filegrc 0.3.4 → 0.5.0

package/src/setup.js

@@ -1,4 +1,4 @@
-import { createResource, updateResource } from "./files.js";
+import { applyResourceBatch } from "./files.js";
 import { createResourceId } from "./id.js";
 import { loadWorkspace } from "./workspace.js";
 
@@ -10,18 +10,30 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const setup = normalizeSetupPayload(payload);
   validateSetup(loaded, setup);
   const plan = buildSetupRecords(loaded, setup);
+  const updates = [
+    ...(plan.existingSystem ? [plan.system] : []),
+    plan.workspace,
+    ...(plan.renderer ? [plan.renderer] : [])
+  ];
+  const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, entry.revision]));
 
-  await upsertResource(loaded.root, plan.existingSystem, plan.system);
-  await updateResource(loaded.root, "workspace", plan.workspace.id, plan.workspace);
-  if (plan.renderer) await updateResource(loaded.root, plan.renderer.type, plan.renderer.id, plan.renderer);
+  await applyResourceBatch(loaded.root, {
+    create: [
+      ...(plan.existingSystem ? [] : [plan.system]),
+      ...(plan.commitment ? [plan.commitment] : [])
+    ],
+    update: updates,
+    expectedRevisions: Object.fromEntries(updates.map((record) => [record.id, revisionById.get(record.id)])),
+    validateWholeWorkspace: true
+  });
 
   return {
     draft: setup.draft,
     system: plan.system,
     workspace: plan.workspace,
     renderer: plan.renderer,
+    commitment: plan.commitment,
     linkedControlIds: [],
-    evidenceTestDraftIds: [],
     onboardingComplete: !setup.draft
   };
 }
@@ -40,11 +52,12 @@ export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
       workspace: "update",
       renderer: plan.renderer ? "update" : "unchanged",
       controls: 0,
-      evidenceDrafts: 0
+      commitment: plan.commitment ? "create" : "unchanged"
     },
     system: setupSystemSummary(plan.system),
     target: setupTargetSummary(plan.workspace),
     renderer: plan.renderer ? setupRendererSummary(plan.renderer) : null,
+    commitment: plan.commitment || null,
     onboardingComplete: !setup.draft
   };
 }
@@ -58,11 +71,12 @@ export function summarizeSetupResult(result) {
       system: "saved",
       workspace: "updated",
       controls: result.linkedControlIds?.length || 0,
-      evidenceDrafts: result.evidenceTestDraftIds?.length || 0
+      commitment: result.commitment ? "saved" : "unchanged"
     },
     system: setupSystemSummary(result.system),
     target: setupTargetSummary(result.workspace),
     renderer: result.renderer ? setupRendererSummary(result.renderer) : null,
+    commitment: result.commitment || null,
     onboardingComplete: result.onboardingComplete
   };
 }
@@ -77,7 +91,7 @@ export function normalizeSetupPayload(payload = {}) {
     boundary: cleanMultilineText(payload.boundary ?? payload.scope, "boundary"),
     ownerId: cleanText(payload.ownerId ?? payload.owner, "ownerId"),
     criticality: cleanText(payload.criticality, "criticality"),
-    dataClassification: cleanText(payload.dataClassification ?? payload.classification, "dataClassification"),
+    classificationId: cleanText(payload.classificationId, "classificationId"),
     internetExposed: booleanValue(payload.internetExposed, "internetExposed"),
     programGoal: cleanText(payload.programGoal ?? "none", "programGoal"),
     draft,
@@ -91,7 +105,7 @@ function validateSetup(loaded, setup) {
     ["boundary", setup.boundary],
     ["ownerId", setup.ownerId],
     ["criticality", setup.criticality],
-    ["dataClassification", setup.dataClassification]
+    ["classificationId", setup.classificationId]
   ]) {
     if (!value) throw new Error(`Setup field "${name}" is required.`);
   }
@@ -113,23 +127,24 @@ function validateSetup(loaded, setup) {
     }
   }
   const classifications = Object.keys(loaded.workspace.classificationDefinitions || {});
-  if (classifications.length && !classifications.includes(setup.dataClassification)) {
-    throw new Error(`dataClassification must be one of ${classifications.join(", ")}.`);
+  if (classifications.length && !classifications.includes(setup.classificationId)) {
+    throw new Error(`classificationId must be one of ${classifications.join(", ")}.`);
   }
 }
 
-function findSetupSystem(resources, setup) {
+function findSetupSystem(resources, workspace, setup) {
+  const scopedSystemIds = new Set(workspace.systemIds || []);
   return (setup.systemId && resources.find(({ type, id }) => type === "system" && id === setup.systemId))
-    || resources.find(({ type, title, inScope, status }) => (
+    || resources.find(({ type, id, title, status }) => (
       type === "system"
-      && inScope === true
+      && scopedSystemIds.has(id)
       && status !== "retired"
       && title.trim().toLowerCase() === setup.serviceName.toLowerCase()
     ));
 }
 
 function buildSetupRecords(loaded, setup) {
-  const existingSystem = findSetupSystem(loaded.resources, setup);
+  const existingSystem = findSetupSystem(loaded.resources, loaded.workspace, setup);
   const systemId = existingSystem?.id || createResourceId(
     "system",
     setup.serviceName,
@@ -137,7 +152,6 @@ function buildSetupRecords(loaded, setup) {
   );
   const system = {
     ...(existingSystem || {}),
-    schemaVersion: 1,
     id: systemId,
     type: "system",
     title: setup.serviceName,
@@ -150,9 +164,8 @@ function buildSetupRecords(loaded, setup) {
     ownerIds: [setup.ownerId],
     description: setup.boundary,
     systemKind: existingSystem?.systemKind || "service",
-    dataClassification: setup.dataClassification,
-    internetExposed: setup.internetExposed,
-    inScope: true
+    classificationId: setup.classificationId,
+    internetExposed: setup.internetExposed
   };
   const existingWorkspace = loaded.resources.find(({ type }) => type === "workspace");
   if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
@@ -163,13 +176,31 @@ function buildSetupRecords(loaded, setup) {
   };
   const existingRenderer = loaded.resources.find(({ type }) => type === "renderer-settings");
   const renderer = existingRenderer ? { ...existingRenderer, showOnboarding: setup.draft } : null;
-  return { existingSystem, system, workspace, renderer };
-}
-
-async function upsertResource(root, existing, record) {
-  return existing
-    ? updateResource(root, record.type, record.id, record)
-    : createResource(root, record);
+  const existingCommitment = loaded.resources.find((record) => (
+    record.type === "commitment"
+    && !["superseded", "retired"].includes(record.status)
+    && (record.systemIds || []).includes(systemId)
+  ));
+  const commitment = String(loaded.model.modelVersion) === "3" && !existingCommitment
+    ? {
+        id: createResourceId(
+          "commitment",
+          `${setup.serviceName} service commitment`,
+          loaded.resources.map(({ id }) => id)
+        ),
+        type: "commitment",
+        title: `${setup.serviceName} service commitment`,
+        status: "planned",
+        commitmentKind: "service",
+        statement: "Replace this starter with the actual customer promise or approved service requirement before activation.",
+        systemIds: [systemId],
+        ownerIds: [setup.ownerId],
+        customerFacing: true,
+        ...(workspace.requirementIds?.length ? { requirementIds: [...workspace.requirementIds] } : {}),
+        ...(workspace.controlIds?.length ? { controlIds: [...workspace.controlIds] } : {})
+      }
+    : null;
+  return { existingSystem, system, workspace, renderer, commitment };
 }
 
 function assuranceGoalFromSetup(goal) {

package/src/source-coverage.js

@@ -0,0 +1,61 @@
+export function sourceCoverageComplete(record, loaded) {
+  if (!record?.validFrom || !record.collectionCadence || !record.retention || !record.reconciliationMethod) {
+    return false;
+  }
+  if (record.coverageKind === "external-system" && (!record.systemId || !(record.retrieverIds || []).length)) {
+    return false;
+  }
+  if (["not-applicable", "zero-population"].includes(record.coverageKind) && !record.applicabilityReview) {
+    return false;
+  }
+  if (loaded.workspace?.candidateCoverage && !(record.readinessTestEvidenceIds || []).length) {
+    return false;
+  }
+  if (loaded.workspace?.candidateCoverage) {
+    const tests = (record.readinessTestEvidenceIds || []).map((id) => (
+      loaded.resources.find((resource) => resource.id === id && resource.type === "evidence")
+    ));
+    if (tests.some((test) => (
+      !test
+      || test.readinessTest !== true
+      || test.retrievalResult !== "passed"
+      || test.accessConfirmed !== true
+      || !(test.coveredSourceFamilyIds || []).includes(record.sourceFamilyId)
+      || (record.coverageKind === "external-system" && !(
+        test.sourceSystemId === record.systemId
+        || (test.systemIds || []).includes(record.systemId)
+      ))
+    ))) return false;
+  }
+  return true;
+}
+
+export function assessSourceCoverageReadiness(loaded, selectedControlIds = []) {
+  if (!loaded.model.resources["source-coverage"]) return [];
+  const selected = new Set(selectedControlIds);
+  const selectedControlCodes = new Set(loaded.resources
+    .filter((record) => (
+      record.type === "control"
+      && selected.has(record.id)
+      && !["not-applicable", "retired"].includes(record.status)
+    ))
+    .map(({ code }) => code)
+    .filter(Boolean));
+  return (loaded.model.evidenceSourceFamilies || [])
+    .filter((family) => family.controlCodes.some((code) => selectedControlCodes.has(code)))
+    .map((family) => {
+      const records = loaded.resources.filter((record) => (
+        record.type === "source-coverage"
+        && record.sourceFamilyId === family.id
+        && record.status !== "retired"
+      ));
+      const record = records.find(({ status }) => status === "active")
+        || records.find(({ status }) => status === "planned")
+        || null;
+      return {
+        family,
+        record,
+        complete: Boolean(record?.status === "active" && sourceCoverageComplete(record, loaded))
+      };
+    });
+}

package/src/state.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { assessAuditPreparation } from "./audit-preparation.js";
+import { assessCollectionReviews } from "./collection-review.js";
 import { getBrowserRepositoryState, getGitSummary, getWorkspaceHistories } from "./git.js";
 import { renderMarkdown } from "./markdown.js";
 import { planObligations } from "./obligations.js";
@@ -8,36 +9,39 @@ import { resolveDataPath } from "./paths.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate } from "./time.js";
-import { validateWorkspace } from "./validate.js";
+import { serializeWorkspaceMutation } from "./mutation.js";
+import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
+import { assessWorkflow } from "./workflow.js";
+
+const renderedMarkdownCache = new Map();
+const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
 
 export async function createAppState(input = process.cwd(), options = {}) {
-  const validation = await validateWorkspace(input);
+  return serializeWorkspaceMutation(input, (root) => createAppStateUnlocked(root, options));
+}
+
+async function createAppStateUnlocked(input, options) {
+  let validation;
+  if (options.validationProof) {
+    const current = await fingerprintWorkspace(input);
+    validation = current.fingerprint === options.validationProof.fingerprint
+      ? { ...options.validationProof.validation, loaded: current.loaded }
+      : await validateWorkspace(current.loaded);
+  } else {
+    validation = await validateWorkspace(input);
+  }
   const { loaded } = validation;
   const entries = [];
-  const relativePaths = loaded.entries.map((entry) => `data/${entry.relativePath}`);
-  const histories = getWorkspaceHistories(loaded.root, relativePaths, 12);
+  const includeDetails = options.includeDetails !== false;
+  const histories = includeDetails
+    ? getWorkspaceHistories(loaded.root, loaded.entries.map((entry) => `data/${entry.relativePath}`), 12)
+    : new Map();
 
   for (const entry of loaded.entries) {
-    const record = structuredClone(entry.record);
-    const content = {};
-    if (loaded.model.resources[record.type]) {
-      for (const item of markdownEntries(loaded.model, record)) {
-        try {
-          const path = resolveDataPath(loaded.root, item.path);
-          const source = await readFile(path, "utf8");
-          content[item.name] = { source, html: renderMarkdown(source), path: item.path, revision: contentRevision(source) };
-        } catch {
-          // Validation reports missing required Markdown.
-        }
-      }
-    }
-    entries.push({
-      record,
-      relativePath: `data/${entry.relativePath}`,
-      revision: contentRevision(entry.source),
-      content,
+    entries.push(await createStateEntry(loaded, entry, {
+      includeDetails,
       history: histories.get(`data/${entry.relativePath}`) ?? []
-    });
+    }));
   }
 
   const git = getGitSummary(loaded.root);
@@ -47,7 +51,6 @@ export async function createAppState(input = process.cwd(), options = {}) {
     allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
   });
   const workspace = loaded.workspace ?? {
-    schemaVersion: 1,
     dataModelVersion: loaded.model.modelVersion,
     id: "workspace",
     type: "workspace",
@@ -72,8 +75,41 @@ export async function createAppState(input = process.cwd(), options = {}) {
       return [audit?.id || "none", preparation];
     })
   ));
+  const obligations = planObligations(entries, {
+    asOf,
+    now: options.now ?? generatedAt,
+    model: loaded.model
+  });
+  const workflow = await assessWorkflow(loaded, {
+    asOf,
+    evaluatedAt: generatedAt,
+    programReadiness,
+    auditPreparations: Object.fromEntries(
+      Object.entries(auditPreparations).filter(([id]) => id !== "none")
+    ),
+    obligations,
+    git,
+    validation
+  });
+  const collectionReviews = Object.fromEntries(
+    assessCollectionReviews(loaded).map((assessment) => [
+      assessment.resourceType,
+      {
+        resourceType: assessment.resourceType,
+        configuration: assessment.configuration,
+        recordCount: assessment.recordCount,
+        review: assessment.review,
+        reviewRevision: assessment.reviewRevision,
+        collectionRevision: assessment.collectionRevision,
+        status: assessment.status,
+        complete: assessment.complete,
+        message: assessment.message
+      }
+    ])
+  );
   return {
     generatedAt,
+    asOf,
     readOnly: Boolean(options.readOnly || (repository.mode === "trunk" && !repository.writesAllowed)),
     repository,
     workspace,
@@ -84,13 +120,74 @@ export async function createAppState(input = process.cwd(), options = {}) {
       counts: validation.counts,
       diagnostics: validation.diagnostics
     },
-    obligations: planObligations(entries, { asOf, now: options.now ?? generatedAt }),
+    obligations,
+    collectionReviews,
     programReadiness,
     auditPreparations,
+    workflow,
     git
   };
 }
 
+export async function createResourceDetail(input, type, id) {
+  return serializeWorkspaceMutation(input, async (root) => {
+    const validation = await validateWorkspace(root);
+    const entry = validation.loaded.entries.find(({ record }) => record.type === type && record.id === id);
+    if (!entry) return null;
+    const relativePath = `data/${entry.relativePath}`;
+    const histories = getWorkspaceHistories(validation.loaded.root, [relativePath], 12);
+    return createStateEntry(validation.loaded, entry, {
+      includeDetails: true,
+      history: histories.get(relativePath) ?? []
+    });
+  });
+}
+
+async function createStateEntry(loaded, entry, options) {
+  const record = structuredClone(entry.record);
+  const content = {};
+  if (loaded.model.resources[record.type]) {
+    for (const item of markdownEntries(loaded.model, record)) {
+      try {
+        const path = resolveDataPath(loaded.root, item.path);
+        const source = await readFile(path, "utf8");
+        content[item.name] = {
+          source,
+          ...(options.includeDetails ? { html: renderMarkdownCached(source) } : {}),
+          path: item.path,
+          revision: contentRevision(source)
+        };
+      } catch {
+        // Validation reports missing required Markdown.
+      }
+    }
+  }
+  return {
+    record,
+    relativePath: `data/${entry.relativePath}`,
+    revision: contentRevision(entry.source),
+    content,
+    history: options.includeDetails ? options.history : undefined,
+    detailsLoaded: options.includeDetails
+  };
+}
+
+function renderMarkdownCached(source) {
+  const revision = contentRevision(source);
+  const cached = renderedMarkdownCache.get(revision);
+  if (cached !== undefined) {
+    renderedMarkdownCache.delete(revision);
+    renderedMarkdownCache.set(revision, cached);
+    return cached;
+  }
+  const html = renderMarkdown(source);
+  renderedMarkdownCache.set(revision, html);
+  if (renderedMarkdownCache.size > MAX_RENDERED_MARKDOWN_CACHE_ENTRIES) {
+    renderedMarkdownCache.delete(renderedMarkdownCache.keys().next().value);
+  }
+  return html;
+}
+
 function contentRevision(source) {
   return createHash("sha256").update(source).digest("hex");
 }

package/src/timing.js

@@ -0,0 +1,41 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { performance } from "node:perf_hooks";
+
+const timingContext = new AsyncLocalStorage();
+
+export async function collectTimings(task) {
+  const timings = new Map();
+  const result = await timingContext.run(timings, task);
+  return { result, timings: Object.fromEntries(timings) };
+}
+
+export async function measureTiming(name, task) {
+  const started = performance.now();
+  try {
+    return await task();
+  } finally {
+    recordTiming(name, performance.now() - started);
+  }
+}
+
+export function measureTimingSync(name, task) {
+  const started = performance.now();
+  try {
+    return task();
+  } finally {
+    recordTiming(name, performance.now() - started);
+  }
+}
+
+export function recordTiming(name, durationMs) {
+  const timings = timingContext.getStore();
+  if (!timings) return;
+  const current = timings.get(name) ?? { count: 0, durationMs: 0 };
+  current.count += 1;
+  current.durationMs += durationMs;
+  timings.set(name, current);
+}
+
+export function timingEnabled() {
+  return process.env.FILEGRC_TIMING === "1";
+}