mergen-server 1.4.0

package/dist/intelligence/plans.js

@@ -0,0 +1,223 @@
+const NO_CAPS = {
+  hitlApproval: false,
+  overrideCorpusEnforce: false,
+  ciGate: false,
+  credentialBrokering: false,
+  agentIam: false
+};
+const CANONICAL_PLANS = {
+  free: {
+    id: "free",
+    name: "Free (OSS)",
+    rank: 0,
+    tagline: "Local-first logs and traces for developers",
+    seats: "1 developer",
+    maxServices: 1,
+    bufferSize: 2e3,
+    backendObservability: false,
+    analyzeCreditsPerMonth: 10,
+    overageCentsPerCredit: 0,
+    seatCap: 1,
+    overageCentsPerSeat: 0,
+    includedToolCallsPerMonth: 1e3,
+    overageCentsPerThousandToolCalls: 0,
+    // hard stop at limit — no paid overage on Free
+    capabilities: { ...NO_CAPS },
+    ctaUrl: "https://mergen.app/pricing",
+    priceDescription: "Free forever"
+  },
+  starter: {
+    id: "starter",
+    name: "Starter",
+    rank: 1,
+    tagline: "Shared policies, workspace collaboration, and safety for small AI teams",
+    seats: "5 included seats (+$15 / additional seat)",
+    maxServices: 5,
+    bufferSize: 1e4,
+    backendObservability: true,
+    analyzeCreditsPerMonth: 500,
+    overageCentsPerCredit: 10,
+    seatCap: 5,
+    overageCentsPerSeat: 1500,
+    // $15.00/mo per seat beyond 5
+    includedToolCallsPerMonth: 1e4,
+    overageCentsPerThousandToolCalls: 500,
+    // $5 / 1,000 calls over
+    // Basic multi-cloud credential brokering + shared override sync across
+    // environments — the first step above the free local-only gate.
+    capabilities: { ...NO_CAPS, overrideCorpusEnforce: true, credentialBrokering: true },
+    ctaUrl: "https://mergen.app/pricing#starter",
+    priceDescription: "$79 / month founding price ($149 regular)"
+  },
+  team: {
+    id: "team",
+    name: "Team",
+    rank: 2,
+    tagline: "Slack approvals, RBAC, CI/CD gates, and runtime visualization for scaling companies",
+    seats: "20 included seats (+$20 / additional seat)",
+    maxServices: 25,
+    bufferSize: 5e4,
+    backendObservability: true,
+    analyzeCreditsPerMonth: 1e3,
+    overageCentsPerCredit: 5,
+    seatCap: 20,
+    overageCentsPerSeat: 2e3,
+    // $20.00/mo per seat beyond 20
+    includedToolCallsPerMonth: 1e5,
+    // 100K tool calls
+    overageCentsPerThousandToolCalls: 500,
+    // $5 / 1,000 calls over
+    // HITL Slack approval loops (OIDC/JWKS-verified approver identity) and
+    // the CI/CD PR diff gate both unlock here — this is the launch tier's
+    // top rung, so it carries every governance primitive except full
+    // enterprise IAM/SSO federation.
+    capabilities: { hitlApproval: true, overrideCorpusEnforce: true, ciGate: true, credentialBrokering: true, agentIam: false },
+    ctaUrl: "https://mergen.app/pricing#team",
+    priceDescription: "$399 / month founding price ($499 regular)"
+  },
+  // Platform and Enterprise are intentionally held back from the launch
+  // pricing page (three-tier funnel: Free/Starter/Team only) to avoid
+  // overloading early-stage adoption with procurement-heavy tiers — but the
+  // ladder stays defined here since existing legacy-alias customers
+  // (solo_power, pay_as_you_go) resolve to them, and they're the natural
+  // next rung once a team outgrows Team's seat/quota ceiling.
+  platform: {
+    id: "platform",
+    name: "Platform",
+    rank: 3,
+    tagline: "Unlimited scale on top of Team\u2019s governance primitives",
+    seats: "Unlimited",
+    maxServices: Infinity,
+    bufferSize: 2e5,
+    backendObservability: true,
+    analyzeCreditsPerMonth: 5e3,
+    overageCentsPerCredit: 2,
+    seatCap: Infinity,
+    overageCentsPerSeat: 0,
+    includedToolCallsPerMonth: 25e4,
+    overageCentsPerThousandToolCalls: 600,
+    // $6 / 1,000 calls over
+    capabilities: { hitlApproval: true, overrideCorpusEnforce: true, ciGate: true, credentialBrokering: true, agentIam: false },
+    ctaUrl: "https://mergen.app/pricing#platform",
+    priceDescription: "$10,000 / month base"
+  },
+  enterprise: {
+    id: "enterprise",
+    name: "Enterprise",
+    rank: 4,
+    tagline: "VPC deployment, SSO/IAM federation, and strict policy engine for regulated environments",
+    seats: "Custom",
+    maxServices: Infinity,
+    bufferSize: 1e6,
+    backendObservability: true,
+    analyzeCreditsPerMonth: 0,
+    overageCentsPerCredit: 0,
+    seatCap: Infinity,
+    overageCentsPerSeat: 0,
+    includedToolCallsPerMonth: 0,
+    // unlimited — custom-contracted, not metered
+    overageCentsPerThousandToolCalls: 0,
+    // Full Agent IAM — SSO federation + enterprise identity/credential governance.
+    capabilities: { hitlApproval: true, overrideCorpusEnforce: true, ciGate: true, credentialBrokering: true, agentIam: true },
+    ctaUrl: "https://mergen.app/pricing#enterprise",
+    priceDescription: "Custom ACV ($100K+ / year)"
+  }
+};
+const PLAN_ORDER = ["free", "starter", "team", "platform", "enterprise"];
+const LEGACY_ALIASES = {
+  solo_starter: "starter",
+  solo_pro: "team",
+  solo_power: "platform",
+  pay_as_you_go: "enterprise"
+};
+function buildPlans() {
+  const all = { ...CANONICAL_PLANS };
+  for (const [aliasId, canonicalId] of Object.entries(LEGACY_ALIASES)) {
+    const base = CANONICAL_PLANS[canonicalId];
+    all[aliasId] = {
+      ...base,
+      capabilities: { ...base.capabilities },
+      id: aliasId,
+      name: `${base.name} (Legacy)`
+    };
+  }
+  return all;
+}
+const PLANS = buildPlans();
+function getPlan(planId) {
+  return PLANS[planId ?? ""] ?? PLANS["free"];
+}
+function getPlanRank(planId) {
+  return getPlan(planId).rank;
+}
+function planMeetsMin(planId, minPlanId) {
+  return getPlanRank(planId) >= getPlanRank(minPlanId);
+}
+function planHasCapability(planId, cap) {
+  return getPlan(planId).capabilities[cap] === true;
+}
+const LOWEST_PAID_PLAN = "starter";
+function minPlanForGate(gate) {
+  if (gate === "free" || gate === "all") return "free";
+  if (gate === "pro") return LOWEST_PAID_PLAN;
+  return PLANS[gate] ? gate : "free";
+}
+function planAllowsGate(planId, gate) {
+  return planMeetsMin(planId, minPlanForGate(gate));
+}
+function planAllowsTier(planId, tier) {
+  return planAllowsGate(planId, tier);
+}
+function estimateToolCallOverageCents(planId, toolCallsThisMonth) {
+  const plan = getPlan(planId);
+  const included = plan.includedToolCallsPerMonth;
+  const rate = plan.overageCentsPerThousandToolCalls;
+  if (included === 0 || rate === 0) return 0;
+  const overage = Math.max(0, toolCallsThisMonth - included);
+  return Math.ceil(overage / 1e3 * rate);
+}
+function estimateSeatOverageCents(planId, activeSeats) {
+  const plan = getPlan(planId);
+  const cap = plan.seatCap;
+  const rate = plan.overageCentsPerSeat;
+  if (!isFinite(cap) || rate === 0) return 0;
+  return Math.max(0, activeSeats - cap) * rate;
+}
+const CAPABILITY_LABELS = {
+  hitlApproval: "HITL approve/deny holds",
+  overrideCorpusEnforce: "Override-corpus enforcement (BLOCK/HOLD)",
+  ciGate: "CI/CD blast-radius gate",
+  credentialBrokering: "Ephemeral multi-cloud credential brokering",
+  agentIam: "Agent IAM: SSO federation + enterprise credential governance"
+};
+const CAPABILITY_KEYS = Object.keys(CAPABILITY_LABELS);
+function describeEntitlement(planId) {
+  const plan = getPlan(planId);
+  const unlocked = CAPABILITY_KEYS.filter((cap) => plan.capabilities[cap]).map((cap) => CAPABILITY_LABELS[cap]);
+  const nextPlanId = PLAN_ORDER.find((id) => PLANS[id].rank === plan.rank + 1);
+  const upgradeLines = [];
+  if (nextPlanId) {
+    const next = getPlan(nextPlanId);
+    const newlyUnlocked = CAPABILITY_KEYS.filter((cap) => next.capabilities[cap] && !plan.capabilities[cap]).map((cap) => CAPABILITY_LABELS[cap]);
+    const suffix = newlyUnlocked.length > 0 ? ` \u2014 unlocks ${newlyUnlocked.join(", ")}` : "";
+    upgradeLines.push(
+      `> **Upgrade to ${next.name}** (${next.priceDescription})${suffix}`,
+      `> ${next.ctaUrl}`
+    );
+  }
+  return { unlocked, upgradeLines };
+}
+export {
+  PLANS,
+  PLAN_ORDER,
+  describeEntitlement,
+  estimateSeatOverageCents,
+  estimateToolCallOverageCents,
+  getPlan,
+  getPlanRank,
+  minPlanForGate,
+  planAllowsGate,
+  planAllowsTier,
+  planHasCapability,
+  planMeetsMin
+};

package/dist/intelligence/platt-scaling.js

@@ -0,0 +1,164 @@
+import { getRecords, getStats } from "./calibration.js";
+import path from "path";
+import fs from "fs";
+import { DATA_DIR } from "../sensor/paths.js";
+const LEARNING_RATE = 0.1;
+const EPOCHS = 200;
+const MIN_SAMPLES = 10;
+const CACHE_TTL_MS = 5 * 6e4;
+const FEDERATED_FILE = path.join(DATA_DIR, "federated-calibration.json");
+const _cache = /* @__PURE__ */ new Map();
+let _federatedCache = null;
+let _federatedLoadedAt = 0;
+function sigmoid(z) {
+  return 1 / (1 + Math.exp(-z));
+}
+function getFederatedParams(tag) {
+  const now = Date.now();
+  if (!_federatedCache || now - _federatedLoadedAt > CACHE_TTL_MS) {
+    try {
+      if (fs.existsSync(FEDERATED_FILE)) {
+        const raw = fs.readFileSync(FEDERATED_FILE, "utf8");
+        _federatedCache = JSON.parse(raw);
+        _federatedLoadedAt = now;
+      } else {
+        _federatedCache = { tags: {} };
+      }
+    } catch {
+      _federatedCache = { tags: {} };
+    }
+  }
+  if (_federatedCache && _federatedCache.tags && _federatedCache.tags[tag]) {
+    const val = _federatedCache.tags[tag];
+    return {
+      A: val.A,
+      B: val.B,
+      n: val.n,
+      holdoutAccuracy: val.accuracy
+    };
+  }
+  return null;
+}
+function fitPlattParams(samples, y_pos, y_neg) {
+  let A = -1;
+  let B = 0;
+  for (let epoch = 0; epoch < EPOCHS; epoch++) {
+    let dA = 0, dB = 0;
+    for (const { score, isCorrect } of samples) {
+      const p = sigmoid(A * score + B);
+      const y = isCorrect ? y_pos : y_neg;
+      const err = p - y;
+      dA += err * score;
+      dB += err;
+    }
+    A -= LEARNING_RATE * dA / samples.length;
+    B -= LEARNING_RATE * dB / samples.length;
+  }
+  return { A, B };
+}
+function fitPlatt(samples) {
+  if (samples.length < MIN_SAMPLES) return null;
+  const N_pos = samples.filter((s) => s.isCorrect).length;
+  const N_neg = samples.length - N_pos;
+  const y_pos = (N_pos + 1) / (N_pos + 2);
+  const y_neg = 1 / (N_neg + 2);
+  const { A, B } = fitPlattParams(samples, y_pos, y_neg);
+  let looCorrect = 0;
+  for (let i = 0; i < samples.length; i++) {
+    const subset = samples.slice(0, i).concat(samples.slice(i + 1));
+    const sub_N_pos = subset.filter((s) => s.isCorrect).length;
+    const sub_N_neg = subset.length - sub_N_pos;
+    const sub_y_pos = (sub_N_pos + 1) / (sub_N_pos + 2);
+    const sub_y_neg = 1 / (sub_N_neg + 2);
+    const { A: subA, B: subB } = fitPlattParams(subset, sub_y_pos, sub_y_neg);
+    const target = samples[i];
+    const p = sigmoid(subA * target.score + subB);
+    const predictedCorrect = p >= 0.5;
+    if (predictedCorrect === target.isCorrect) {
+      looCorrect++;
+    }
+  }
+  const holdoutAccuracy = looCorrect / samples.length;
+  return { A, B, n: samples.length, holdoutAccuracy };
+}
+function scoreOfRecord(r) {
+  return r.numericScore ?? r.confidenceScore ?? 0;
+}
+function getParams(tag) {
+  const now = Date.now();
+  const cached = _cache.get(tag);
+  if (cached && now - cached.fittedAt < CACHE_TTL_MS) return cached.params;
+  const records = getRecords().filter(
+    (r) => r.verdict !== null && (r.numericScore !== void 0 || r.confidenceScore !== void 0)
+  );
+  let samples;
+  if (tag === "global") {
+    samples = records.map((r) => ({
+      score: scoreOfRecord(r),
+      isCorrect: r.verdict === "correct" || r.verdict === "partial"
+    }));
+  } else {
+    samples = records.filter((r) => r.tag === tag).map((r) => ({
+      score: scoreOfRecord(r),
+      isCorrect: r.verdict === "correct" || r.verdict === "partial"
+    }));
+  }
+  const params = fitPlatt(samples);
+  if (params) _cache.set(tag, { params, fittedAt: now });
+  return params;
+}
+function plattScale(rawScore, tag) {
+  if (tag) {
+    const tagParams = getParams(tag);
+    if (tagParams) {
+      return {
+        calibrated: Math.min(0.99, Math.max(0.01, sigmoid(tagParams.A * rawScore + tagParams.B))),
+        source: "tag-platt",
+        n: tagParams.n
+      };
+    }
+  }
+  if (tag) {
+    const fedParams = getFederatedParams(tag);
+    if (fedParams) {
+      return {
+        calibrated: Math.min(0.99, Math.max(0.01, sigmoid(fedParams.A * rawScore + fedParams.B))),
+        source: "federated-platt",
+        n: fedParams.n
+      };
+    }
+  }
+  const globalParams = getParams("global");
+  if (globalParams) {
+    return {
+      calibrated: Math.min(0.99, Math.max(0.01, sigmoid(globalParams.A * rawScore + globalParams.B))),
+      source: "global-platt",
+      n: globalParams.n
+    };
+  }
+  if (tag) {
+    const stats = getStats().find((s) => s.tag === tag);
+    if (stats?.trusted) {
+      return { calibrated: stats.accuracy, source: "empirical", n: stats.verdicts };
+    }
+  }
+  return { calibrated: rawScore, source: "raw", n: 0 };
+}
+function invalidatePlattCache() {
+  _cache.clear();
+}
+function getPlattDiagnostics() {
+  const now = Date.now();
+  return [..._cache.entries()].filter(([, v]) => now - v.fittedAt < CACHE_TTL_MS).map(([tag, { params }]) => ({
+    tag,
+    A: params.A,
+    B: params.B,
+    n: params.n,
+    holdoutAccuracy: params.holdoutAccuracy
+  }));
+}
+export {
+  getPlattDiagnostics,
+  invalidatePlattCache,
+  plattScale
+};

package/dist/intelligence/policy-proposals.js

@@ -0,0 +1,84 @@
+import fs from "fs";
+import path from "path";
+import { randomUUID } from "crypto";
+import { DATA_DIR, zeroRetentionMode } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const PROPOSALS_FILE = path.join(DATA_DIR, "policy-proposals.json");
+let _proposals = null;
+function load() {
+  if (_proposals) return _proposals;
+  if (zeroRetentionMode() || !fs.existsSync(PROPOSALS_FILE)) {
+    _proposals = [];
+    return _proposals;
+  }
+  try {
+    _proposals = JSON.parse(fs.readFileSync(PROPOSALS_FILE, "utf8"));
+  } catch (err) {
+    logger.warn({ err }, "policy-proposals: file unreadable \u2014 starting empty");
+    _proposals = [];
+  }
+  return _proposals;
+}
+function persist() {
+  if (zeroRetentionMode()) return;
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const tmp = `${PROPOSALS_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(_proposals ?? [], null, 2));
+    fs.renameSync(tmp, PROPOSALS_FILE);
+  } catch (err) {
+    logger.warn({ err }, "policy-proposals: persist failed");
+  }
+}
+function stageProposal(ruleHash, rule, sourceOccurrences) {
+  if (rule.action !== "warn") {
+    throw new Error(`policy-proposals: refusing to stage a non-HOLD proposal (action=${rule.action})`);
+  }
+  const list = load();
+  const existing = list.find((p) => p.ruleHash === ruleHash && p.status !== "rejected");
+  if (existing) return null;
+  const proposal = {
+    id: randomUUID(),
+    ruleHash,
+    rule,
+    sourceOccurrences,
+    status: "proposed",
+    proposedAt: Date.now(),
+    decidedAt: null
+  };
+  list.push(proposal);
+  persist();
+  logger.info({ id: proposal.id, ruleId: rule.id }, "policy-proposals: staged HOLD-only proposal");
+  return proposal;
+}
+function getProposals(status) {
+  const list = load();
+  return status ? list.filter((p) => p.status === status) : [...list];
+}
+function getProposal(id) {
+  return load().find((p) => p.id === id) ?? null;
+}
+function markProposalDecided(id, status) {
+  const list = load();
+  const p = list.find((x) => x.id === id);
+  if (!p || p.status !== "proposed") return null;
+  p.status = status;
+  p.decidedAt = Date.now();
+  persist();
+  logger.info({ id, status }, "policy-proposals: proposal decided");
+  return p;
+}
+function _resetProposalsForTesting() {
+  _proposals = null;
+  try {
+    fs.unlinkSync(PROPOSALS_FILE);
+  } catch {
+  }
+}
+export {
+  _resetProposalsForTesting,
+  getProposal,
+  getProposals,
+  markProposalDecided,
+  stageProposal
+};

package/dist/intelligence/policy-suggester.js

@@ -0,0 +1,161 @@
+import { getStores } from "../storage/store-registry.js";
+import { loadEnterprisePolicy } from "./enterprise-policy-engine.js";
+import { synthesizeRulesFromCorpus } from "./corpus-to-policy.js";
+import logger from "../sensor/logger.js";
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+const MIN_CLUSTER_SIZE = 5;
+function commandPrefix(cmd) {
+  if (!cmd) return "(unknown)";
+  return cmd.trim().split(/\s+/).slice(0, 3).join(" ");
+}
+function isCoveredByPolicy(prefix) {
+  const policy = loadEnterprisePolicy();
+  const lowerPrefix = prefix.toLowerCase();
+  for (const rule of policy.rules) {
+    const cmds = rule.conditions.commands ?? [];
+    if (cmds.some((c) => lowerPrefix.includes(c.toLowerCase()) || c.toLowerCase().includes(lowerPrefix.split(" ")[0]))) {
+      return true;
+    }
+  }
+  return false;
+}
+async function computePolicySuggestions() {
+  const now = Date.now();
+  const cutoff = now - THIRTY_DAYS_MS;
+  const recent = (await getStores().blunders.list()).filter((b) => b.recordedAt >= cutoff);
+  const clusters = /* @__PURE__ */ new Map();
+  for (const b of recent) {
+    const prefix = commandPrefix(b.command);
+    const entry = clusters.get(prefix) ?? { count: 0, lastSeenAt: 0, services: /* @__PURE__ */ new Set() };
+    entry.count++;
+    entry.lastSeenAt = Math.max(entry.lastSeenAt, b.recordedAt);
+    if (b.service) entry.services.add(b.service);
+    clusters.set(prefix, entry);
+  }
+  const suggestions = [];
+  for (const [prefix, data] of clusters) {
+    if (data.count < MIN_CLUSTER_SIZE) continue;
+    if (prefix === "(unknown)") continue;
+    const alreadyCovered = isCoveredByPolicy(prefix);
+    const slug = prefix.replace(/[^a-z0-9]+/gi, "_").toLowerCase().slice(0, 40);
+    suggestions.push({
+      commandPrefix: prefix,
+      occurrences: data.count,
+      lastSeenAt: data.lastSeenAt,
+      services: [...data.services],
+      alreadyCovered,
+      suggestedRule: {
+        id: `auto_suggest_${slug}`,
+        name: `Block: ${prefix}`,
+        action: "block",
+        reason: `Auto-suggested: this command pattern was blocked ${data.count} times in the last 30 days.`,
+        conditions: { commands: [prefix.split(" ")[0]] }
+      }
+    });
+  }
+  const corpusSynthesized = synthesizeRulesFromCorpus();
+  for (const { rule, sourceOccurrences, compactedRule } of corpusSynthesized) {
+    suggestions.push({
+      commandPrefix: compactedRule.incidentTag,
+      occurrences: sourceOccurrences,
+      lastSeenAt: compactedRule.compactedAt,
+      services: compactedRule.service !== "unknown" ? [compactedRule.service] : [],
+      alreadyCovered: false,
+      // synthesizeRulesFromCorpus already filters covered ones
+      source: "corpus",
+      suggestedRule: {
+        id: rule.id,
+        name: rule.name,
+        // Corpus-synthesized rules are only ever 'warn' or 'block' (never 'pass');
+        // narrow away 'pass' to satisfy the suggestion type.
+        action: rule.action,
+        reason: rule.reason,
+        conditions: rule.conditions
+      }
+    });
+  }
+  return suggestions.sort((a, b) => b.occurrences - a.occurrences);
+}
+async function postSuggestionsToSlack(suggestions) {
+  const token = process.env.MERGEN_SLACK_BOT_TOKEN;
+  const channel = process.env.MERGEN_SLACK_DIGEST_CHANNEL ?? process.env.MERGEN_SLACK_CHANNEL;
+  if (!token || !channel) return;
+  const uncovered = suggestions.filter((s) => !s.alreadyCovered);
+  if (uncovered.length === 0) return;
+  const lines = uncovered.slice(0, 5).map(
+    (s) => `\u2022 \`${s.commandPrefix}\` \u2014 blocked *${s.occurrences}\xD7* in 30 days (services: ${s.services.join(", ") || "unknown"})`
+  );
+  const payload = {
+    channel,
+    text: `\u{1F4CB} Mergen Policy Suggestions \u2014 ${uncovered.length} uncovered pattern${uncovered.length !== 1 ? "s" : ""}`,
+    blocks: [
+      {
+        type: "header",
+        text: { type: "plain_text", text: "\u{1F4CB} Mergen Policy Suggestions", emoji: true }
+      },
+      {
+        type: "section",
+        text: {
+          type: "mrkdwn",
+          text: `*${uncovered.length}* command pattern${uncovered.length !== 1 ? "s" : ""} have been blocked repeatedly but have no named policy rule. Consider formalising them:
+
+${lines.join("\n")}`
+        }
+      },
+      {
+        type: "section",
+        text: {
+          type: "mrkdwn",
+          text: `View all suggestions and generated rule JSON: \`GET /policy-suggestions\`
+Add a rule: \`POST /policies/rules\``
+        }
+      }
+    ]
+  };
+  try {
+    await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      headers: { "Content-Type": "application/json; charset=utf-8", Authorization: `Bearer ${token}` },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(8e3)
+    });
+  } catch (err) {
+    logger.warn({ err }, "policy-suggester: Slack post failed");
+  }
+}
+function msUntilNextMonday0900Utc() {
+  const now = /* @__PURE__ */ new Date();
+  const day = now.getUTCDay();
+  const daysUntilMonday = day === 1 ? 7 : (8 - day) % 7 || 7;
+  const next = new Date(Date.UTC(
+    now.getUTCFullYear(),
+    now.getUTCMonth(),
+    now.getUTCDate() + daysUntilMonday,
+    9,
+    5,
+    0,
+    0
+  ));
+  return Math.max(next.getTime() - Date.now(), 0);
+}
+function scheduleNext() {
+  const delay = msUntilNextMonday0900Utc();
+  setTimeout(async () => {
+    const suggestions = await computePolicySuggestions();
+    void postSuggestionsToSlack(suggestions);
+    scheduleNext();
+  }, delay).unref();
+}
+function startPolicySuggesterCron() {
+  setTimeout(async () => {
+    const suggestions = await computePolicySuggestions();
+    if (suggestions.length > 0) {
+      logger.info({ count: suggestions.length }, "policy-suggester: startup scan complete");
+    }
+    scheduleNext();
+  }, 3e4).unref();
+}
+export {
+  computePolicySuggestions,
+  startPolicySuggesterCron
+};