filegrc 0.5.1 → 0.6.1

package/src/setup.js

@@ -1,5 +1,6 @@
 import { applyResourceBatch } from "./files.js";
 import { createResourceId } from "./id.js";
+import { resolveProgram, selectedRequirementIds } from "./program.js";
 import { loadWorkspace } from "./workspace.js";
 
 const PROGRAM_GOALS = new Set(["none", "readiness", "type-1", "type-2"]);
@@ -12,7 +13,8 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const plan = buildSetupRecords(loaded, setup);
   const updates = [
     ...(plan.existingSystem ? [plan.system] : []),
-    plan.workspace,
+    plan.target,
+    ...(plan.component ? [plan.component] : []),
     ...(plan.renderer ? [plan.renderer] : [])
   ];
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, entry.revision]));
@@ -30,7 +32,8 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   return {
     draft: setup.draft,
     system: plan.system,
-    workspace: plan.workspace,
+    workspace: plan.target.type === "workspace" ? plan.target : plan.workspace,
+    program: plan.target.type === "program" ? plan.target : null,
     renderer: plan.renderer,
     commitment: plan.commitment,
     linkedControlIds: [],
@@ -49,13 +52,13 @@ export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
     draft: setup.draft,
     changes: {
       system: plan.existingSystem ? "update" : "create",
-      workspace: "update",
+      [plan.target.type]: "update",
       renderer: plan.renderer ? "update" : "unchanged",
       controls: 0,
       commitment: plan.commitment ? "create" : "unchanged"
     },
     system: setupSystemSummary(plan.system),
-    target: setupTargetSummary(plan.workspace),
+    target: setupTargetSummary(plan.target, loaded.model),
     renderer: plan.renderer ? setupRendererSummary(plan.renderer) : null,
     commitment: plan.commitment || null,
     onboardingComplete: !setup.draft
@@ -69,12 +72,12 @@ export function summarizeSetupResult(result) {
     draft: result.draft,
     changes: {
       system: "saved",
-      workspace: "updated",
+      [result.program ? "program" : "workspace"]: "updated",
       controls: result.linkedControlIds?.length || 0,
       commitment: result.commitment ? "saved" : "unchanged"
     },
     system: setupSystemSummary(result.system),
-    target: setupTargetSummary(result.workspace),
+    target: setupTargetSummary(result.program || result.workspace, { modelVersion: result.program ? "4" : "3" }),
     renderer: result.renderer ? setupRendererSummary(result.renderer) : null,
     commitment: result.commitment || null,
     onboardingComplete: result.onboardingComplete
@@ -126,14 +129,16 @@ function validateSetup(loaded, setup) {
       throw new Error(`System "${setup.systemId}" cannot be used for initial scope because it is ${system.status}.`);
     }
   }
-  const classifications = Object.keys(loaded.workspace.classificationDefinitions || {});
+  const classifications = String(loaded.model.modelVersion) === "4"
+    ? loaded.resources.filter(({ type, status }) => type === "classification" && status === "active").map(({ id }) => id)
+    : Object.keys(loaded.workspace.classificationDefinitions || {});
   if (classifications.length && !classifications.includes(setup.classificationId)) {
     throw new Error(`classificationId must be one of ${classifications.join(", ")}.`);
   }
 }
 
-function findSetupSystem(resources, workspace, setup) {
-  const scopedSystemIds = new Set(workspace.systemIds || []);
+function findSetupSystem(resources, target, setup) {
+  const scopedSystemIds = new Set(target.systemIds || []);
   return (setup.systemId && resources.find(({ type, id }) => type === "system" && id === setup.systemId))
     || resources.find(({ type, id, title, status }) => (
       type === "system"
@@ -144,7 +149,9 @@ function findSetupSystem(resources, workspace, setup) {
 }
 
 function buildSetupRecords(loaded, setup) {
-  const existingSystem = findSetupSystem(loaded.resources, loaded.workspace, setup);
+  const target = resolveProgram(loaded);
+  const v4 = String(loaded.model.modelVersion) === "4";
+  const existingSystem = findSetupSystem(loaded.resources, target, setup);
   const systemId = existingSystem?.id || createResourceId(
     "system",
     setup.serviceName,
@@ -162,18 +169,46 @@ function buildSetupRecords(loaded, setup) {
         : existingSystem?.status || "active",
     criticality: setup.criticality,
     ownerIds: [setup.ownerId],
-    description: setup.boundary,
-    systemKind: existingSystem?.systemKind || "service",
+    ...(v4 ? {
+      purpose: existingSystem?.purpose || setup.boundary,
+      servicesProvided: existingSystem?.servicesProvided || [setup.serviceName],
+      boundary: setup.boundary,
+      exclusions: existingSystem?.exclusions || []
+    } : {
+      description: setup.boundary,
+      systemKind: existingSystem?.systemKind || "service"
+    }),
     classificationId: setup.classificationId,
     internetExposed: setup.internetExposed
   };
   const existingWorkspace = loaded.resources.find(({ type }) => type === "workspace");
   if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
-  const workspace = {
-    ...existingWorkspace,
+  const nextTarget = {
+    ...target,
+    ...(!setup.draft && v4 ? { status: "active" } : {}),
     assuranceGoal: assuranceGoalFromSetup(setup.programGoal),
-    systemIds: [...new Set([...(existingWorkspace.systemIds || []), systemId])]
+    systemIds: [...new Set([...(target.systemIds || []), systemId])]
   };
+  const componentEntry = v4
+    ? loaded.resources.find(({ id, type }) => id === "component-filegrc-program-repository" && type === "component")
+    : null;
+  const existingSystemUses = componentEntry?.systemUses || [];
+  const component = componentEntry ? {
+    ...componentEntry,
+    status: setup.draft
+      ? componentEntry.status || "planned"
+      : componentEntry.status === "planned"
+        ? "active"
+        : componentEntry.status || "active",
+    systemUses: [
+      ...existingSystemUses.filter((use) => use.systemId !== systemId),
+      {
+        systemId,
+        roles: ["control-support", "evidence-source", "supporting-operations"],
+        rationale: "FileGRC stores the Program records, retained evidence index, and Git revision history used to operate and support this System's Controls."
+      }
+    ]
+  } : null;
   const existingRenderer = loaded.resources.find(({ type }) => type === "renderer-settings");
   const renderer = existingRenderer ? { ...existingRenderer, showOnboarding: setup.draft } : null;
   const existingCommitment = loaded.resources.find((record) => (
@@ -181,7 +216,7 @@ function buildSetupRecords(loaded, setup) {
     && !["superseded", "retired"].includes(record.status)
     && (record.systemIds || []).includes(systemId)
   ));
-  const commitment = String(loaded.model.modelVersion) === "3" && !existingCommitment
+  const commitment = ["3", "4"].includes(String(loaded.model.modelVersion)) && !existingCommitment
     ? {
         id: createResourceId(
           "commitment",
@@ -196,11 +231,11 @@ function buildSetupRecords(loaded, setup) {
         systemIds: [systemId],
         ownerIds: [setup.ownerId],
         customerFacing: true,
-        ...(workspace.requirementIds?.length ? { requirementIds: [...workspace.requirementIds] } : {}),
-        ...(workspace.controlIds?.length ? { controlIds: [...workspace.controlIds] } : {})
+        ...(selectedRequirementIds(nextTarget, loaded.model).length ? { requirementIds: selectedRequirementIds(nextTarget, loaded.model) } : {}),
+        ...(nextTarget.controlIds?.length ? { controlIds: [...nextTarget.controlIds] } : {})
       }
     : null;
-  return { existingSystem, system, workspace, renderer, commitment };
+  return { existingSystem, system, workspace: existingWorkspace, target: nextTarget, component, renderer, commitment };
 }
 
 function assuranceGoalFromSetup(goal) {
@@ -214,14 +249,14 @@ function setupSystemSummary(system) {
   return { ...system };
 }
 
-function setupTargetSummary(workspace) {
+function setupTargetSummary(workspace, model) {
   return {
     assuranceGoal: workspace.assuranceGoal,
     systemIds: [...(workspace.systemIds || [])],
     scopeCounts: {
       systems: workspace.systemIds?.length || 0,
       frameworks: workspace.frameworkIds?.length || 0,
-      requirements: workspace.requirementIds?.length || 0,
+      requirements: selectedRequirementIds(workspace, model).length,
       controls: workspace.controlIds?.length || 0
     }
   };

package/src/source-coverage.js

@@ -1,17 +1,19 @@
-export function sourceCoverageComplete(record, loaded) {
+export function sourceCoverageComplete(record, loaded, program = loaded.workspace) {
   if (!record?.validFrom || !record.collectionCadence || !record.retention || !record.reconciliationMethod) {
     return false;
   }
-  if (record.coverageKind === "external-system" && (!record.systemId || !(record.retrieverIds || []).length)) {
+  const external = record.coverageKind === "external-system" || record.coverageKind === "external-component";
+  const sourceId = record.componentId || record.systemId;
+  if (external && (!sourceId || !(record.retrieverIds || []).length)) {
     return false;
   }
   if (["not-applicable", "zero-population"].includes(record.coverageKind) && !record.applicabilityReview) {
     return false;
   }
-  if (loaded.workspace?.candidateCoverage && !(record.readinessTestEvidenceIds || []).length) {
+  if (program?.candidateCoverage && !(record.readinessTestEvidenceIds || []).length) {
     return false;
   }
-  if (loaded.workspace?.candidateCoverage) {
+  if (program?.candidateCoverage) {
     const tests = (record.readinessTestEvidenceIds || []).map((id) => (
       loaded.resources.find((resource) => resource.id === id && resource.type === "evidence")
     ));
@@ -21,16 +23,18 @@ export function sourceCoverageComplete(record, loaded) {
       || test.retrievalResult !== "passed"
       || test.accessConfirmed !== true
       || !(test.coveredSourceFamilyIds || []).includes(record.sourceFamilyId)
-      || (record.coverageKind === "external-system" && !(
-        test.sourceSystemId === record.systemId
-        || (test.systemIds || []).includes(record.systemId)
+      || (external && !(
+        test.sourceComponentId === sourceId
+        || test.sourceSystemId === sourceId
+        || (test.componentIds || []).includes(sourceId)
+        || (test.systemIds || []).includes(sourceId)
       ))
     ))) return false;
   }
   return true;
 }
 
-export function assessSourceCoverageReadiness(loaded, selectedControlIds = []) {
+export function assessSourceCoverageReadiness(loaded, selectedControlIds = [], program = loaded.workspace) {
   if (!loaded.model.resources["source-coverage"]) return [];
   const selected = new Set(selectedControlIds);
   const selectedControlCodes = new Set(loaded.resources
@@ -55,7 +59,7 @@ export function assessSourceCoverageReadiness(loaded, selectedControlIds = []) {
       return {
         family,
         record,
-        complete: Boolean(record?.status === "active" && sourceCoverageComplete(record, loaded))
+        complete: Boolean(record?.status === "active" && sourceCoverageComplete(record, loaded, program))
       };
     });
 }

package/src/state.js

@@ -12,6 +12,7 @@ import { currentCalendarDate } from "./time.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
 import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
 import { assessWorkflow } from "./workflow.js";
+import { measureTiming } from "./timing.js";
 
 const renderedMarkdownCache = new Map();
 const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
@@ -37,19 +38,21 @@ async function createAppStateUnlocked(input, options) {
     ? getWorkspaceHistories(loaded.root, loaded.entries.map((entry) => `data/${entry.relativePath}`), 12)
     : new Map();
 
-  for (const entry of loaded.entries) {
-    entries.push(await createStateEntry(loaded, entry, {
-      includeDetails,
-      history: histories.get(`data/${entry.relativePath}`) ?? []
-    }));
-  }
+  await measureTiming("state-entries", async () => {
+    for (const entry of loaded.entries) {
+      entries.push(await createStateEntry(loaded, entry, {
+        includeDetails,
+        history: histories.get(`data/${entry.relativePath}`) ?? []
+      }));
+    }
+  });
 
   const git = getGitSummary(loaded.root);
   delete git.root;
-  const repository = await getBrowserRepositoryState(loaded.root, {
+  const repository = await measureTiming("state-repository", () => getBrowserRepositoryState(loaded.root, {
     readOnly: options.readOnly,
     allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
-  });
+  }));
   const workspace = loaded.workspace ?? {
     dataModelVersion: loaded.model.modelVersion,
     id: "workspace",
@@ -60,12 +63,12 @@ async function createAppStateUnlocked(input, options) {
   };
   const asOf = options.asOf ?? currentCalendarDate(workspace.timezone);
   const generatedAt = new Date().toISOString();
-  const programReadiness = await assessProgramReadiness(loaded, {
+  const programReadiness = await measureTiming("state-program-readiness", () => assessProgramReadiness(loaded, {
     asOf,
     generatedAt
-  });
+  }));
   const audits = loaded.resources.filter((record) => record.type === "audit");
-  const auditPreparations = Object.fromEntries(await Promise.all(
+  const auditPreparations = await measureTiming("state-audit-preparation", async () => Object.fromEntries(await Promise.all(
     (audits.length ? audits : [null]).map(async (audit) => {
       const preparation = await assessAuditPreparation(loaded, {
         auditId: audit?.id,
@@ -74,13 +77,13 @@ async function createAppStateUnlocked(input, options) {
       });
       return [audit?.id || "none", preparation];
     })
-  ));
+  )));
   const obligations = planObligations(entries, {
     asOf,
     now: options.now ?? generatedAt,
     model: loaded.model
   });
-  const workflow = await assessWorkflow(loaded, {
+  const workflow = await measureTiming("state-workflow", () => assessWorkflow(loaded, {
     asOf,
     evaluatedAt: generatedAt,
     programReadiness,
@@ -90,7 +93,7 @@ async function createAppStateUnlocked(input, options) {
     obligations,
     git,
     validation
-  });
+  }));
   const collectionReviews = Object.fromEntries(
     assessCollectionReviews(loaded).map((assessment) => [
       assessment.resourceType,

package/src/timing.js

@@ -5,7 +5,9 @@ const timingContext = new AsyncLocalStorage();
 
 export async function collectTimings(task) {
   const timings = new Map();
+  const started = performance.now();
   const result = await timingContext.run(timings, task);
+  recordCollectedTiming(timings, "total", performance.now() - started);
   return { result, timings: Object.fromEntries(timings) };
 }
 
@@ -30,6 +32,10 @@ export function measureTimingSync(name, task) {
 export function recordTiming(name, durationMs) {
   const timings = timingContext.getStore();
   if (!timings) return;
+  recordCollectedTiming(timings, name, durationMs);
+}
+
+function recordCollectedTiming(timings, name, durationMs) {
   const current = timings.get(name) ?? { count: 0, durationMs: 0 };
   current.count += 1;
   current.durationMs += durationMs;

package/src/validate.js

@@ -73,6 +73,10 @@ async function validateWorkspaceUnmeasured(input) {
     validateRecord(record, definition, loaded.model, displayPath, diagnostics);
     validateDateRanges(record, displayPath, diagnostics);
     if (record.type === "appointment") validateAppointment(record, byId, displayPath, diagnostics);
+    if (record.type === "program") validateProgram(record, displayPath, diagnostics);
+    if (record.type === "component") validateComponent(record, displayPath, diagnostics);
+    if (record.type === "control") validateControlComponents(record, byId, displayPath, diagnostics);
+    if (record.type === "audit") validateAuditSubservices(record, byId, displayPath, diagnostics);
     if (record.type === "collection-review") {
       validateCollectionReview(record, loaded.model, loaded.resources, byId, displayPath, diagnostics);
     }
@@ -83,7 +87,7 @@ async function validateWorkspaceUnmeasured(input) {
     if (record.type === "obligation-event") validatePolicyEvent(record, loaded.model, byId, displayPath, diagnostics);
     if (record.type === "evidence") validateEvidencePaths(record, displayPath, diagnostics);
     validateCoverage(record, displayPath, diagnostics);
-    validateClassification(record, loaded.workspace, displayPath, diagnostics);
+    validateClassification(record, loaded, displayPath, diagnostics);
     validateCompletionDates(record, displayPath, diagnostics);
     await validateAttestationBinding(record, loaded.model, loaded.root, byId, displayPath, diagnostics);
 
@@ -167,7 +171,24 @@ function validateCollectionReview(record, model, resources, byId, path, diagnost
     ));
     return;
   }
-  const recordCount = resources.filter(({ type }) => type === record.resourceType).length;
+  const program = String(model.modelVersion) === "4"
+    ? (record.scopeResourceIds || []).map((id) => byId.get(id)).find(({ type } = {}) => type === "program")
+    : null;
+  const programSystemIds = new Set(program?.systemIds || []);
+  const componentIds = new Set(resources.filter((candidate) => (
+    candidate.type === "component"
+    && (candidate.systemUses || []).some(({ systemId }) => programSystemIds.has(systemId))
+  )).map(({ id }) => id));
+  const selectedIds = {
+    system: programSystemIds,
+    component: componentIds,
+    framework: new Set(program?.frameworkIds || []),
+    vendor: new Set(resources.filter(({ id }) => componentIds.has(id)).map(({ vendorId }) => vendorId).filter(Boolean)),
+    asset: new Set(resources.filter(({ type, componentIds: ids }) => type === "asset" && (ids || []).some((id) => componentIds.has(id))).map(({ id }) => id))
+  }[record.resourceType];
+  const recordCount = resources.filter(({ type, id }) => (
+    type === record.resourceType && (!program || !selectedIds || selectedIds.has(id))
+  )).length;
   if (!recordCount && record.decision === "complete") {
     diagnostics.push(error(
       "invalid-collection-review-decision",
@@ -184,12 +205,12 @@ function validateCollectionReview(record, model, resources, byId, path, diagnost
   }
   if (
     record.decision === "externally-managed"
-    && byId.get(record.authoritativeSystemId)?.status !== "active"
+    && byId.get(record.authoritativeComponentId || record.authoritativeSystemId)?.status !== "active"
   ) {
     diagnostics.push(error(
       "inactive-authoritative-system",
       path,
-      `${configuration.title} must name an active authoritative System for an externally managed conclusion.`
+      `${configuration.title} must name an active authoritative ${String(model.modelVersion) === "4" ? "Component" : "System"} for an externally managed conclusion.`
     ));
   }
 }
@@ -302,6 +323,64 @@ function validateAppointment(record, byId, path, diagnostics) {
   ));
 }
 
+function validateProgram(record, path, diagnostics) {
+  const requirementIds = (record.requirementApplicability || [])
+    .map(({ requirementId }) => requirementId)
+    .filter(Boolean);
+  if (new Set(requirementIds).size !== requirementIds.length) {
+    diagnostics.push(error(
+      "duplicate-program-applicability",
+      path,
+      "A Program may record each Requirement only once in requirementApplicability."
+    ));
+  }
+}
+
+function validateComponent(record, path, diagnostics) {
+  const systemIds = (record.systemUses || []).map(({ systemId }) => systemId).filter(Boolean);
+  if (new Set(systemIds).size !== systemIds.length) {
+    diagnostics.push(error("duplicate-system-use", path, "A Component may name each System only once in systemUses."));
+  }
+  for (const [index, use] of (record.systemUses || []).entries()) {
+    if (!(use.roles || []).length || !String(use.rationale || "").trim()) {
+      diagnostics.push(error("incomplete-system-use", path, `systemUses[${index}] needs at least one role and a rationale.`));
+    }
+  }
+}
+
+function validateControlComponents(record, byId, path, diagnostics) {
+  if (record.status !== "implemented") return;
+  const systemIds = new Set(record.systemIds || []);
+  for (const field of ["componentIds", "evidenceSourceComponentIds"]) {
+    for (const id of record[field] || []) {
+      const component = byId.get(id);
+      if (component?.type !== "component") continue;
+      const uses = (component.systemUses || []).filter(({ systemId }) => systemIds.has(systemId));
+      if (!uses.length) {
+        diagnostics.push(error("component-outside-control-scope", path, `${field} Component "${id}" has no use in a System where this Control applies.`));
+      }
+      if (field === "evidenceSourceComponentIds" && !uses.some(({ roles }) => (roles || []).includes("evidence-source"))) {
+        diagnostics.push(error("invalid-evidence-source-component", path, `Component "${id}" must have the evidence-source role in a System where this Control applies.`));
+      }
+    }
+  }
+}
+
+function validateAuditSubservices(record, byId, path, diagnostics) {
+  for (const [index, treatment] of (record.subserviceTreatments || []).entries()) {
+    for (const componentId of treatment.componentIds || []) {
+      const component = byId.get(componentId);
+      if (component?.type === "component" && component.vendorId !== treatment.vendorId) {
+        diagnostics.push(error(
+          "subservice-vendor-mismatch",
+          path,
+          `subserviceTreatments[${index}] Component "${componentId}" is not supplied by Vendor "${treatment.vendorId}".`
+        ));
+      }
+    }
+  }
+}
+
 function validateCompletedObligationEvent(record, byId, model, path, diagnostics) {
   if (record.type !== "obligation-event" || record.status !== "complete") return;
   if (record.completedOn && record.occurredOn && record.completedOn < record.occurredOn) {
@@ -334,7 +413,7 @@ function validateCompletedObligationEvent(record, byId, model, path, diagnostics
       ? model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || []
       : [];
     if (!expectedTypes.length) continue;
-    const completionIds = String(model.modelVersion) === "3"
+    const completionIds = ["3", "4"].includes(String(model.modelVersion))
       ? action.completionResourceIds || []
       : [...(action.completionResourceIds || []), ...(action.evidenceIds || [])];
     const linked = [...new Set(completionIds)]
@@ -352,7 +431,7 @@ function validateCompletedObligationEvent(record, byId, model, path, diagnostics
 
 function validateCompletedObligationAction(record, byId, model, path, diagnostics) {
   if (
-    String(model.modelVersion) !== "3"
+    !["3", "4"].includes(String(model.modelVersion))
     || record.status !== "done"
     || !record.obligationId
   ) return;
@@ -754,9 +833,19 @@ function validateCoverage(record, path, diagnostics) {
   }
 }
 
-function validateClassification(record, workspace, path, diagnostics) {
+function validateClassification(record, loaded, path, diagnostics) {
   if (!record.classificationId) return;
-  const definitions = workspace?.classificationDefinitions;
+  if (String(loaded.model.modelVersion) === "4") {
+    if (!loaded.resources.some(({ id, type }) => id === record.classificationId && type === "classification")) {
+      diagnostics.push(error(
+        "unknown-classification",
+        path,
+        `classificationId references undefined Classification "${record.classificationId}".`
+      ));
+    }
+    return;
+  }
+  const definitions = loaded.workspace?.classificationDefinitions;
   if (
     !definitions
     || Array.isArray(definitions)
@@ -1076,8 +1165,10 @@ function validateArrayItem(name, value, field, model, path, diagnostics, index)
     diagnostics.push(error("invalid-field", path, `${name} items must be objects.`));
   } else if (type === "object" && field.itemObjectType) {
     validateObjectValue(`${name}[${index}]`, value, field.itemObjectType, model, path, diagnostics);
-  } else if ((type === "string" || type === "data-path") && typeof value !== "string") {
+  } else if ((type === "string" || type === "data-path" || type === "enum") && typeof value !== "string") {
     diagnostics.push(error("invalid-field", path, `${name} items must be strings.`));
+  } else if (type === "enum" && field.values && !field.values.includes(value)) {
+    diagnostics.push(error("invalid-field", path, `${name} items must be one of ${field.values.join(", ")}.`));
   } else if (type === "id" && (typeof value !== "string" || !ID_PATTERN.test(value))) {
     diagnostics.push(error("invalid-field", path, `${name} items must be lowercase kebab-case IDs.`));
   }