,7 +205,7 @@ export declare const agents: {
             annotations: string;
             imports: string;
         }, {
-            role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+            role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
             confidence: number;
             reasoning: string;
             indicators: string[];
@@ -292,7 +292,7 @@ export declare const agents: {
             annotations: string;
             imports: string;
         }, {
-            role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+            role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
             confidence: number;
             reasoning: string;
             indicators: string[];

package/dist/agents/mastra/instance.d.ts

@@ -27,7 +27,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 annotations: string;
                 imports: string;
             }, {
-                role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+                role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
                 confidence: number;
                 reasoning: string;
                 indicators: string[];
@@ -114,7 +114,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 annotations: string;
                 imports: string;
             }, {
-                role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+                role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
                 confidence: number;
                 reasoning: string;
                 indicators: string[];
@@ -199,7 +199,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 annotations: string;
                 imports: string;
             }, {
-                role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+                role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
                 confidence: number;
                 reasoning: string;
                 indicators: string[];
@@ -286,7 +286,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 annotations: string;
                 imports: string;
             }, {
-                role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+                role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
                 confidence: number;
                 reasoning: string;
                 indicators: string[];

package/dist/llm/schemas.d.ts

@@ -21,7 +21,7 @@ export declare const RoleClassificationResponseSchema: z.ZodEffects<z.ZodObject<
     reasoning?: string | undefined;
     indicators?: string[] | undefined;
 }>, {
-    role: "controller" | "service" | "repository" | "utility" | "entity" | "unknown";
+    role: "unknown" | "controller" | "service" | "repository" | "utility" | "entity";
     confidence: number;
     reasoning: string;
     indicators: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.18.2",
+  "version": "2.18.3",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -95,7 +95,7 @@
   "dependencies": {
     "@ax-llm/ax": "^20.0.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.104.0",
+    "circle-ir": "3.106.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },