renma 0.16.0 → 0.18.0

package/dist/static-support.js

@@ -0,0 +1,284 @@
+import path from "node:path";
+import { classifyRepositorySkillPath, logicalSkillDirectory, } from "./discovery.js";
+const SUPPORT_ROOTS = [
+    "references",
+    "scripts",
+    "assets",
+    "profiles",
+    "examples",
+];
+/** Parse exact, repository-local support references once for rules and graphs. */
+export function staticSupportReferences(document, skillDirectory, localCandidatePaths) {
+    const candidatesByBasename = new Map();
+    for (const candidate of localCandidatePaths) {
+        const basename = path.posix.basename(candidate);
+        const values = candidatesByBasename.get(basename) ?? [];
+        values.push(candidate);
+        candidatesByBasename.set(basename, values);
+    }
+    const references = [];
+    const seen = new Set();
+    for (let index = 0; index < document.lines.length; index += 1) {
+        const line = document.lines[index] ?? "";
+        const values = [];
+        const markdownLinks = markdownLinkDestinations(line);
+        values.push(...markdownLinks);
+        let unquotedLine = maskRawMatches(line, markdownLinks.map((link) => link.raw));
+        const quotedMatches = [];
+        for (const match of unquotedLine.matchAll(/([`'"])((?:\.\/)?(?:references|scripts|assets|profiles|examples)\/.*?)\1/g)) {
+            if (match[2]) {
+                values.push({ raw: match[0], value: match[2] });
+                quotedMatches.push(match[0]);
+            }
+        }
+        unquotedLine = maskRawMatches(unquotedLine, quotedMatches);
+        for (const match of unquotedLine.matchAll(/(?:^|[\s([])((?:\.\/)?(?:references|scripts|assets|profiles|examples)\/[^\s)`'"\],;]+)/g)) {
+            if (match[1])
+                values.push({ raw: match[0].trim(), value: match[1] });
+        }
+        for (const [basename, paths] of candidatesByBasename) {
+            if (paths.length !== 1 || !containsExactBasename(line, basename))
+                continue;
+            values.push({ raw: basename, value: paths[0] });
+        }
+        for (const value of values) {
+            const normalized = normalizeStaticSupportReference(value.value, skillDirectory);
+            if (!normalized)
+                continue;
+            const key = `${index + 1}:${normalized.targetPath}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            references.push({
+                sourcePath: document.artifact.path,
+                targetPath: normalized.targetPath,
+                relativePath: normalized.relativePath,
+                line: index + 1,
+                raw: value.raw,
+            });
+        }
+    }
+    return references.sort((left, right) => left.line - right.line ||
+        left.targetPath.localeCompare(right.targetPath) ||
+        left.raw.localeCompare(right.raw));
+}
+function maskRawMatches(line, matches) {
+    let masked = line;
+    for (const match of matches) {
+        masked = masked.replace(match, " ".repeat(match.length));
+    }
+    return masked;
+}
+export function buildStaticSupportDependencies(documents, entries, repositoryPaths) {
+    const documentsByPath = new Map(documents.map((document) => [document.artifact.path, document]));
+    const entriesByPath = new Map(entries.map((entry) => [entry.sourcePath, entry]));
+    const skillEntries = entries.filter((entry) => entry.kind === "skill");
+    const skillCounts = new Map();
+    for (const skill of skillEntries) {
+        const directory = logicalSkillDirectory(skill.sourcePath);
+        if (!directory)
+            continue;
+        skillCounts.set(directory, (skillCounts.get(directory) ?? 0) + 1);
+    }
+    const result = [];
+    for (const skill of skillEntries) {
+        const skillDirectory = logicalSkillDirectory(skill.sourcePath);
+        if (!skillDirectory)
+            continue;
+        if (skillCounts.get(skillDirectory) !== 1)
+            continue;
+        const localEntries = entries.filter((entry) => {
+            const classified = classifyRepositorySkillPath(entry.sourcePath);
+            return (classified?.kind === "support" &&
+                classified.skillDirectory === skillDirectory);
+        });
+        for (const local of localEntries) {
+            result.push({
+                from: skill.id,
+                to: local.id,
+                kind: "owns_local_resource",
+                sourcePath: skill.sourcePath,
+            });
+            if (local.ownership.source === "inherited") {
+                result.push({
+                    from: local.id,
+                    to: skill.id,
+                    kind: "inherits_owner",
+                    sourcePath: local.sourcePath,
+                });
+            }
+            if (local.kind === "script" || local.kind === "asset") {
+                result.push({
+                    from: local.id,
+                    to: skill.id,
+                    kind: "inherits_policy",
+                    sourcePath: local.sourcePath,
+                });
+            }
+        }
+        const candidatePaths = [...repositoryPaths].filter((candidate) => {
+            const classified = classifyRepositorySkillPath(candidate);
+            return (classified?.kind === "support" &&
+                classified.skillDirectory === skillDirectory);
+        });
+        const sources = [skill, ...localEntries]
+            .map((entry) => documentsByPath.get(entry.sourcePath))
+            .filter((document) => document !== undefined);
+        for (const source of sources) {
+            for (const reference of staticSupportReferences(source, skillDirectory, candidatePaths)) {
+                const target = entriesByPath.get(reference.targetPath);
+                if (!target ||
+                    target.id === entriesByPath.get(source.artifact.path)?.id)
+                    continue;
+                result.push({
+                    from: entriesByPath.get(source.artifact.path)?.id ?? skill.id,
+                    to: target.id,
+                    kind: "statically_references",
+                    sourcePath: source.artifact.path,
+                    evidence: {
+                        path: source.artifact.path,
+                        startLine: reference.line,
+                        endLine: reference.line,
+                        snippet: reference.raw,
+                    },
+                });
+            }
+        }
+    }
+    return dedupeDependencies(result);
+}
+function normalizeStaticSupportReference(value, skillDirectory) {
+    const cleaned = decodePath(stripUriSuffix(value.trim()))
+        .replace(/^<|>$/g, "")
+        .replace(/[),.;:]+$/, "")
+        .replace(/^\.\//, "");
+    if (!cleaned || path.posix.isAbsolute(cleaned))
+        return undefined;
+    if (cleaned.split("/").includes(".."))
+        return undefined;
+    const repositoryRelative = cleaned.startsWith(`${skillDirectory}/`)
+        ? cleaned
+        : path.posix.join(skillDirectory, cleaned);
+    const normalized = path.posix.normalize(repositoryRelative);
+    const relativePath = path.posix.relative(skillDirectory, normalized);
+    if (relativePath.startsWith("../") ||
+        relativePath === ".." ||
+        !SUPPORT_ROOTS.includes(relativePath.split("/")[0]) ||
+        relativePath.endsWith("/")) {
+        return undefined;
+    }
+    return { targetPath: normalized, relativePath };
+}
+function markdownLinkDestinations(line) {
+    const destinations = [];
+    let searchFrom = 0;
+    while (searchFrom < line.length) {
+        const opener = line.indexOf("](", searchFrom);
+        if (opener < 0)
+            break;
+        const rawStart = line.lastIndexOf("[", opener);
+        let cursor = opener + 2;
+        while (/\s/.test(line[cursor] ?? ""))
+            cursor += 1;
+        const destinationStart = cursor;
+        let destination = "";
+        if (line[cursor] === "<") {
+            cursor += 1;
+            const valueStart = cursor;
+            while (cursor < line.length && line[cursor] !== ">")
+                cursor += 1;
+            if (line[cursor] === ">") {
+                destination = line.slice(valueStart, cursor);
+                cursor += 1;
+            }
+        }
+        else {
+            let nestedParentheses = 0;
+            while (cursor < line.length) {
+                const character = line[cursor] ?? "";
+                if (character === "\\" && cursor + 1 < line.length) {
+                    cursor += 2;
+                    continue;
+                }
+                if (character === "(") {
+                    nestedParentheses += 1;
+                }
+                else if (character === ")") {
+                    if (nestedParentheses === 0)
+                        break;
+                    nestedParentheses -= 1;
+                }
+                else if (/\s/.test(character) && nestedParentheses === 0) {
+                    break;
+                }
+                cursor += 1;
+            }
+            destination = line.slice(destinationStart, cursor);
+        }
+        let outerClose = cursor;
+        let titleParentheses = 0;
+        let quote;
+        while (outerClose < line.length) {
+            const character = line[outerClose] ?? "";
+            if (character === "\\") {
+                outerClose += 2;
+                continue;
+            }
+            if (quote) {
+                if (character === quote)
+                    quote = undefined;
+            }
+            else if (character === '"' || character === "'") {
+                quote = character;
+            }
+            else if (character === "(") {
+                titleParentheses += 1;
+            }
+            else if (character === ")") {
+                if (titleParentheses === 0)
+                    break;
+                titleParentheses -= 1;
+            }
+            outerClose += 1;
+        }
+        if (destination && outerClose < line.length) {
+            destinations.push({
+                raw: line.slice(rawStart >= 0 ? rawStart : opener, outerClose + 1),
+                value: destination,
+            });
+        }
+        searchFrom = Math.max(outerClose + 1, opener + 2);
+    }
+    return destinations;
+}
+function stripUriSuffix(value) {
+    const query = value.indexOf("?");
+    const fragment = value.indexOf("#");
+    const boundary = [query, fragment]
+        .filter((index) => index >= 0)
+        .sort((left, right) => left - right)[0];
+    return boundary === undefined ? value : value.slice(0, boundary);
+}
+function containsExactBasename(content, basename) {
+    const escaped = basename.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?:^|[\\s\`'"()\\[\\]{},;:])${escaped}(?=$|[\\s\`'"()\\[\\]{},;:?!]|\\.(?=\\s|$))`, "m").test(content);
+}
+function decodePath(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function dedupeDependencies(dependencies) {
+    const seen = new Set();
+    return dependencies.filter((dependency) => {
+        const key = `${dependency.from}\0${dependency.kind}\0${dependency.to}\0${dependency.sourcePath}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=static-support.js.map

package/dist/static-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-support.js","sourceRoot":"","sources":["../src/static-support.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,aAAa,GAAG;IACpB,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,UAAU;CACF,CAAC;AAUX,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CACrC,QAAwB,EACxB,cAAsB,EACtB,mBAAsC;IAEtC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAA0C,EAAE,CAAC;QAEzD,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAC9B,IAAI,YAAY,GAAG,cAAc,CAC/B,IAAI,EACJ,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACtC,CAAC;QACF,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CACvC,2EAA2E,CAC5E,EAAE,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChD,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,YAAY,GAAG,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CACvC,yFAAyF,CAC1F,EAAE,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC9D,SAAS;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,+BAA+B,CAChD,KAAK,CAAC,KAAK,EACX,cAAc,CACf,CAAC;YACF,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,UAAU,CAAC,IAAI,CAAC;gBACd,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;QACtB,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAiB;IACrD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAA2B,EAC3B,OAAuB,EACvB,eAAoC;IAEpC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAClD,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjE,OAAO,CACL,UAAU,EAAE,IAAI,KAAK,SAAS;gBAC9B,UAAU,CAAC,cAAc,KAAK,cAAc,CAC7C,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,EAAE;gBACd,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK,CAAC,EAAE;oBACd,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK,CAAC,EAAE;oBACd,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YAC/D,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;YAC1D,OAAO,CACL,UAAU,EAAE,IAAI,KAAK,SAAS;gBAC9B,UAAU,CAAC,cAAc,KAAK,cAAc,CAC7C,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,YAAY,CAAC;aACrC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;aACrD,MAAM,CAAC,CAAC,QAAQ,EAA8B,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,SAAS,IAAI,uBAAuB,CAC7C,MAAM,EACN,cAAc,EACd,cAAc,CACf,EAAE,CAAC;gBACF,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACvD,IACE,CAAC,MAAM;oBACP,MAAM,CAAC,EAAE,KAAK,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE;oBAEzD,SAAS;gBACX,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE;oBAC7D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;oBAChC,QAAQ,EAAE;wBACR,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;wBAC1B,SAAS,EAAE,SAAS,CAAC,IAAI;wBACzB,OAAO,EAAE,SAAS,CAAC,IAAI;wBACvB,OAAO,EAAE,SAAS,CAAC,GAAG;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAa,EACb,cAAsB;IAEtB,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;SACrD,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC;QACjE,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACrE,IACE,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9B,YAAY,KAAK,IAAI;QACrB,CAAC,aAAa,CAAC,QAAQ,CACrB,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAmC,CAC7D;QACD,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY;IAEZ,MAAM,YAAY,GAA0C,EAAE,CAAC;IAC/D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC;QAChC,IAAI,WAAW,GAAG,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,CAAC;YAC1B,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,MAAM,IAAI,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,GAAG,CAAC,CAAC;YAC1B,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,IAAI,CAAC,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;oBACtB,iBAAiB,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;oBAC7B,IAAI,iBAAiB,KAAK,CAAC;wBAAE,MAAM;oBACnC,iBAAiB,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;oBAC3D,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,UAAU,GAAG,MAAM,CAAC;QACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,KAAyB,CAAC;QAC9B,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,SAAS,KAAK,KAAK;oBAAE,KAAK,GAAG,SAAS,CAAC;YAC7C,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAClD,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC7B,gBAAgB,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,gBAAgB,KAAK,CAAC;oBAAE,MAAM;gBAClC,gBAAgB,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,WAAW,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,YAAY,CAAC,IAAI,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC;gBAClE,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;QACL,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;SAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,QAAgB;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,IAAI,MAAM,CACf,+BAA+B,OAAO,6CAA6C,EACnF,GAAG,CACJ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA0B;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;QACjG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/token-estimator.d.ts

@@ -0,0 +1,21 @@
+/** A deterministic, model-neutral token estimate unit. */
+export interface EstimatedTokenUnit {
+    value: string;
+    offset: number;
+}
+/**
+ * Estimate tokens without claiming compatibility with a model tokenizer.
+ *
+ * Latin-like words, code identifiers, URLs, and repository paths are lexical
+ * units. Consecutive Han, Hiragana, Katakana, and Hangul text is divided into
+ * two-code-point units so unspaced Japanese is neither one token nor one token
+ * per character. Other punctuation is grouped in runs of up to three code
+ * points. The algorithm is Unicode-aware, dependency-free, and deterministic,
+ * but is only suitable for stable repository thresholds and comparisons.
+ */
+export declare function estimateTokens(value: string): number;
+/** Return the deterministic units used by estimateTokens. */
+export declare function estimatedTokenUnits(value: string): EstimatedTokenUnit[];
+/** Return Markdown after a complete leading YAML frontmatter block. */
+export declare function markdownBody(value: string): string;
+//# sourceMappingURL=token-estimator.d.ts.map

package/dist/token-estimator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-estimator.d.ts","sourceRoot":"","sources":["../src/token-estimator.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAiEvE;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD"}

package/dist/token-estimator.js

@@ -0,0 +1,84 @@
+const CJK_RUN = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u;
+const WORD_RUN = /[\p{L}\p{N}_]/u;
+const WORD_CONTINUATION = /[\p{L}\p{N}_./:+\-=]/u;
+/**
+ * Estimate tokens without claiming compatibility with a model tokenizer.
+ *
+ * Latin-like words, code identifiers, URLs, and repository paths are lexical
+ * units. Consecutive Han, Hiragana, Katakana, and Hangul text is divided into
+ * two-code-point units so unspaced Japanese is neither one token nor one token
+ * per character. Other punctuation is grouped in runs of up to three code
+ * points. The algorithm is Unicode-aware, dependency-free, and deterministic,
+ * but is only suitable for stable repository thresholds and comparisons.
+ */
+export function estimateTokens(value) {
+    return estimatedTokenUnits(value).length;
+}
+/** Return the deterministic units used by estimateTokens. */
+export function estimatedTokenUnits(value) {
+    const codePoints = [...value];
+    const offsets = [];
+    let utf16Offset = 0;
+    for (const codePoint of codePoints) {
+        offsets.push(utf16Offset);
+        utf16Offset += codePoint.length;
+    }
+    const units = [];
+    let index = 0;
+    while (index < codePoints.length) {
+        const current = codePoints[index] ?? "";
+        if (/\s/u.test(current)) {
+            index += 1;
+            continue;
+        }
+        if (CJK_RUN.test(current)) {
+            const start = index;
+            index += 1;
+            if (index < codePoints.length && CJK_RUN.test(codePoints[index] ?? "")) {
+                index += 1;
+            }
+            units.push({
+                value: codePoints.slice(start, index).join("").toLowerCase(),
+                offset: offsets[start] ?? 0,
+            });
+            continue;
+        }
+        if (WORD_RUN.test(current)) {
+            const start = index;
+            index += 1;
+            while (index < codePoints.length &&
+                WORD_CONTINUATION.test(codePoints[index] ?? "") &&
+                !CJK_RUN.test(codePoints[index] ?? "")) {
+                index += 1;
+            }
+            units.push({
+                value: codePoints.slice(start, index).join("").toLowerCase(),
+                offset: offsets[start] ?? 0,
+            });
+            continue;
+        }
+        const start = index;
+        index += 1;
+        while (index < codePoints.length &&
+            index - start < 3 &&
+            !/\s/u.test(codePoints[index] ?? "") &&
+            !WORD_RUN.test(codePoints[index] ?? "") &&
+            !CJK_RUN.test(codePoints[index] ?? "")) {
+            index += 1;
+        }
+        units.push({
+            value: codePoints.slice(start, index).join(""),
+            offset: offsets[start] ?? 0,
+        });
+    }
+    return units;
+}
+/** Return Markdown after a complete leading YAML frontmatter block. */
+export function markdownBody(value) {
+    const lines = value.split(/\r?\n/);
+    if (lines[0]?.trim() !== "---")
+        return value;
+    const end = lines.findIndex((line, index) => index > 0 && line.trim() === "---");
+    return end < 0 ? value : lines.slice(end + 1).join("\n");
+}
+//# sourceMappingURL=token-estimator.js.map

package/dist/token-estimator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-estimator.js","sourceRoot":"","sources":["../src/token-estimator.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,GACX,0EAA0E,CAAC;AAC7E,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvE,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC5D,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,OACE,KAAK,GAAG,UAAU,CAAC,MAAM;gBACzB,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC/C,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EACtC,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC5D,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,CAAC;QACX,OACE,KAAK,GAAG,UAAU,CAAC,MAAM;YACzB,KAAK,GAAG,KAAK,GAAG,CAAC;YACjB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EACtC,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CACzB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CACpD,CAAC;IACF,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/dist/trust-graph.d.ts

@@ -1,9 +1,9 @@
-import type { Catalog } from "./model.js";
+import { type Catalog } from "./model.js";
 import type { SecurityPolicyAssetEvidence } from "./security-policy-inventory.js";
 import type { Diagnostic, Evidence, Finding, RiskClass } from "./types.js";
-export type TrustGraphSchemaVersion = "renma.trustGraph.v1";
+export type TrustGraphSchemaVersion = "renma.trustGraph.v2";
 export type TrustGraphNodeType = "asset" | "owner" | "lifecycle_status" | "security_profile" | "effective_policy" | "diagnostic";
-export type TrustGraphEdgeType = "owned_by" | "has_lifecycle_status" | "declares_dependency" | "references" | "selects_security_profile" | "inherits_policy" | "has_effective_policy" | "has_diagnostic";
+export type TrustGraphEdgeType = "owned_by" | "has_lifecycle_status" | "declares_dependency" | "references" | "owns_local_resource" | "statically_references" | "inherits_owner" | "selects_security_profile" | "inherits_policy" | "has_effective_policy" | "has_diagnostic";
 export type TrustGraphFindingSource = "finding" | "diagnostic";
 export type TrustGraphFindingSeverity = Finding["severity"] | Diagnostic["severity"];
 export interface TrustGraphSummary {

package/dist/trust-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-graph.d.ts","sourceRoot":"","sources":["../src/trust-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,OAAO,EAAc,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,OAAO,GACP,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,YAAY,CAAC;AAEjB,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,sBAAsB,GACtB,qBAAqB,GACrB,YAAY,GACZ,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,YAAY,CAAC;AAC/D,MAAM,MAAM,yBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,GACnB,UAAU,CAAC,UAAU,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;IACjE,eAAe,EAAE,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,uBAAuB,CAAC;IACvC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAClD;AAuCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA0FlE"}
+{"version":3,"file":"trust-graph.d.ts","sourceRoot":"","sources":["../src/trust-graph.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,OAAO,GACP,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,YAAY,CAAC;AAEjB,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,sBAAsB,GACtB,qBAAqB,GACrB,YAAY,GACZ,qBAAqB,GACrB,uBAAuB,GACvB,gBAAgB,GAChB,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,YAAY,CAAC;AAC/D,MAAM,MAAM,yBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,GACnB,UAAU,CAAC,UAAU,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;IACjE,eAAe,EAAE,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,uBAAuB,CAAC;IACvC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAClD;AA0CD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA0IlE"}

package/dist/trust-graph.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { normalizeDependencyReference, resolveDependencyTarget, } from "./dependency-resolution.js";
+import { effectiveAssetOwner, } from "./model.js";
 const NODE_TYPES = [
     "asset",
     "owner",
@@ -12,6 +14,9 @@ const EDGE_TYPES = [
     "has_lifecycle_status",
     "declares_dependency",
     "references",
+    "owns_local_resource",
+    "statically_references",
+    "inherits_owner",
     "selects_security_profile",
     "inherits_policy",
     "has_effective_policy",
@@ -37,17 +42,33 @@ export function buildTrustGraph(input) {
     const edges = new Map();
     const assets = stableAssets(input.catalog.assets);
     const assetsById = new Map(assets.map((asset) => [asset.id, asset]));
-    const assetsByPath = new Map(assets.map((asset) => [normalizeReference(asset.sourcePath), asset]));
+    const assetsByPath = new Map(assets.map((asset) => [
+        normalizeDependencyReference(asset.sourcePath),
+        asset,
+    ]));
     for (const asset of assets) {
         addNode(nodes, assetNode(asset));
-        if (asset.metadata.owner) {
-            const ownerNodeId = ownerNode(asset.metadata.owner).id;
-            addNode(nodes, ownerNode(asset.metadata.owner));
+        const owner = effectiveAssetOwner(asset);
+        if (owner) {
+            const ownerNodeId = ownerNode(owner).id;
+            addNode(nodes, ownerNode(owner));
+            const inheritedOwnerAsset = asset.ownership.source === "inherited" && asset.ownership.inheritedFrom
+                ? assetsByPath.get(normalizeDependencyReference(asset.ownership.inheritedFrom.sourcePath))
+                : undefined;
             addEdge(edges, {
                 from: assetNodeId(asset),
                 to: ownerNodeId,
                 type: "owned_by",
-                evidence: metadataEvidence(asset, "owner"),
+                properties: {
+                    ownershipSource: asset.ownership.source,
+                    ...(asset.ownership.source === "inherited" &&
+                        asset.ownership.inheritedFrom
+                        ? { inheritedFrom: asset.ownership.inheritedFrom }
+                        : {}),
+                },
+                evidence: inheritedOwnerAsset
+                    ? metadataEvidence(inheritedOwnerAsset, "owner")
+                    : metadataEvidence(asset, "owner"),
             });
         }
         if (asset.metadata.status) {
@@ -69,26 +90,46 @@ export function buildTrustGraph(input) {
         addEdge(edges, {
             from: assetNodeId(source),
             to: assetNodeId(target),
-            type: dependency.kind === "references" ? "references" : "declares_dependency",
+            type: trustEdgeTypeForDependency(dependency),
             properties: {
                 dependencyKind: dependency.kind,
                 declaredTarget: dependency.to,
+                ...(dependency.kind === "inherits_owner" ||
+                    dependency.kind === "inherits_policy"
+                    ? {
+                        inheritedFrom: {
+                            id: target.id,
+                            sourcePath: target.sourcePath,
+                        },
+                    }
+                    : {}),
             },
             evidence: dependency.evidence ? [dependency.evidence] : [],
         });
     }
     for (const policy of input.securityPolicies ?? []) {
-        const asset = assetsByPath.get(normalizeReference(policy.path));
+        const asset = assetsByPath.get(normalizeDependencyReference(policy.path));
         if (!asset)
             continue;
-        addPolicyEvidence(nodes, edges, asset, policy);
+        const inheritedAsset = policy.inheritedFrom
+            ? assetsByPath.get(normalizeDependencyReference(policy.inheritedFrom.sourcePath))
+            : undefined;
+        addPolicyEvidence(nodes, edges, asset, inheritedAsset
+            ? {
+                ...policy,
+                inheritedFrom: {
+                    id: inheritedAsset.id,
+                    sourcePath: inheritedAsset.sourcePath,
+                },
+            }
+            : policy);
     }
     const findings = stableTrustGraphFindings((input.findings ?? []).map(findingToTrustGraphFinding), (input.diagnostics ?? []).map(diagnosticToTrustGraphFinding));
     for (const finding of findings) {
         const diagnostic = diagnosticNode(finding);
         addNode(nodes, diagnostic);
         const asset = finding.path
-            ? assetsByPath.get(normalizeReference(finding.path))
+            ? assetsByPath.get(normalizeDependencyReference(finding.path))
             : undefined;
         if (asset) {
             addEdge(edges, {
@@ -101,13 +142,25 @@ export function buildTrustGraph(input) {
     }
     const sortedNodes = [...nodes.values()].sort(compareNodes);
     const sortedEdges = [...edges.values()].sort(compareEdges);
-    return {
-        schemaVersion: "renma.trustGraph.v1",
+    const graph = {
+        schemaVersion: "renma.trustGraph.v2",
         summary: summarizeTrustGraph(assets.length, sortedNodes, sortedEdges, findings),
         nodes: sortedNodes,
         edges: sortedEdges,
         findings,
     };
+    return graph;
+}
+function trustEdgeTypeForDependency(dependency) {
+    if (dependency.kind === "references")
+        return "references";
+    if (dependency.kind === "owns_local_resource" ||
+        dependency.kind === "statically_references" ||
+        dependency.kind === "inherits_owner" ||
+        dependency.kind === "inherits_policy") {
+        return dependency.kind;
+    }
+    return "declares_dependency";
 }
 function addPolicyEvidence(nodes, edges, asset, policy) {
     if (policy.selectedSecurityProfile) {
@@ -126,6 +179,11 @@ function addPolicyEvidence(nodes, edges, asset, policy) {
                 : [],
         });
     }
+    if (!policy.hasEffectivePolicy)
+        return;
+    if (policy.policySources.length === 0) {
+        throw new Error(`Effective security policy for ${policy.path} has no provenance source.`);
+    }
     for (let index = 1; index < policy.profileChain.length; index += 1) {
         const childProfile = policy.profileChain[index];
         const parentProfile = policy.profileChain[index - 1];
@@ -149,6 +207,8 @@ function addPolicyEvidence(nodes, edges, asset, policy) {
         type: "has_effective_policy",
         properties: {
             hasLocalPolicyMetadata: policy.hasLocalPolicyMetadata,
+            policySources: policy.policySources,
+            ...(policy.inheritedFrom ? { inheritedFrom: policy.inheritedFrom } : {}),
         },
         evidence: policy.evidence.policyFields,
     });
@@ -163,8 +223,11 @@ function assetNode(asset) {
             kind: asset.kind,
             sourcePath: asset.sourcePath,
             contentHash: asset.contentHash,
+            sizeBytes: asset.sizeBytes,
+            contentClassification: asset.contentClassification,
+            markdownParserEligible: asset.markdownParserEligible,
             tags: asset.metadata.tags,
-            ...(asset.metadata.owner ? { owner: asset.metadata.owner } : {}),
+            ownership: asset.ownership,
             ...(asset.metadata.status ? { status: asset.metadata.status } : {}),
         },
         evidence: [
@@ -237,7 +300,7 @@ function diagnosticNode(finding) {
     };
 }
 function assetNodeId(asset) {
-    // Trust Graph v1 keeps asset IDs logical. Duplicate-id diagnostics preserve
+    // Trust Graph keeps asset IDs logical. Duplicate-id diagnostics preserve
     // per-source evidence when multiple catalog assets share the same id.
     return `asset:${asset.id}`;
 }
@@ -383,14 +446,6 @@ function summarizeTrustGraph(assetCount, nodes, edges, findings) {
 function zeroCounts(values) {
     return Object.fromEntries(values.map((value) => [value, 0]));
 }
-function resolveDependencyTarget(dependency, assets) {
-    const target = normalizeReference(dependency.to);
-    return assets.find((asset) => asset.id === dependency.to ||
-        normalizeReference(asset.sourcePath) === target);
-}
-function normalizeReference(reference) {
-    return reference.replace(/\\/g, "/").replace(/^\.\//, "");
-}
 function stableAssets(assets) {
     return [...assets].sort((left, right) => {
         const byKind = left.kind.localeCompare(right.kind);