filegrc 0.9.2 → 0.11.0

package/src/retention.js

@@ -0,0 +1,261 @@
+import { readFile } from "node:fs/promises";
+import { contentRevision } from "./files.js";
+import { resolveDataPath } from "./paths.js";
+import { programComponents } from "./program.js";
+import { markdownEntries } from "./resource-markdown.js";
+
+export async function assessRetentionReadiness(loaded, program, options = {}) {
+  if (!loaded.model.resources["retention-schedule-item"]) return [];
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const rules = loaded.resources.filter((record) => (
+    record.type === "retention-schedule-item" && record.status === "active"
+  ));
+  const revisions = await resourceReviewRevisions(loaded, rules.flatMap((rule) => retentionReviewResourceIds(rule, loaded)));
+  const usableRules = rules.filter((rule) => retentionRuleIsCurrent(rule, revisions, byId, loaded));
+  const uses = retentionUses(loaded, program);
+  const items = rules.filter((rule) => !usableRules.includes(rule)).map((rule) => readinessItem(
+    `retention-rule-${rule.id}`,
+    "action",
+    `Review ${rule.title}`,
+    "This active retention schedule item is incomplete or is not bound to every current source revision. Review it before relying on its period or disposition behavior.",
+    rule,
+    {
+      sourceResourceIds: retentionReviewResourceIds(rule, loaded),
+      commands: [
+        `npx filegrc get ${rule.id} --mutation`,
+        `npx filegrc review-bindings ${rule.id} --json`,
+        ...(rule.sourceResourceIds || [])
+          .filter((id) => ["policy", "document", "framework", "requirement", "commitment"].includes(byId.get(id)?.type))
+          .map((id) => `npx filegrc program-amendment ${id} --json`)
+      ]
+    }
+  ));
+  items.push(...uses.map((use) => {
+    const matches = usableRules.filter((rule) => ruleCoversUse(rule, use, program));
+    return readinessItem(
+      `retention-use-${use.resource.id}-${use.informationTypeId}`,
+      matches.length ? "complete" : "action",
+      `Decide retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`,
+      matches.length
+        ? `${use.resource.title} is covered by ${matches.map(({ title }) => title).join(", ")}.`
+        : `${use.resource.title} uses this Information Type, but no active, current retention schedule item covers both the type and scope. Management must choose the cutoff, period, and disposition.`,
+      use.resource,
+      {
+        informationTypeId: use.informationTypeId,
+        retentionScheduleItemIds: matches.map(({ id }) => id),
+        commands: [
+          "npx filegrc guide retention-schedule-item --json",
+          `npx filegrc scaffold retention-schedule-item --title ${shellArgument(`Retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`)}`
+        ]
+      }
+    );
+  }));
+
+  for (const coverage of loaded.resources.filter((record) => record.type === "source-coverage" && record.status === "active")) {
+    const linked = (coverage.retentionScheduleItemIds || []).map((id) => byId.get(id)).filter(Boolean);
+    const matching = linked.filter((rule) => (
+      rule.type === "retention-schedule-item"
+      && rule.status === "active"
+      && usableRules.includes(rule)
+      && (rule.scopeResourceIds || []).includes(coverage.id)
+    ));
+    items.push(readinessItem(
+      `retention-source-coverage-${coverage.id}`,
+      matching.length ? "complete" : "action",
+      `Confirm retained evidence for ${coverage.title}`,
+      matching.length
+        ? `The source-coverage record references a current schedule item scoped to this population.`
+        : `The source-coverage record must reference an active, current schedule item whose scope includes ${coverage.id}. A draft schedule or unrelated rule does not satisfy this check.`,
+      coverage,
+      {
+        retentionScheduleItemIds: matching.map(({ id }) => id),
+        commands: [
+          `npx filegrc get ${coverage.id} --mutation`,
+          "npx filegrc list retention-schedule-item --workflow --json"
+        ]
+      }
+    ));
+  }
+
+  const duplicates = nearDuplicateInformationTypes(loaded.resources);
+  if (duplicates.length) {
+    items.push(readinessItem(
+      "retention-information-type-duplicates",
+      options.informationTypesReviewed ? "complete" : "action",
+      "Review similar Information Types",
+      options.informationTypesReviewed
+        ? `${duplicates.length} similar pair${duplicates.length === 1 ? " was" : "s were"} included in the current Information Type inventory review. FileGRC did not merge records or rewrite relationships.`
+        : `${duplicates.length} similar pair${duplicates.length === 1 ? " needs" : "s need"} management review. FileGRC will not merge records or rewrite relationships automatically.`,
+      { type: "information-type" },
+      {
+        candidates: duplicates,
+        commands: [
+          "npx filegrc list information-type --workflow --json",
+          "npx filegrc review-collection information-type --scaffold"
+        ]
+      }
+    ));
+  }
+  return items;
+}
+
+export async function resourceReviewRevision(loaded, resourceId) {
+  return (await resourceReviewRevisions(loaded, [resourceId])).get(resourceId) || null;
+}
+
+export async function resourceReviewRevisions(loaded, ids) {
+  const wanted = new Set(ids);
+  const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
+  const revisions = new Map();
+  const reviewing = new Set();
+  const review = async (id) => {
+    if (revisions.has(id)) return revisions.get(id);
+    const entry = entries.get(id);
+    if (!entry || reviewing.has(id)) return null;
+    reviewing.add(id);
+    const parts = [entry.source];
+    for (const markdown of markdownEntries(loaded.model, entry.record)) {
+      try {
+        parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    for (const sourceId of [...new Set(entry.record.sourceResourceIds || [])].sort()) {
+      const revision = await review(sourceId);
+      if (revision) parts.push(`${sourceId}:${revision}`);
+    }
+    reviewing.delete(id);
+    const revision = contentRevision(parts.join("\n"));
+    revisions.set(id, revision);
+    return revision;
+  };
+  for (const id of wanted) {
+    await review(id);
+  }
+  return new Map([...revisions].filter(([id]) => wanted.has(id)));
+}
+
+export function retentionUses(loaded, program) {
+  const systemIds = new Set(program.systemIds || []);
+  const componentIds = new Set(programComponents(loaded, program).map(({ id }) => id));
+  const vendorIds = new Set(program.vendorIds || loaded.resources
+    .filter((record) => record.type === "vendor" && record.status !== "retired")
+    .map(({ id }) => id));
+  const uses = [];
+  for (const record of loaded.resources) {
+    if (record.type === "system" && systemIds.has(record.id)) {
+      for (const informationTypeId of record.informationTypeIds || []) uses.push({ resource: record, informationTypeId });
+    }
+    if (record.type === "component" && componentIds.has(record.id)) {
+      for (const use of record.informationUses || []) uses.push({ resource: record, informationTypeId: use.informationTypeId });
+    }
+    if (record.type === "vendor" && vendorIds.has(record.id)) {
+      for (const informationTypeId of record.informationTypeIds || []) uses.push({ resource: record, informationTypeId });
+    }
+  }
+  return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
+}
+
+export function nearDuplicateInformationTypes(records) {
+  const types = records.filter((record) => record.type === "information-type" && !["retired", "superseded"].includes(record.status));
+  const pairs = [];
+  for (let leftIndex = 0; leftIndex < types.length; leftIndex += 1) {
+    for (let rightIndex = leftIndex + 1; rightIndex < types.length; rightIndex += 1) {
+      const left = types[leftIndex];
+      const right = types[rightIndex];
+      const score = similarity(normalize(left.title), normalize(right.title));
+      if (score >= 0.8) pairs.push({ leftId: left.id, rightId: right.id, score });
+    }
+  }
+  return pairs;
+}
+
+function ruleCoversUse(rule, use, program) {
+  if (!(rule.informationTypeIds || []).includes(use.informationTypeId)) return false;
+  const scope = new Set(rule.scopeResourceIds || []);
+  return scope.has(use.resource.id) || scope.has(program.id);
+}
+
+export function retentionReviewResourceIds(rule, loaded) {
+  const programUseIds = [];
+  if (loaded) {
+    const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+    const informationTypeIds = new Set(rule.informationTypeIds || []);
+    for (const scopeId of rule.scopeResourceIds || []) {
+      const program = byId.get(scopeId);
+      if (program?.type !== "program") continue;
+      for (const use of retentionUses(loaded, program)) {
+        if (informationTypeIds.has(use.informationTypeId)) programUseIds.push(use.resource.id);
+      }
+    }
+  }
+  return [...new Set([
+    rule.scheduleDocumentId,
+    ...(rule.sourceResourceIds || []),
+    ...(rule.informationTypeIds || []),
+    ...(rule.scopeResourceIds || []),
+    ...programUseIds
+  ].filter(Boolean))];
+}
+
+export function retentionRuleIsCurrent(rule, revisions, byId = new Map(), loaded) {
+  if (!String(rule.description || "").trim()) return false;
+  if (!(rule.informationTypeIds || []).length || !(rule.scopeResourceIds || []).length || !rule.scheduleDocumentId) return false;
+  const schedule = byId.get(rule.scheduleDocumentId);
+  if (schedule?.type !== "document" || schedule.documentKind !== "schedule" || schedule.workflowScope !== "program" || ["superseded", "retired"].includes(schedule.status)) return false;
+  if (!(rule.ownerIds || []).length || !(rule.approvedByIds || []).length || !rule.approvedOn) return false;
+  if (!rule.reviewedSourceRevisions || typeof rule.reviewedSourceRevisions !== "object") return false;
+  if (!retentionCutoffIsComplete(rule.cutoff) || !retentionPeriodIsComplete(rule.retentionPeriod)) return false;
+  if (!["delete", "destroy", "erase", "anonymize", "transfer", "retain-permanently"].includes(rule.dispositionAction)) return false;
+  if (!String(rule.dispositionInstructions || "").trim()) return false;
+  const dependencyIds = retentionReviewResourceIds(rule, loaded);
+  if (Object.keys(rule.reviewedSourceRevisions).length !== dependencyIds.length) return false;
+  return dependencyIds.every((id) => (
+    revisions.get(id) && rule.reviewedSourceRevisions?.[id] === revisions.get(id)
+  ));
+}
+
+function shellArgument(value) {
+  const text = String(value);
+  return /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(text)
+    ? text
+    : `'${text.replaceAll("'", "'\\''")}'`;
+}
+
+function retentionCutoffIsComplete(cutoff) {
+  if (!cutoff || !["creation", "receipt", "calendar-year-end", "fiscal-year-end", "event"].includes(cutoff.basis)) return false;
+  return cutoff.basis !== "event" || Boolean(String(cutoff.event || "").trim());
+}
+
+function retentionPeriodIsComplete(period) {
+  if (!period || !["fixed", "until-event", "permanent"].includes(period.basis)) return false;
+  if (period.basis === "fixed") {
+    return Number.isInteger(period.amount) && period.amount >= 1 && ["day", "month", "year"].includes(period.unit);
+  }
+  return period.basis !== "until-event" || Boolean(String(period.event || "").trim());
+}
+
+function normalize(value) {
+  return new Set(String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().split(/\s+/).filter(Boolean).map((word) => (
+    word.length > 3 && word.endsWith("s") ? word.slice(0, -1) : word
+  )));
+}
+
+function similarity(left, right) {
+  if (!left.size || !right.size) return 0;
+  const intersection = [...left].filter((word) => right.has(word)).length;
+  return Number((intersection / new Set([...left, ...right]).size).toFixed(2));
+}
+
+function readinessItem(id, status, title, message, resource = {}, details = {}) {
+  return {
+    id,
+    status,
+    title,
+    message,
+    ...(resource.type ? { resourceType: resource.type } : {}),
+    ...(resource.id ? { resourceId: resource.id } : {}),
+    ...details
+  };
+}

package/src/server.js

@@ -46,7 +46,8 @@ import {
 import { isWithin, relativeToWorkspace, resolveWorkspacePath } from "./paths.js";
 import { activatePolicies } from "./policy-activation.js";
 import { applyReconciliation, planReconciliation } from "./reconciliation.js";
-import { createAppState, createResourceDetail } from "./state.js";
+import { resourceReviewRevisions } from "./retention.js";
+import { createAppBootstrap, createAppState, createAppStateSection, createResourceDetail } from "./state.js";
 import { setupWorkspace } from "./setup.js";
 import { collectTimings, measureTiming, timingEnabled } from "./timing.js";
 import {
@@ -59,6 +60,8 @@ import { loadWorkspace } from "./workspace.js";
 import { APP_SCRIPT, APP_STYLES, renderIndex } from "./web.js";
 
 export function createFilegrcServer(input = process.cwd(), options = {}) {
+  const stateSessions = new Map();
+  let nextStateSession = 0;
   return createHttpServer(async (request, response) => {
     const requestStarted = performance.now();
     if (timingEnabled()) {
@@ -94,6 +97,31 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           includeDetails: false
         }));
       }
+      if (request.method === "GET" && url.pathname === "/api/state/bootstrap") {
+        const loaded = await serializeWorkspaceMutation(input, (root) => loadWorkspace(root));
+        const token = `${Date.now().toString(36)}-${(++nextStateSession).toString(36)}`;
+        const session = {
+          loaded,
+          generatedAt: new Date().toISOString(),
+          promises: new Map()
+        };
+        stateSessions.set(token, session);
+        while (stateSessions.size > 8) stateSessions.delete(stateSessions.keys().next().value);
+        const state = await createAppBootstrap(loaded, { generatedAt: session.generatedAt });
+        state.stateToken = token;
+        return json(response, 200, state);
+      }
+      if (request.method === "GET" && url.pathname.startsWith("/api/state/")) {
+        const section = url.pathname.slice("/api/state/".length);
+        if (!["repository", "program", "obligations", "audits", "workflow"].includes(section)) {
+          return json(response, 404, { error: "Unknown app-state section." });
+        }
+        const token = url.searchParams.get("token");
+        const session = stateSessions.get(token);
+        if (!session) return json(response, 409, { error: "The workspace state expired. Reload it and try again." });
+        const state = await loadStateSessionSection(session, section, options);
+        return json(response, 200, { stateToken: token, section, state });
+      }
       if (request.method === "GET" && url.pathname === "/api/history") {
         const path = url.searchParams.get("path");
         if (!path || path.includes("..") || !path.startsWith("data/")) return json(response, 400, { error: "A safe data path is required." });
@@ -319,7 +347,8 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         const payload = await readJson(request);
         const completeSetup = async () => {
           return browserMutation(input, options, {
-            message: (setupResult) => `${payload.draft === true ? "Save onboarding draft" : "Complete onboarding"} for ${setupResult.workspace.organizationName}`
+            message: (setupResult) => `${payload.draft === true ? "Save onboarding draft" : "Complete onboarding"} for ${setupResult.workspace.organizationName}`,
+            fastResponse: prefersFastMutation(request)
           }, () => setupWorkspace(input, payload));
         };
         return json(response, 200, await completeSetup());
@@ -389,6 +418,17 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           readOnly: repository.mode === "trunk" && !repository.writesAllowed
         });
       }
+      if (request.method === "GET" && url.pathname === "/api/review-revisions") {
+        const ids = [...new Set(url.searchParams.getAll("id"))];
+        if (!ids.length || ids.some((id) => !safeSegment(id))) {
+          return json(response, 400, { error: "Pass one or more safe resource IDs." });
+        }
+        const loaded = await loadWorkspace(input);
+        const revisions = await resourceReviewRevisions(loaded, ids);
+        const missing = ids.filter((id) => !revisions.has(id));
+        if (missing.length) return json(response, 404, { error: `Resources not found: ${missing.join(", ")}.` });
+        return json(response, 200, { revisions: Object.fromEntries(revisions) });
+      }
       if (request.method === "PUT" && url.pathname === "/api/content") {
         const payload = await readJson(request);
         const result = await browserMutation(input, options, {
@@ -593,6 +633,40 @@ export function reconcileMutationSynchronization(synchronization, repository) {
   };
 }
 
+function loadStateSessionSection(session, section, serverOptions) {
+  if (session.promises.has(section)) return session.promises.get(section);
+  const dependencies = section === "workflow"
+    ? Promise.all([
+        loadStateSessionSection(session, "repository", serverOptions),
+        loadStateSessionSection(session, "program", serverOptions),
+        loadStateSessionSection(session, "obligations", serverOptions),
+        loadStateSessionSection(session, "audits", serverOptions)
+      ])
+    : section === "audits"
+      ? Promise.all([loadStateSessionSection(session, "program", serverOptions)])
+      : Promise.resolve([]);
+  const promise = dependencies.then((results) => {
+    const repository = section === "workflow" ? results[0] : null;
+    const program = section === "workflow" ? results[1] : section === "audits" ? results[0] : null;
+    const obligations = section === "workflow" ? results[2] : null;
+    const audits = section === "workflow" ? results[3] : null;
+    return createAppStateSection(session.loaded, section, {
+      allowNonAuthoritativeWrites: serverOptions.allowNonAuthoritativeWrites,
+      generatedAt: session.generatedAt,
+      programReadiness: program?.programReadiness,
+      auditPreparations: audits?.auditPreparations,
+      obligations: obligations?.obligations,
+      git: repository?.git,
+      validation: repository?.validation
+    });
+  }).catch((error) => {
+    session.promises.delete(section);
+    throw error;
+  });
+  session.promises.set(section, promise);
+  return promise;
+}
+
 function prefersFastMutation(request) {
   return String(request.headers.prefer || "")
     .split(",")

package/src/setup.js

@@ -81,7 +81,7 @@ export function summarizeSetupResult(result) {
     },
     system: setupSystemSummary(result.system),
     target: setupTargetSummary(result.program || result.workspace, {
-      modelVersion: result.workspace?.dataModelVersion || (result.program ? "6" : "3")
+      modelVersion: result.workspace?.dataModelVersion || (result.program ? "7" : "3")
     }),
     renderer: result.renderer ? setupRendererSummary(result.renderer) : null,
     commitment: result.commitment || null,

package/src/source-coverage.js

@@ -1,7 +1,21 @@
-export function sourceCoverageComplete(record, loaded, program = loaded.workspace) {
-  if (!record?.validFrom || !record.collectionCadence || !record.retention || !record.reconciliationMethod) {
+import { resourceReviewRevisions, retentionReviewResourceIds, retentionRuleIsCurrent } from "./retention.js";
+
+export async function sourceCoverageComplete(record, loaded, program = loaded.workspace) {
+  const structuredRetention = loaded.model.resources["retention-schedule-item"];
+  if (!record?.validFrom || !record.collectionCadence || !record.reconciliationMethod) {
     return false;
   }
+  if (structuredRetention) {
+    const linkedRules = (record.retentionScheduleItemIds || []).map((id) => (
+      loaded.resources.find((resource) => resource.id === id && resource.type === "retention-schedule-item")
+    ));
+    const revisions = await resourceReviewRevisions(loaded, linkedRules.filter(Boolean).flatMap((rule) => retentionReviewResourceIds(rule, loaded)));
+    if (!linkedRules.some((rule) => (
+      rule?.status === "active"
+      && (rule.scopeResourceIds || []).includes(record.id)
+      && retentionRuleIsCurrent(rule, revisions, new Map(loaded.resources.map((resource) => [resource.id, resource])), loaded)
+    ))) return false;
+  } else if (!record.retention) return false;
   const external = record.coverageKind === "external-system" || record.coverageKind === "external-component";
   const sourceId = record.componentId || record.systemId;
   if (external && (!sourceId || !(record.retrieverIds || []).length)) {
@@ -34,7 +48,7 @@ export function sourceCoverageComplete(record, loaded, program = loaded.workspac
   return true;
 }
 
-export function assessSourceCoverageReadiness(loaded, selectedControlIds = [], program = loaded.workspace) {
+export async function assessSourceCoverageReadiness(loaded, selectedControlIds = [], program = loaded.workspace) {
   if (!loaded.model.resources["source-coverage"]) return [];
   const selected = new Set(selectedControlIds);
   const selectedControlCodes = new Set(loaded.resources
@@ -45,9 +59,9 @@ export function assessSourceCoverageReadiness(loaded, selectedControlIds = [], p
     ))
     .map(({ code }) => code)
     .filter(Boolean));
-  return (loaded.model.evidenceSourceFamilies || [])
+  return Promise.all((loaded.model.evidenceSourceFamilies || [])
     .filter((family) => family.controlCodes.some((code) => selectedControlCodes.has(code)))
-    .map((family) => {
+    .map(async (family) => {
       const records = loaded.resources.filter((record) => (
         record.type === "source-coverage"
         && record.sourceFamilyId === family.id
@@ -59,7 +73,7 @@ export function assessSourceCoverageReadiness(loaded, selectedControlIds = [], p
       return {
         family,
         record,
-        complete: Boolean(record?.status === "active" && sourceCoverageComplete(record, loaded, program))
+        complete: Boolean(record?.status === "active" && await sourceCoverageComplete(record, loaded, program))
       };
-    });
+    }));
 }

package/src/state.js

@@ -37,6 +37,174 @@ export async function createAppState(input = process.cwd(), options = {}) {
   return promise;
 }
 
+export async function createAppBootstrap(input = process.cwd(), options = {}) {
+  const loaded = input?.entries && input?.root ? input : await loadWorkspace(input);
+  const workspace = loaded.workspace ?? {
+    dataModelVersion: loaded.model.modelVersion,
+    id: "workspace",
+    type: "workspace",
+    title: "filegrc workspace",
+    organizationName: "Workspace configuration unavailable",
+    timezone: "UTC"
+  };
+  const generatedAt = options.generatedAt ?? new Date().toISOString();
+  return {
+    generatedAt,
+    asOf: options.asOf ?? currentCalendarDate(workspace.timezone),
+    readOnly: true,
+    repository: {
+      loading: true,
+      mode: null,
+      status: "loading",
+      label: "Checking Git",
+      writesAllowed: false
+    },
+    workspace,
+    model: loaded.model,
+    resources: loaded.entries.map((entry) => ({
+      record: structuredClone(entry.record),
+      relativePath: `data/${entry.relativePath}`,
+      revision: contentRevision(entry.source),
+      content: {},
+      history: undefined,
+      detailsLoaded: false
+    })),
+    validation: {
+      loading: true,
+      ok: null,
+      counts: { errors: 0, warnings: 0 },
+      diagnostics: []
+    },
+    obligations: { loading: true, items: [], triggers: [], counts: {} },
+    collectionReviews: {},
+    applicabilityConstraints: {},
+    programReadiness: null,
+    auditPreparations: {},
+    workflow: { loading: true, findings: [], workItems: [], assessments: {} },
+    git: {
+      loading: true,
+      available: false,
+      clean: null,
+      changes: [],
+      branch: null,
+      shortCommit: "checking"
+    },
+    sections: {
+      repository: "loading",
+      program: "idle",
+      obligations: "idle",
+      audits: "idle",
+      workflow: "idle"
+    }
+  };
+}
+
+export async function createAppStateSection(input, section, options = {}) {
+  const loaded = input?.entries && input?.root ? input : await loadWorkspace(input);
+  const workspace = loaded.workspace;
+  const asOf = options.asOf ?? currentCalendarDate(workspace?.timezone || "UTC");
+  const generatedAt = options.generatedAt ?? new Date().toISOString();
+  if (section === "repository") {
+    const [validation, snapshot] = await Promise.all([
+      validateWorkspace(loaded),
+      measureTiming("state-repository-snapshot", () => getRepositorySnapshot(loaded.root))
+    ]);
+    const git = { ...snapshot };
+    delete git.root;
+    const repository = await measureTiming("state-repository", () => getBrowserRepositoryState(loaded, {
+      readOnly: options.readOnly,
+      allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites,
+      repositorySnapshot: git
+    }));
+    return {
+      generatedAt,
+      readOnly: Boolean(options.readOnly || (repository.mode === "trunk" && !repository.writesAllowed)),
+      repository,
+      git,
+      validation: {
+        ok: validation.ok,
+        counts: validation.counts,
+        diagnostics: validation.diagnostics
+      }
+    };
+  }
+  if (section === "program") {
+    const programReadiness = options.programReadiness ?? await assessProgramReadiness(loaded, { asOf, generatedAt });
+    const activeProgram = resolveProgram(loaded);
+    return {
+      generatedAt,
+      asOf,
+      programReadiness,
+      collectionReviews: Object.fromEntries(
+        assessCollectionReviews(loaded).map((assessment) => [
+          assessment.resourceType,
+          {
+            resourceType: assessment.resourceType,
+            configuration: assessment.configuration,
+            recordCount: assessment.recordCount,
+            review: assessment.review,
+            reviewRevision: assessment.reviewRevision,
+            collectionRevision: assessment.collectionRevision,
+            status: assessment.status,
+            complete: assessment.complete,
+            message: assessment.message
+          }
+        ])
+      ),
+      applicabilityConstraints: Object.fromEntries(loaded.resources.flatMap((record) => {
+        const constraint = soc2RequirementApplicabilityConstraint(record, activeProgram, loaded.model.modelVersion);
+        return constraint ? [[record.id, constraint]] : [];
+      }))
+    };
+  }
+  if (section === "obligations") {
+    return {
+      generatedAt,
+      asOf,
+      obligations: planObligations(loaded.resources, {
+        asOf,
+        now: options.now ?? generatedAt,
+        model: loaded.model
+      })
+    };
+  }
+  if (section === "audits") {
+    const programReadiness = options.programReadiness;
+    const audits = loaded.resources.filter((record) => record.type === "audit");
+    return {
+      generatedAt,
+      asOf,
+      auditPreparations: Object.fromEntries(await Promise.all(
+        (audits.length ? audits : [null]).map(async (audit) => [
+          audit?.id || "none",
+          await assessAuditPreparation(loaded, {
+            auditId: audit?.id,
+            asOf,
+            generatedAt,
+            ...(audit || !programReadiness ? {} : { programReadiness })
+          })
+        ])
+      ))
+    };
+  }
+  if (section === "workflow") {
+    return {
+      generatedAt,
+      asOf,
+      workflow: await assessWorkflow(loaded, {
+        asOf,
+        evaluatedAt: generatedAt,
+        programReadiness: options.programReadiness,
+        auditPreparations: options.auditPreparations,
+        obligations: options.obligations,
+        git: options.git,
+        validation: options.validation
+      })
+    };
+  }
+  throw new Error(`Unknown app-state section "${section}".`);
+}
+
 async function createAppStateUnlocked(input, options) {
   let validation;
   if (options.validationProof) {
@@ -65,7 +233,7 @@ async function createAppStateUnlocked(input, options) {
 
   const git = { ...await measureTiming("state-repository-snapshot", () => getRepositorySnapshot(loaded.root)) };
   delete git.root;
-  const repository = await measureTiming("state-repository", () => getBrowserRepositoryState(loaded.root, {
+  const repository = await measureTiming("state-repository", () => getBrowserRepositoryState(loaded, {
     readOnly: options.readOnly,
     allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites,
     repositorySnapshot: git
@@ -94,8 +262,9 @@ async function createAppStateUnlocked(input, options) {
     (audits.length ? audits : [null]).map(async (audit) => {
       const preparation = await assessAuditPreparation(loaded, {
         auditId: audit?.id,
+        asOf,
         generatedAt,
-        programReadiness
+        ...(audit ? {} : { programReadiness })
       });
       return [audit?.id || "none", preparation];
     })