filegrc 0.16.19 → 0.16.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.19",
+  "version": "0.16.21",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/collection-scope.js

@@ -1,6 +1,6 @@
 import { modelSupports } from "../model/index.js";
 import { programComponents, selectedRequirementIds } from "./program.js";
-import { resourceReviewRevisionsSync, retentionReviewResourceIds, retentionUses } from "./retention.js";
+import { resourceReviewRevisionsSync, retentionReviewResourceIds, retentionSystemUses, retentionUses } from "./retention.js";
 import { documentIsAuditSpecific } from "./program-lifecycle.js";
 
 export function scopedCollectionRecords(loaded, resourceType, program) {
@@ -625,6 +625,10 @@ function dependencyRevisionValue(resourceType, record, legacy, historicalReviewM
   const value = Object.fromEntries(fields
     .filter((field) => record[field] !== undefined)
     .map((field) => [field, record[field]]));
+  if (resourceType === "retention-schedule-item" && currentModel && !historicalReviewMetadata
+    && !legacyRetentionSourceBasis && record.type === "component") {
+    value.systemUses = retentionSystemUses(value.systemUses);
+  }
   if (controlDecision) value.unavailable = ["not-applicable", "retired", "superseded"].includes(record.status);
   return value;
 }

package/src/retention.js

@@ -167,8 +167,9 @@ export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "leg
     const entry = effectiveReviewEntry(loaded, entries.get(id));
     if (!entry || reviewing.has(key)) return null;
     reviewing.add(key);
-    const parts = [reviewSource(loaded, entry, scopeHashInput, false, heading)];
-    let matchedSection = !heading;
+    const decisionHeading = heading || retentionPolicyHeading(loaded, entry, reviewer);
+    const parts = [reviewSource(loaded, entry, scopeHashInput, false, decisionHeading, reviewer)];
+    let matchedSection = !decisionHeading;
     for (const markdown of reviewMarkdownEntries(loaded, entry, false)) {
       try {
         const source = entry.reviewCommit
@@ -176,7 +177,7 @@ export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "leg
             ?? getFileAtRevision(loaded.root, entry.reviewCommit, `data/${markdown.path}`)
           : await readFile(resolveDataPath(loaded.root, markdown.path), "utf8");
         if (source !== null) {
-          const section = reviewedMarkdownSection(source, heading);
+          const section = reviewedMarkdownSection(source, decisionHeading);
           if (section !== null) { parts.push(section); matchedSection = true; }
         }
       } catch (error) {
@@ -214,8 +215,9 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
     const entry = historicalCommit ? entries.get(id) : effectiveReviewEntry(loaded, entries.get(id));
     if (!entry || reviewing.has(key)) return null;
     reviewing.add(key);
-    const parts = [reviewSource(loaded, entry, scopeHashInput, legacySource, heading)];
-    let matchedSection = !heading;
+    const decisionHeading = legacySource ? heading : heading || retentionPolicyHeading(loaded, entry, reviewer);
+    const parts = [reviewSource(loaded, entry, scopeHashInput, legacySource, decisionHeading, reviewer)];
+    let matchedSection = !decisionHeading;
     for (const markdown of reviewMarkdownEntries(loaded, entry, legacySource)) {
       try {
         const source = (historicalCommit || entry.reviewCommit)
@@ -224,7 +226,7 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
             ?? getFileAtRevision(loaded.root, historicalCommit || entry.reviewCommit, `data/${markdown.path}`)
           : readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8");
         if (source !== null) {
-          const section = legacySource ? source : reviewedMarkdownSection(source, heading);
+          const section = legacySource ? source : reviewedMarkdownSection(source, decisionHeading);
           if (section !== null) { parts.push(section); matchedSection = true; }
         }
       } catch (error) {
@@ -250,25 +252,26 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
 }
 
 export function resourceReviewRevisionMatches(loaded, revisions, id, stored, reviewer = null) {
-  const current = sourceHeading(reviewer, id)
+  const current = (sourceHeading(reviewer, id) || reviewer?.type === "retention-schedule-item")
     ? resourceReviewRevisionsSync(loaded, [id], "legacy", false, null, reviewer).get(id)
     : revisions.get(id);
   if (!current || !revisionDigest("content", stored)) return false;
   if (revisionsMatch("content", stored, current)) return true;
-  if (sourceHeading(reviewer, id)) return false;
-  const legacy = resourceReviewRevisionsSync(loaded, [id], "legacy", true).get(id);
-  if (revisionsMatch("content", stored, legacy)) return true;
-  // Version 0.16.0 used a bare digest as the hash input for scopeRevision.
-  // Read that binding without changing the legacy scope: basis restored here.
-  const compatible = resourceReviewRevisionsSync(loaded, [id], "digest", true).get(id);
-  if (revisionsMatch("content", stored, compatible)) return true;
-  return historicallyEquivalentReviewSource(loaded, id, stored, current);
+  if (!sourceHeading(reviewer, id)) {
+    const legacy = resourceReviewRevisionsSync(loaded, [id], "legacy", true).get(id);
+    if (revisionsMatch("content", stored, legacy)) return true;
+    // Version 0.16.0 used a bare digest as the hash input for scopeRevision.
+    // Read that binding without changing the legacy scope: basis restored here.
+    const compatible = resourceReviewRevisionsSync(loaded, [id], "digest", true).get(id);
+    if (revisionsMatch("content", stored, compatible)) return true;
+  }
+  return historicallyEquivalentReviewSource(loaded, id, stored, current, reviewer);
 }
 
 // Recompute the old byte-sensitive binding at each committed state. The
 // semantic source graph must still equal today's graph, including linked
 // records and Markdown, before the old approval is treated as current.
-function historicallyEquivalentReviewSource(loaded, id, stored, current) {
+function historicallyEquivalentReviewSource(loaded, id, stored, current, reviewer = null) {
   if (!loaded.root) return false;
   const context = reviewHistoryContext(loaded.root, loaded);
   const { index } = context;
@@ -289,8 +292,13 @@ function historicallyEquivalentReviewSource(loaded, id, stored, current) {
     if (relevantPaths && ![...changed.keys()].some((path) => relevantPaths.has(path) || path.endsWith(".md"))) continue;
     const snapshot = reviewHistoricalWorkspace(context, commit);
     if (!snapshot?.entries.some(({ record }) => record.id === id)) continue;
-    const semantic = resourceReviewRevisionsSync(snapshot, [id], "legacy", false, commit).get(id);
+    const semantic = resourceReviewRevisionsSync(snapshot, [id], "legacy", false, commit, reviewer).get(id);
     if (!revisionsMatch("content", semantic, current)) continue;
+    // A row may narrow a source to its retention facts or a named Markdown
+    // section. Accept its old binding only when those facts still match the
+    // committed source that supplied the binding.
+    const original = resourceReviewRevisionsSync(snapshot, [id], "legacy", false, commit).get(id);
+    if (revisionsMatch("content", stored, original)) return true;
     for (const scopeHashInput of ["legacy", "digest"]) {
       const legacy = resourceReviewRevisionsSync(snapshot, [id], scopeHashInput, true, commit).get(id);
       if (revisionsMatch("content", stored, legacy)) return true;
@@ -320,7 +328,7 @@ export function retentionUses(loaded, program) {
   return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
 }
 
-function reviewSource(loaded, entry, scopeHashInput = "legacy", legacySource = false, heading = null) {
+function reviewSource(loaded, entry, scopeHashInput = "legacy", legacySource = false, heading = null, reviewer = null) {
   if (heading && !legacySource) {
     const governingFields = entry.record.type === "policy"
       ? ["policyKind", "effectiveOn", "supersedesId", "parentPolicyId", "relatedPolicyIds", "relatedDocumentIds", "requirementIds", "audience", "acknowledgementRequired", "programRole", "reportingRouteRequirements"]
@@ -358,7 +366,7 @@ function reviewSource(loaded, entry, scopeHashInput = "legacy", legacySource = f
   return legacySource
     ? canonicalCalculatedRevisionJson(entry.source, scopeHashInput)
     : canonicalCalculatedRevisionJson(JSON.stringify(substantiveReviewSource(
-      JSON.parse(entry.source), modelSupports(loaded.model, "retention-schedule-approval")
+      JSON.parse(entry.source), modelSupports(loaded.model, "retention-schedule-approval"), reviewer
     )), scopeHashInput);
 }
 
@@ -454,6 +462,32 @@ function sourceHeading(record, sourceId) {
     ? headings[sourceId] : null;
 }
 
+function retentionPolicyHeading(loaded, entry, reviewer) {
+  if (reviewer?.type !== "retention-schedule-item" || entry.record.type !== "policy") return null;
+  // Older rows often bind a whole Policy. A single retention section gives
+  // that decision a narrower basis while an explicit heading still wins.
+  const headings = new Set();
+  for (const markdown of markdownEntries(loaded.model, entry.record)) {
+    let source;
+    try {
+      source = loaded.historicalFiles?.get(`data/${markdown.path}`)
+        ?? (entry.reviewCommit
+          ? entry.reviewFiles?.get(`data/${markdown.path}`)
+            ?? getFileAtRevision(loaded.root, entry.reviewCommit, `data/${markdown.path}`)
+          : readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const line of (source || "").split("\n")) {
+      const heading = /^#{2,6}\s+(.+?)\s*#*\s*$/.exec(line)?.[1];
+      if (heading && /\b(retention|disposal|deletion|destruction|archiving)\b/i.test(heading)
+        && reviewedMarkdownSection(source, heading) !== null) headings.add(heading);
+    }
+  }
+  return headings.size === 1 ? [...headings][0] : null;
+}
+
 const reviewDecisionFields = {
   control: ["statement", "requirementIds", "code", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"],
   commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "sourceSectionHeadings", "requirementIds", "controlIds", "customerFacing", "effectiveOn", "reportingRouteRequirements"],
@@ -469,7 +503,7 @@ const reviewDecisionFields = {
   document: ["documentKind", "workflowScope", "template", "version", "effectiveOn", "supersedesId", "systemIds", "controlIds", "relatedDocumentIds", "audience", "acknowledgementRequired", "trainingIds", "classificationId", "programRole", "componentIds", "reportingRouteRequirements"]
 };
 
-function substantiveReviewSource(record, currentModel) {
+function substantiveReviewSource(record, currentModel, reviewer = null) {
   if (currentModel && reviewDecisionFields[record.type]) {
     const fields = ["id", "type", "title", "extensions", "externalIds", ...reviewDecisionFields[record.type]];
     const decision = Object.fromEntries(fields.filter((field) => record[field] !== undefined)
@@ -481,6 +515,10 @@ function substantiveReviewSource(record, currentModel) {
     } else {
       decision.status = record.status || null;
     }
+    if (record.type === "component" && reviewer?.type === "retention-schedule-item") {
+      decision.systemUses = retentionSystemUses(decision.systemUses);
+      delete decision.evidenceSourceKinds;
+    }
     if (["control", "commitment", "complementary-control"].includes(record.type)) {
       decision.nonApplicableDecision = ["not-applicable", "externally-managed", "zero-population"]
         .includes(record.applicabilityReview?.decision) ? record.applicabilityReview.decision : null;
@@ -511,6 +549,13 @@ function substantiveReviewSource(record, currentModel) {
   return source;
 }
 
+export function retentionSystemUses(uses) {
+  return uses?.map((use) => ({
+    ...use,
+    roles: use.roles?.filter((role) => role !== "evidence-source")
+  }));
+}
+
 export function nearDuplicateInformationTypes(records) {
   const types = records.filter((record) => record.type === "information-type" && !["retired", "superseded"].includes(record.status));
   const pairs = [];