filegrc 0.16.0 → 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -207,7 +207,7 @@ function canonicalFieldValue(model, value, field, name, revisionMap = false) {
       : value;
   }
   return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(name))
-    ? canonicalCalculatedRevision(value)
+    ? canonicalCalculatedRevision(value, name)
     : value;
 }
 

package/src/collection-review-integrity.js

@@ -1,5 +1,5 @@
 import { loadModel } from "../model/index.js";
-import { collectionRevision } from "./collection-revision.js";
+import { collectionRevision, collectionRevisionMatches } from "./collection-revision.js";
 import { scopedCollectionRecords } from "./collection-scope.js";
 import { getDataFilesAtRevision, getFileAtRevision, getRecordIdentityHistory, hasGitRevision } from "./git.js";
 import { currentCalendarDate, isRfc3339Timestamp } from "./time.js";
@@ -70,7 +70,11 @@ export function historicalCollectionReviewSnapshot(root, record, model, timezone
     authoritativeSourceId: record.authoritativeComponentId
   });
   if (
-    !revisionsMatch("collection", record.collectionRevision, currentRevision)
+    !collectionRevisionMatches(snapshot, resourceType, record.collectionRevision, {
+      program,
+      authoritativeSourceId: record.authoritativeComponentId,
+      currentRevision
+    })
     || JSON.stringify([...(record.populationResourceIds || [])].sort()) !== JSON.stringify(collectionIds)
   ) return null;
   const selectedIds = selector

package/src/collection-revision.js

@@ -12,25 +12,37 @@ import { markdownEntries } from "./resource-markdown.js";
 import { CALCULATED_REVISION_FIELDS, CALCULATED_REVISION_MAP_FIELDS, calculateRevision, canonicalCalculatedRevision, revisionsMatch } from "./revisions.js";
 
 export function collectionRevision(loaded, resourceType, options = {}) {
-  return calculateCollectionRevision(loaded, resourceType, options, false);
+  return calculateCollectionRevision(loaded, resourceType, options, false, options.scopeHashInput || "legacy", options.scopeFactsInput || "legacy");
 }
 
 export function legacyCollectionRevision(loaded, resourceType, options = {}) {
-  return calculateCollectionRevision(loaded, resourceType, options, true);
+  return calculateCollectionRevision(loaded, resourceType, options, true, options.scopeHashInput || "legacy", options.scopeFactsInput || "legacy");
 }
 
 export function collectionRevisionMatches(loaded, resourceType, storedRevision, options = {}) {
   if (!storedRevision) return false;
   const currentRevision = options.currentRevision
     || collectionRevision(loaded, resourceType, options);
-  // Version 0.9.2 narrowed this hash basis. Keep unchanged 0.9.1 reviews valid
-  // until management records a new review on the current basis.
-  return revisionsMatch("collection", storedRevision, currentRevision)
-    || (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval"))
-      && revisionsMatch("collection", storedRevision, legacyCollectionRevision(loaded, resourceType, options));
+  // Accept both the pre-0.16 scope: input and the digest-only input used by
+  // 0.16.0, as well as the older collection basis from 0.9.1.
+  if (revisionsMatch("collection", storedRevision, currentRevision)) return true;
+  const allowOlderBasis = resourceType !== "retention-schedule-item"
+    || !modelSupports(loaded.model, "retention-schedule-approval");
+  for (const olderBasis of [false, true]) {
+    if (olderBasis && !allowOlderBasis) continue;
+    for (const scopeHashInput of ["legacy", "digest"]) {
+      for (const scopeFactsInput of ["legacy", "source"]) {
+        if (!olderBasis && scopeHashInput === "legacy" && scopeFactsInput === "legacy") continue;
+        if (revisionsMatch("collection", storedRevision, calculateCollectionRevision(
+          loaded, resourceType, options, olderBasis, scopeHashInput, scopeFactsInput
+        ))) return true;
+      }
+    }
+  }
+  return false;
 }
 
-function calculateCollectionRevision(loaded, resourceType, options, legacy) {
+function calculateCollectionRevision(loaded, resourceType, options, legacy, scopeHashInput = "legacy", scopeFactsInput = "legacy") {
   const workspaceWideRetentionReview = resourceType === "retention-schedule-item"
     && modelSupports(loaded.model, "retention-schedule-approval")
     && !legacy;
@@ -55,7 +67,7 @@ function calculateCollectionRevision(loaded, resourceType, options, legacy) {
     .map(({ record, value, includeContent }) => ({
       id: record.id,
       revision: createHash("sha256")
-        .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value)))
+        .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value, scopeHashInput)))
         .digest("hex"),
       contentRevisions: (legacy || includeContent ? markdownEntries(loaded.model, record) : []).flatMap(({ path }) => {
         try {
@@ -68,35 +80,46 @@ function calculateCollectionRevision(loaded, resourceType, options, legacy) {
       })
     }))
     .sort((left, right) => left.id.localeCompare(right.id));
-  const workspaceScope = collectionScopeRevisionFacts(loaded, resourceType, program);
+  const scopeFacts = collectionScopeRevisionFacts(loaded, resourceType, program);
+  const workspaceScope = scopeFactsInput === "source" ? scopeFacts : canonicalScopeFacts(scopeFacts);
   const source = JSON.stringify({ resourceType, records, workspaceScope });
   return legacy
     ? createHash("sha256").update(source).digest("hex")
     : calculateRevision("collection", source);
 }
 
-function canonicalRecordValue(model, resourceType, value) {
+function canonicalScopeFacts(value, field = null) {
+  if (Array.isArray(value)) return value.map((item) => canonicalScopeFacts(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, canonicalScopeFacts(item, key)]));
+  }
+  return field === "scopeRevision" && typeof value === "string"
+    ? canonicalCalculatedRevision(value, field)
+    : value;
+}
+
+function canonicalRecordValue(model, resourceType, value, scopeHashInput) {
   const fields = {
     ...model.commonFields,
     ...model.resources[resourceType]?.fields
   };
-  return canonicalObject(model, value, fields);
+  return canonicalObject(model, value, fields, false, scopeHashInput);
 }
 
-function canonicalObject(model, value, fields = {}, revisionMap = false) {
+function canonicalObject(model, value, fields = {}, revisionMap = false, scopeHashInput = "legacy") {
   return Object.fromEntries(Object.keys(value).sort().map((name) => [
     name,
-    canonicalFieldValue(model, value[name], fields[name], name, revisionMap)
+    canonicalFieldValue(model, value[name], fields[name], name, revisionMap, scopeHashInput)
   ]));
 }
 
-function canonicalFieldValue(model, value, field, name, revisionMap = false) {
+function canonicalFieldValue(model, value, field, name, revisionMap = false, scopeHashInput = "legacy") {
   if (Array.isArray(value)) {
     const objectType = field?.itemObjectType;
     const itemFields = objectType ? model.objectTypes?.[objectType]?.properties : undefined;
     const items = value.map((item) => (
       item && typeof item === "object" && !Array.isArray(item)
-        ? canonicalObject(model, item, itemFields)
+        ? canonicalObject(model, item, itemFields, false, scopeHashInput)
         : item
     ));
     return field?.type === "array"
@@ -105,10 +128,10 @@ function canonicalFieldValue(model, value, field, name, revisionMap = false) {
   }
   if (value && typeof value === "object") {
     const objectType = field?.objectType;
-    return canonicalObject(model, value, objectType ? model.objectTypes?.[objectType]?.properties : undefined, CALCULATED_REVISION_MAP_FIELDS.has(name));
+    return canonicalObject(model, value, objectType ? model.objectTypes?.[objectType]?.properties : undefined, CALCULATED_REVISION_MAP_FIELDS.has(name), scopeHashInput);
   }
   return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(name))
-    ? canonicalCalculatedRevision(value)
+    ? canonicalCalculatedRevision(value, name, scopeHashInput)
     : value;
 }
 

package/src/program-amendment.js

@@ -1,5 +1,5 @@
 import { findResourceReferences } from "./agent.js";
-import { resourceReviewRevision, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
+import { resourceReviewRevision, resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { loadWorkspace } from "./workspace.js";
 
 const SOURCE_TYPES = new Set(["policy", "document", "framework", "requirement", "commitment"]);
@@ -114,7 +114,8 @@ export async function planProgramAmendment(input, options = {}) {
     && reviewBindingsDiffer(
       [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])],
       record.reviewedSourceRevisions,
-      currentReviewRevisions
+      currentReviewRevisions,
+      loaded
     )
   ));
   if (staleMappings.length) {
@@ -127,7 +128,7 @@ export async function planProgramAmendment(input, options = {}) {
   const retention = related.filter((record) => (
     record.type === "retention-schedule-item"
     && record.status === "active"
-    && reviewBindingsDiffer(retentionReviewResourceIds(record, loaded), record.reviewedSourceRevisions, currentReviewRevisions)
+    && reviewBindingsDiffer(retentionReviewResourceIds(record, loaded), record.reviewedSourceRevisions, currentReviewRevisions, loaded)
   ));
   if (retention.length) {
     missing.push({
@@ -160,10 +161,10 @@ export async function planProgramAmendment(input, options = {}) {
   };
 }
 
-function reviewBindingsDiffer(expectedIds, reviewed = {}, current) {
+function reviewBindingsDiffer(expectedIds, reviewed = {}, current, loaded) {
   const expected = new Set(expectedIds);
   if (Object.keys(reviewed).length !== expected.size) return true;
-  return [...expected].some((id) => !current.get(id) || reviewed[id] !== current.get(id));
+  return [...expected].some((id) => !resourceReviewRevisionMatches(loaded, current, id, reviewed[id]));
 }
 
 export async function assessProgramAmendmentReadiness(loaded) {

package/src/requirement-mapping.js

@@ -1,5 +1,4 @@
-import { resourceReviewRevisions } from "./retention.js";
-import { revisionsMatch } from "./revisions.js";
+import { resourceReviewRevisionMatches, resourceReviewRevisions } from "./retention.js";
 
 export async function assessRequirementMappingReadiness(loaded) {
   if (!loaded.model.resources["requirement-mapping"]) return [];
@@ -18,7 +17,7 @@ export async function assessRequirementMappingReadiness(loaded) {
       ...(mapping.targetResourceIds || [])
     ])];
     const staleIds = mappedIds.filter((id) => (
-      !revisions.get(id) || !revisionsMatch("content", mapping.reviewedSourceRevisions?.[id], revisions.get(id))
+      !resourceReviewRevisionMatches(loaded, revisions, id, mapping.reviewedSourceRevisions?.[id])
     )).concat(Object.keys(mapping.reviewedSourceRevisions || {}).filter((id) => !mappedIds.includes(id)));
     const structurallyComplete = mappingStructureIsComplete(mapping);
     const complete = mapping.status === "active" && structurallyComplete && staleIds.length === 0;

package/src/retention.js

@@ -154,7 +154,7 @@ export async function resourceReviewRevision(loaded, resourceId) {
   return (await resourceReviewRevisions(loaded, [resourceId])).get(resourceId) || null;
 }
 
-export async function resourceReviewRevisions(loaded, ids) {
+export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "legacy") {
   const wanted = new Set(ids);
   const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
   const revisions = new Map();
@@ -164,7 +164,7 @@ export async function resourceReviewRevisions(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [reviewSource(loaded, entry)];
+    const parts = [reviewSource(loaded, entry, scopeHashInput)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -187,7 +187,7 @@ export async function resourceReviewRevisions(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
-export function resourceReviewRevisionsSync(loaded, ids) {
+export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legacy") {
   const wanted = new Set(ids);
   const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
   const revisions = new Map();
@@ -197,7 +197,7 @@ export function resourceReviewRevisionsSync(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [reviewSource(loaded, entry)];
+    const parts = [reviewSource(loaded, entry, scopeHashInput)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -218,6 +218,16 @@ export function resourceReviewRevisionsSync(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
+export function resourceReviewRevisionMatches(loaded, revisions, id, stored) {
+  const current = revisions.get(id);
+  if (!current || !revisionDigest("content", stored)) return false;
+  if (revisionsMatch("content", stored, current)) return true;
+  // Version 0.16.0 used a bare digest as the hash input for scopeRevision.
+  // Read that binding without changing the legacy scope: basis restored here.
+  const compatible = resourceReviewRevisionsSync(loaded, [id], "digest").get(id);
+  return revisionsMatch("content", stored, compatible);
+}
+
 export function retentionUses(loaded, program) {
   const systemIds = new Set(program.systemIds || []);
   const componentIds = new Set(programComponents(loaded, program).map(({ id }) => id));
@@ -239,7 +249,7 @@ export function retentionUses(loaded, program) {
   return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
 }
 
-function reviewSource(loaded, entry) {
+function reviewSource(loaded, entry, scopeHashInput = "legacy") {
   if (
     modelSupports(loaded.model, "retention-schedule-approval")
     && entry.record.type === "document"
@@ -261,7 +271,7 @@ function reviewSource(loaded, entry) {
     ]) delete approved[field];
     return JSON.stringify(approved);
   }
-  return canonicalCalculatedRevisionJson(entry.source);
+  return canonicalCalculatedRevisionJson(entry.source, scopeHashInput);
 }
 
 export function nearDuplicateInformationTypes(records) {
@@ -327,7 +337,7 @@ export function retentionRuleIsCurrent(rule, revisions, byId = new Map(), loaded
   const dependencyIds = retentionReviewResourceIds(rule, loaded);
   if (Object.keys(rule.reviewedSourceRevisions).length !== dependencyIds.length) return false;
   return dependencyIds.every((id) => (
-    revisions.get(id) && revisionsMatch("content", rule.reviewedSourceRevisions?.[id], revisions.get(id))
+    resourceReviewRevisionMatches(loaded, revisions, id, rule.reviewedSourceRevisions?.[id])
   ));
 }
 

package/src/revisions.js

@@ -59,8 +59,17 @@ export function calculatedRevisionDiagnostic(kind, stored, current) {
   };
 }
 
-export function canonicalCalculatedRevision(value) {
+export function canonicalCalculatedRevision(value, field = null, scopeHashInput = "legacy") {
   const text = String(value || "");
+  // Legacy applicability reviews stored their scope digest with a `scope:`
+  // label. Keep that exact hash input when a newer scheme labels the same
+  // decision, including when the review is embedded in another source record.
+  if (field === "scopeRevision" && scopeHashInput === "legacy") {
+    const scopeDigest = revisionDigest("applicability-scope", text);
+    if (scopeDigest && (text.startsWith("scope:") || text.startsWith(PREFIXES["applicability-scope"]))) {
+      return `scope:${scopeDigest}`;
+    }
+  }
   // Keep the original digest as the calculation input. Merely installing a
   // scheme-aware engine must not stale a decision made over unchanged facts.
   if (/^[a-f0-9]{64}$/.test(text)) return text;
@@ -71,22 +80,22 @@ export function canonicalCalculatedRevision(value) {
 
 // Preserve JSON layout because older resource-review bindings hashed the exact
 // source bytes. Only scheme labels in model-defined revision slots may change.
-export function canonicalCalculatedRevisionJson(source) {
+export function canonicalCalculatedRevisionJson(source, scopeHashInput = "legacy") {
   const fieldNames = [...CALCULATED_REVISION_FIELDS].join("|");
   const mapNames = [...CALCULATED_REVISION_MAP_FIELDS].join("|");
   const stringValue = /("(?:\\.|[^"\\])*")(\s*:\s*)("(?:\\.|[^"\\])*")/g;
-  const canonicalValue = (quoted) => {
+  const canonicalValue = (quoted, field) => {
     const value = JSON.parse(quoted);
-    const canonical = canonicalCalculatedRevision(value);
+    const canonical = canonicalCalculatedRevision(value, field, scopeHashInput);
     return canonical === value ? quoted : JSON.stringify(canonical);
   };
   return source
     .replace(new RegExp(`("(?:${fieldNames})")(\\s*:\\s*)("(?:\\\\.|[^"\\\\])*")`, "g"),
-      (_match, key, separator, value) => `${key}${separator}${canonicalValue(value)}`)
+      (_match, key, separator, value) => `${key}${separator}${canonicalValue(value, JSON.parse(key))}`)
     .replace(new RegExp(`("(?:${mapNames})")(\\s*:\\s*\\{)([^{}]*)(\\})`, "g"),
       (_match, key, opening, body, closing) => (
         `${key}${opening}${body.replace(stringValue, (_pair, name, separator, value) => (
-          `${name}${separator}${canonicalValue(value)}`
+          `${name}${separator}${canonicalValue(value, JSON.parse(name))}`
         ))}${closing}`
       ));
 }

package/src/validate.js

@@ -18,7 +18,7 @@ import {
   parseCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
+import { resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 import { obligationIsEnabled } from "./program-lifecycle.js";
 import { currentPartyPeople, partyPeople } from "./parties.js";
@@ -156,7 +156,7 @@ async function validateWorkspaceUnmeasured(input) {
       validateObligationOccurrence(record, loaded.model, loaded.resources, loaded.entries, loaded.root, loaded.workspace.timezone, byId, asOf, displayPath, diagnostics);
     }
     if (record.type === "retention-schedule-item") validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisions, displayPath, diagnostics);
-    if (record.type === "requirement-mapping") validateRequirementMapping(record, currentReviewRevisions, displayPath, diagnostics);
+    if (record.type === "requirement-mapping") validateRequirementMapping(record, loaded, currentReviewRevisions, displayPath, diagnostics);
     if (record.type === "action-item") {
       validateCompletedObligationAction(record, byId, loaded.model, displayPath, diagnostics);
     }
@@ -1998,7 +1998,7 @@ function validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisi
   const sources = retentionReviewResourceIds(record, loaded);
   const revisions = record.reviewedSourceRevisions || {};
   const missing = sources.filter((id) => (
-    !currentReviewRevisions.get(id) || !revisionsMatch("content", revisions[id], currentReviewRevisions.get(id))
+    !resourceReviewRevisionMatches(loaded, currentReviewRevisions, id, revisions[id])
   )).concat(Object.keys(revisions).filter((id) => !sources.includes(id)));
   if (missing.length) {
     diagnostics.push(error(
@@ -2009,7 +2009,7 @@ function validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisi
   }
 }
 
-function validateRequirementMapping(record, currentReviewRevisions, path, diagnostics) {
+function validateRequirementMapping(record, loaded, currentReviewRevisions, path, diagnostics) {
   const overlap = (record.sourceResourceIds || []).filter((id) => (record.targetResourceIds || []).includes(id));
   if (overlap.length) {
     diagnostics.push(error(
@@ -2022,7 +2022,7 @@ function validateRequirementMapping(record, currentReviewRevisions, path, diagno
   const mappedIds = [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])];
   const revisions = record.reviewedSourceRevisions || {};
   const missing = mappedIds.filter((id) => (
-    !currentReviewRevisions.get(id) || !revisionsMatch("content", revisions[id], currentReviewRevisions.get(id))
+    !resourceReviewRevisionMatches(loaded, currentReviewRevisions, id, revisions[id])
   )).concat(Object.keys(revisions).filter((id) => !mappedIds.includes(id)));
   if (missing.length) {
     diagnostics.push(error(

package/src/workflow-history-integrity.js

@@ -836,7 +836,7 @@ function canonicalJson(value, field = null, revisionMap = false) {
   if (Array.isArray(value)) return value.map((item) => canonicalJson(item));
   if (!value || typeof value !== "object") {
     return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(field))
-      ? canonicalCalculatedRevision(value)
+      ? canonicalCalculatedRevision(value, field)
       : value;
   }
   return Object.fromEntries(Object.keys(value).sort().map((key) => [