@avi770/testteam 3.0.0 → 3.2.0

package/dist/bridge/api-contract-reader.d.ts

@@ -0,0 +1,55 @@
+/**
+ * API-contract posture reader (dashboard S5 — The Border Guard).
+ *
+ * The API Contract Validator (agent #11, core/api-contract) is a COMPOSITE
+ * results-processor: its rich static capabilities (breaking-change spec diff,
+ * Pact consumer verification, blast-radius, mock generation, migration guide)
+ * require OpenAPI specs + consumer contracts the bridge does not have — those
+ * are a CLI/active-scan concern (like the Sentinel's active scan, D-UI-6). Its
+ * RUNTIME-monitoring seam is `engineFindings`: the verbatim Finding[] from the
+ * engine "api" squad (#39 contract, #41 pagination, #42 GraphQL).
+ *
+ * Decision D-UI-8: mirroring S3/S4, this derives an api-contract posture from
+ * the data the bridge HAS — the latest run's api-squad findings — grouped per
+ * agent with a severity rollup and a blocking-conformance flag. Findings are
+ * normalised at the trust boundary (S3 never-throw lesson). `enrichment`
+ * discloses that the spec-diff features are not part of a run-derived view.
+ */
+import type { FindingSeverity } from '../core/types.js';
+export interface ApiAgentSummary {
+    readonly agentId: number;
+    readonly agentName: string;
+    readonly findingCount: number;
+    readonly bySeverity: Record<FindingSeverity, number>;
+}
+export interface ApiContractFindingView {
+    readonly id: string;
+    readonly agentId: number;
+    readonly severity: FindingSeverity;
+    readonly module: string;
+    readonly description: string;
+}
+export interface ApiContractSnapshot {
+    readonly sourceRunId: string | null;
+    readonly scannedAt: string | null;
+    /** Per-agent rollup for the api squad (#39/#41/#42), only agents present in the run. */
+    readonly perAgent: readonly ApiAgentSummary[];
+    /** Top api-contract findings, highest-severity first (capped). */
+    readonly findings: readonly ApiContractFindingView[];
+    readonly totalFindings: number;
+    readonly bySeverity: Record<FindingSeverity, number>;
+    /** Count of critical+high findings (release-blocking contract regressions). */
+    readonly blockingFindings: number;
+    /** True when no blocking (critical/high) api-contract finding is present. */
+    readonly conformant: boolean;
+    /**
+     * 'run-derived' — from the latest run's api-squad findings. The spec-diff
+     * features (breaking-change/Pact/blast-radius/mocks) need configured OpenAPI
+     * specs and are NOT part of this view.
+     */
+    readonly enrichment: 'run-derived';
+}
+/** Build the api-contract snapshot from the newest recorded run under `runsDir`.
+ *  Returns an empty snapshot when no run exists or the detail is unreadable; never throws. */
+export declare function buildApiContractSnapshot(runsDir: string): ApiContractSnapshot;
+//# sourceMappingURL=api-contract-reader.d.ts.map

package/dist/bridge/api-contract-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contract-reader.d.ts","sourceRoot":"","sources":["../../bridge/api-contract-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAW,eAAe,EAAe,MAAM,eAAe,CAAC;AAmB3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAC9C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACrD,+EAA+E;IAC/E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAgBD;8FAC8F;AAC9F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAyD7E"}

package/dist/bridge/api-contract-reader.js

@@ -0,0 +1,103 @@
+/**
+ * API-contract posture reader (dashboard S5 — The Border Guard).
+ *
+ * The API Contract Validator (agent #11, core/api-contract) is a COMPOSITE
+ * results-processor: its rich static capabilities (breaking-change spec diff,
+ * Pact consumer verification, blast-radius, mock generation, migration guide)
+ * require OpenAPI specs + consumer contracts the bridge does not have — those
+ * are a CLI/active-scan concern (like the Sentinel's active scan, D-UI-6). Its
+ * RUNTIME-monitoring seam is `engineFindings`: the verbatim Finding[] from the
+ * engine "api" squad (#39 contract, #41 pagination, #42 GraphQL).
+ *
+ * Decision D-UI-8: mirroring S3/S4, this derives an api-contract posture from
+ * the data the bridge HAS — the latest run's api-squad findings — grouped per
+ * agent with a severity rollup and a blocking-conformance flag. Findings are
+ * normalised at the trust boundary (S3 never-throw lesson). `enrichment`
+ * discloses that the spec-diff features are not part of a run-derived view.
+ */
+import { listRuns, readRun } from './runs-reader.js';
+import { normalizeFinding } from './finding-normalize.js';
+import { COMPOSED_ENGINE_AGENTS } from '../core/api-contract/types.js';
+/** Engine "api" squad agent ids the Border Guard composes (39/41/42). */
+const API_AGENT_IDS = new Set(Object.values(COMPOSED_ENGINE_AGENTS));
+/** Severities that BLOCK a release (a contract regression the guard should stop). */
+const BLOCKING_SEVERITIES = new Set(['critical', 'high']);
+/** How many findings the dashboard lists (highest-severity first). */
+const TOP_FINDINGS_LIMIT = 20;
+const SEVERITY_RANK = {
+    critical: 4, high: 3, medium: 2, low: 1, info: 0,
+};
+function emptySeverityCounts() {
+    return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+}
+function emptySnapshot() {
+    return {
+        sourceRunId: null,
+        scannedAt: null,
+        perAgent: [],
+        findings: [],
+        totalFindings: 0,
+        bySeverity: emptySeverityCounts(),
+        blockingFindings: 0,
+        conformant: true,
+        enrichment: 'run-derived',
+    };
+}
+/** Build the api-contract snapshot from the newest recorded run under `runsDir`.
+ *  Returns an empty snapshot when no run exists or the detail is unreadable; never throws. */
+export function buildApiContractSnapshot(runsDir) {
+    const runs = listRuns(runsDir);
+    if (runs.length === 0)
+        return emptySnapshot();
+    const latest = runs[0];
+    if (!latest)
+        return emptySnapshot();
+    const detail = readRun(runsDir, latest.runId);
+    if (!detail)
+        return emptySnapshot();
+    const apiAgents = detail.agents.filter((a) => API_AGENT_IDS.has(a.agentId));
+    const perAgent = [];
+    const allFindings = [];
+    const bySeverity = emptySeverityCounts();
+    for (const a of apiAgents) {
+        const findings = (Array.isArray(a.findings) ? a.findings : [])
+            .map(normalizeFinding)
+            .filter((f) => f !== null);
+        const agentCounts = emptySeverityCounts();
+        for (const f of findings) {
+            agentCounts[f.severity]++;
+            bySeverity[f.severity]++;
+            allFindings.push({ agentId: a.agentId, finding: f });
+        }
+        perAgent.push({
+            agentId: a.agentId,
+            agentName: a.agentName,
+            findingCount: findings.length,
+            bySeverity: agentCounts,
+        });
+    }
+    const findings = allFindings
+        .sort((x, y) => SEVERITY_RANK[y.finding.severity] - SEVERITY_RANK[x.finding.severity])
+        .slice(0, TOP_FINDINGS_LIMIT)
+        .map(({ agentId, finding }) => ({
+        id: finding.id,
+        agentId,
+        severity: finding.severity,
+        module: finding.module,
+        description: finding.description,
+    }));
+    const blockingFindings = allFindings.filter((x) => BLOCKING_SEVERITIES.has(x.finding.severity)).length;
+    const totalFindings = allFindings.length;
+    return {
+        sourceRunId: latest.runId,
+        scannedAt: detail.summary.completedAt || null,
+        perAgent,
+        findings,
+        totalFindings,
+        bySeverity,
+        blockingFindings,
+        conformant: blockingFindings === 0,
+        enrichment: 'run-derived',
+    };
+}
+//# sourceMappingURL=api-contract-reader.js.map

package/dist/bridge/api-contract-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contract-reader.js","sourceRoot":"","sources":["../../bridge/api-contract-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,yEAAyE;AACzE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAE1F,qFAAqF;AACrF,MAAM,mBAAmB,GAAiC,IAAI,GAAG,CAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzG,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAoC;IACrD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAsCD,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,mBAAmB,EAAE;QACjC,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IAEpC,MAAM,SAAS,GAAkB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,GAAG,CAAC,gBAAgB,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,UAAU,EAAE,WAAW;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAA6B,WAAW;SACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SACrF,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;SAC5B,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC,CAAC;IAEN,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACvG,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC;IAEzC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI;QAC7C,QAAQ;QACR,QAAQ;QACR,aAAa;QACb,UAAU;QACV,gBAAgB;QAChB,UAAU,EAAE,gBAAgB,KAAK,CAAC;QAClC,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bridge/compliance-reader.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Compliance posture reader (dashboard S4 — The Inspector).
+ *
+ * The Compliance & Audit layer (agent #18, core/compliance) COMPOSES engine-agent
+ * findings (agents 65/66/67/84) into a continuous compliance posture — it never
+ * re-scans. Mirroring the S2/S3 readers, this derives a REAL posture from data the
+ * bridge has: the latest run's compliance-agent findings, fed through the
+ * ComplianceAuditor with its DEFAULT_CONTROLS.
+ *
+ * Decision D-UI-7: DriftAlerts are stateful (the auditor fires them only on a
+ * control's passing→failing transition BETWEEN evaluate() calls). To surface real
+ * drift, we evaluate the PREVIOUS run first, then the latest run, on the same
+ * auditor instance — so drift reflects prev-run → latest-run regressions. With a
+ * single run, drift is naturally empty. Posture is run-derived (`enrichment`),
+ * never a legal attestation (see the module's NOT-legal-advice disclaimer).
+ */
+import type { ControlEvaluation, ComplianceGap, DriftAlert, FrameworkSummary, ComplianceFramework } from '../core/compliance/index.js';
+export interface CompliancePostureSnapshot {
+    /** Run the posture was derived from, or null when no run has been recorded. */
+    readonly sourceRunId: string | null;
+    /** ISO evaluation time, or null when there is no run. */
+    readonly evaluatedAt: string | null;
+    /** Per-framework pass summaries (only frameworks with ≥1 control appear). */
+    readonly frameworkSummary: Readonly<Partial<Record<ComplianceFramework, FrameworkSummary>>>;
+    /** Per-control evaluated status. */
+    readonly controlEvaluations: readonly ControlEvaluation[];
+    /** Controls that cannot currently be demonstrated (no-evidence / failing / partial). */
+    readonly gaps: readonly ComplianceGap[];
+    /** Controls that regressed passing→failing between the previous and latest run. */
+    readonly driftAlerts: readonly DriftAlert[];
+    /** Total controls evaluated. */
+    readonly totalControls: number;
+    /** Controls currently passing. */
+    readonly passingControls: number;
+    /** Posture is derived from run findings, not a legal attestation. */
+    readonly enrichment: 'run-derived';
+}
+/**
+ * Build the compliance-posture snapshot from the newest recorded run under
+ * `runsDir`. Returns an empty snapshot when no run exists or the newest run's
+ * detail is unreadable. Never throws — a misshaped run artifact degrades to an
+ * empty/clean posture so the caller renders a state, not a 500.
+ *
+ * @param nowIso - injectable clock for deterministic tests; defaults to now.
+ */
+export declare function buildCompliancePostureSnapshot(runsDir: string, nowIso?: string): CompliancePostureSnapshot;
+//# sourceMappingURL=compliance-reader.d.ts.map

package/dist/bridge/compliance-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-reader.d.ts","sourceRoot":"","sources":["../../bridge/compliance-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EACV,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAsB5B,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5F,oCAAoC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,gCAAgC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAgBD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAiC,GACxC,yBAAyB,CAkC3B"}

package/dist/bridge/compliance-reader.js

@@ -0,0 +1,91 @@
+/**
+ * Compliance posture reader (dashboard S4 — The Inspector).
+ *
+ * The Compliance & Audit layer (agent #18, core/compliance) COMPOSES engine-agent
+ * findings (agents 65/66/67/84) into a continuous compliance posture — it never
+ * re-scans. Mirroring the S2/S3 readers, this derives a REAL posture from data the
+ * bridge has: the latest run's compliance-agent findings, fed through the
+ * ComplianceAuditor with its DEFAULT_CONTROLS.
+ *
+ * Decision D-UI-7: DriftAlerts are stateful (the auditor fires them only on a
+ * control's passing→failing transition BETWEEN evaluate() calls). To surface real
+ * drift, we evaluate the PREVIOUS run first, then the latest run, on the same
+ * auditor instance — so drift reflects prev-run → latest-run regressions. With a
+ * single run, drift is naturally empty. Posture is run-derived (`enrichment`),
+ * never a legal attestation (see the module's NOT-legal-advice disclaimer).
+ */
+import { listRuns, readRun } from './runs-reader.js';
+import { normalizeFinding } from './finding-normalize.js';
+import { ComplianceAuditor, DEFAULT_CONTROLS } from '../core/compliance/index.js';
+/** Engine-agent ids whose findings the compliance controls consume (kept in sync
+ *  with DEFAULT_CONTROLS so a control re-map never desyncs the reader). */
+const COMPLIANCE_AGENT_IDS = new Set(DEFAULT_CONTROLS.flatMap((c) => c.provedByAgentIds));
+/** Build the agent→findings batch the auditor consumes from a run's agents. */
+function batchFromRun(agents) {
+    const batch = {};
+    for (const a of agents) {
+        if (!COMPLIANCE_AGENT_IDS.has(a.agentId))
+            continue;
+        const findings = (Array.isArray(a.findings) ? a.findings : [])
+            .map(normalizeFinding)
+            .filter((f) => f !== null);
+        batch[a.agentId] = [...(batch[a.agentId] ?? []), ...findings];
+    }
+    return batch;
+}
+function emptySnapshot() {
+    return {
+        sourceRunId: null,
+        evaluatedAt: null,
+        frameworkSummary: {},
+        controlEvaluations: [],
+        gaps: [],
+        driftAlerts: [],
+        totalControls: 0,
+        passingControls: 0,
+        enrichment: 'run-derived',
+    };
+}
+/**
+ * Build the compliance-posture snapshot from the newest recorded run under
+ * `runsDir`. Returns an empty snapshot when no run exists or the newest run's
+ * detail is unreadable. Never throws — a misshaped run artifact degrades to an
+ * empty/clean posture so the caller renders a state, not a 500.
+ *
+ * @param nowIso - injectable clock for deterministic tests; defaults to now.
+ */
+export function buildCompliancePostureSnapshot(runsDir, nowIso = new Date().toISOString()) {
+    const runs = listRuns(runsDir);
+    if (runs.length === 0)
+        return emptySnapshot();
+    const latest = runs[0];
+    if (!latest)
+        return emptySnapshot();
+    const latestDetail = readRun(runsDir, latest.runId);
+    if (!latestDetail)
+        return emptySnapshot();
+    const auditor = new ComplianceAuditor({ clock: () => nowIso });
+    // Seed prior state from the previous run (if any) so the latest evaluate() can
+    // fire real passing→failing drift alerts (D-UI-7). The previous run's posture
+    // is discarded; only its status map matters for transition detection.
+    const previous = runs[1];
+    if (previous) {
+        const prevDetail = readRun(runsDir, previous.runId);
+        if (prevDetail)
+            auditor.evaluate(batchFromRun(prevDetail.agents));
+    }
+    const posture = auditor.evaluate(batchFromRun(latestDetail.agents));
+    const passingControls = posture.controlEvaluations.filter((e) => e.status === 'passing').length;
+    return {
+        sourceRunId: latest.runId,
+        evaluatedAt: posture.evaluatedAt,
+        frameworkSummary: posture.frameworkSummary,
+        controlEvaluations: posture.controlEvaluations,
+        gaps: posture.gaps,
+        driftAlerts: posture.driftAlerts,
+        totalControls: posture.controlEvaluations.length,
+        passingControls,
+        enrichment: 'run-derived',
+    };
+}
+//# sourceMappingURL=compliance-reader.js.map

package/dist/bridge/compliance-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-reader.js","sourceRoot":"","sources":["../../bridge/compliance-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAUzE;2EAC2E;AAC3E,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CACvD,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CACpD,CAAC;AAEF,+EAA+E;AAC/E,SAAS,YAAY,CAAC,MAA8B;IAClD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACnD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,GAAG,CAAC,gBAAgB,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAuBD,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,EAAE;QACpB,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAe,EACf,SAAiB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAEzC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,aAAa,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/D,+EAA+E;IAC/E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,UAAU;YAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEhG,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM;QAChD,eAAe;QACf,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bridge/data-integrity-reader.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Data-integrity posture reader (dashboard S8 — the Data-Integrity notary).
+ *
+ * The Data Integrity layer (core/data-integrity) composes four engine agents —
+ * #14 Data Integrity Auditor, #43 Data Consistency Checker, #44 Backup Recovery
+ * Tester, #45 Data Privacy Scanner — into a DataIntegrityReport via
+ * `DataIntegritySession` (the module's documented composition surface: engine
+ * findings are ingested verbatim; the session is the AGGREGATION layer). Its
+ * richer checks — ref-integrity, cross-store consistency, reconciliation,
+ * backup RPO/restore verification, distribution anomalies, lineage corruption
+ * tracing — all need LIVE inputs the bridge lacks (DB key sets, store values,
+ * authoritative numerics, backup-system state, row-level sampling, a pipeline
+ * DAG), exactly like S3's active scan / S5's spec diff / S7's churn signal.
+ *
+ * Decision D-UI-11: mirroring S3–S7, this derives a REAL data-integrity posture
+ * from the latest run's engine findings by ingesting them into a fresh
+ * `DataIntegritySession` and reading `buildReport()` — so the severity rollup
+ * (`IntegritySummary`, incl. `requiresEscalation`) is computed by the LAYER's
+ * own logic, not re-implemented here. Two session-instance fields are
+ * deliberately NOT surfaced: `auditChainIntact` and `readOnlyProof` are
+ * trivially clean for a fresh ingest-only session and would over-claim ("the
+ * run's integrity was verified") — session trivia, not run properties. The six
+ * live-check result lists are likewise omitted rather than shipped as
+ * always-empty fields implying checks that never ran. Findings are normalised
+ * at the trust boundary (shared `normalizeFinding`).
+ */
+import type { IntegritySummary } from '../core/data-integrity/index.js';
+import type { Finding } from '../core/types.js';
+/** Engine agents the data-integrity layer composes → the dimension they audit. */
+declare const INTEGRITY_AGENTS: readonly [{
+    readonly agentId: 14;
+    readonly dimension: "ref-integrity";
+}, {
+    readonly agentId: 43;
+    readonly dimension: "consistency";
+}, {
+    readonly agentId: 44;
+    readonly dimension: "backup";
+}, {
+    readonly agentId: 45;
+    readonly dimension: "privacy";
+}];
+type IntegrityDimension = (typeof INTEGRITY_AGENTS)[number]['dimension'];
+export interface IntegrityAgentSummary {
+    readonly agentId: number;
+    readonly agentName: string;
+    readonly dimension: IntegrityDimension;
+    readonly findingCount: number;
+}
+export interface DataIntegritySnapshot {
+    readonly sourceRunId: string | null;
+    readonly auditedAt: string | null;
+    /**
+     * The layer's own rollup (`IntegritySummary`): totalViolations + severity
+     * buckets + `requiresEscalation` (true when any critical/high is present).
+     */
+    readonly summary: IntegritySummary;
+    /** Engine findings (severity-ranked, capped) for the UI list. */
+    readonly findings: readonly Finding[];
+    readonly totalFindings: number;
+    /** Per-agent rollup, only agents present in the run. */
+    readonly perAgent: readonly IntegrityAgentSummary[];
+    /**
+     * 'run-derived' — engine findings ingested into the layer's own session.
+     * Live checks (ref-integrity, cross-store, reconciliation, backup
+     * verification, distribution, lineage tracing) need DB/pipeline access the
+     * bridge lacks and are NOT part of this view (D-UI-11).
+     */
+    readonly enrichment: 'run-derived';
+}
+/**
+ * Build the data-integrity snapshot from the newest recorded run under `runsDir`.
+ * Returns an empty snapshot when no run exists or the detail is unreadable; never throws.
+ */
+export declare function buildDataIntegritySnapshot(runsDir: string): DataIntegritySnapshot;
+export {};
+//# sourceMappingURL=data-integrity-reader.d.ts.map

package/dist/bridge/data-integrity-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-integrity-reader.d.ts","sourceRoot":"","sources":["../../bridge/data-integrity-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAe,MAAM,eAAe,CAAC;AAE1D,kFAAkF;AAClF,QAAA,MAAM,gBAAgB;;;;;;;;;;;;EAKZ,CAAC;AAEX,KAAK,kBAAkB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;AAOzE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAgCD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAyCjF"}

package/dist/bridge/data-integrity-reader.js

@@ -0,0 +1,110 @@
+/**
+ * Data-integrity posture reader (dashboard S8 — the Data-Integrity notary).
+ *
+ * The Data Integrity layer (core/data-integrity) composes four engine agents —
+ * #14 Data Integrity Auditor, #43 Data Consistency Checker, #44 Backup Recovery
+ * Tester, #45 Data Privacy Scanner — into a DataIntegrityReport via
+ * `DataIntegritySession` (the module's documented composition surface: engine
+ * findings are ingested verbatim; the session is the AGGREGATION layer). Its
+ * richer checks — ref-integrity, cross-store consistency, reconciliation,
+ * backup RPO/restore verification, distribution anomalies, lineage corruption
+ * tracing — all need LIVE inputs the bridge lacks (DB key sets, store values,
+ * authoritative numerics, backup-system state, row-level sampling, a pipeline
+ * DAG), exactly like S3's active scan / S5's spec diff / S7's churn signal.
+ *
+ * Decision D-UI-11: mirroring S3–S7, this derives a REAL data-integrity posture
+ * from the latest run's engine findings by ingesting them into a fresh
+ * `DataIntegritySession` and reading `buildReport()` — so the severity rollup
+ * (`IntegritySummary`, incl. `requiresEscalation`) is computed by the LAYER's
+ * own logic, not re-implemented here. Two session-instance fields are
+ * deliberately NOT surfaced: `auditChainIntact` and `readOnlyProof` are
+ * trivially clean for a fresh ingest-only session and would over-claim ("the
+ * run's integrity was verified") — session trivia, not run properties. The six
+ * live-check result lists are likewise omitted rather than shipped as
+ * always-empty fields implying checks that never ran. Findings are normalised
+ * at the trust boundary (shared `normalizeFinding`).
+ */
+import { listRuns, readRun } from './runs-reader.js';
+import { normalizeFinding } from './finding-normalize.js';
+import { DataIntegritySession } from '../core/data-integrity/index.js';
+/** Engine agents the data-integrity layer composes → the dimension they audit. */
+const INTEGRITY_AGENTS = [
+    { agentId: 14, dimension: 'ref-integrity' },
+    { agentId: 43, dimension: 'consistency' },
+    { agentId: 44, dimension: 'backup' },
+    { agentId: 45, dimension: 'privacy' },
+];
+/** Cap the finding list surfaced to the UI (severity-ranked). */
+const FINDINGS_CAP = 20;
+const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+const EMPTY_SUMMARY = {
+    totalViolations: 0,
+    critical: 0,
+    high: 0,
+    medium: 0,
+    low: 0,
+    requiresEscalation: false,
+};
+function emptySnapshot() {
+    return {
+        sourceRunId: null,
+        auditedAt: null,
+        summary: EMPTY_SUMMARY,
+        findings: [],
+        totalFindings: 0,
+        perAgent: [],
+        enrichment: 'run-derived',
+    };
+}
+/** Collect the normalised findings for one integrity agent from a run's agents. */
+function findingsFor(agents, agentId) {
+    return agents
+        .filter((a) => a.agentId === agentId)
+        .flatMap((a) => (Array.isArray(a.findings) ? a.findings : []))
+        .map(normalizeFinding)
+        .filter((f) => f !== null);
+}
+/**
+ * Build the data-integrity snapshot from the newest recorded run under `runsDir`.
+ * Returns an empty snapshot when no run exists or the detail is unreadable; never throws.
+ */
+export function buildDataIntegritySnapshot(runsDir) {
+    const runs = listRuns(runsDir);
+    if (runs.length === 0)
+        return emptySnapshot();
+    const latest = runs[0];
+    if (!latest)
+        return emptySnapshot();
+    const detail = readRun(runsDir, latest.runId);
+    if (!detail)
+        return emptySnapshot();
+    const auditedAt = detail.summary.completedAt || null;
+    // Deterministic session clock derived from the run it describes (not wall-clock).
+    const runMs = auditedAt ? Date.parse(auditedAt) || 0 : 0;
+    const perAgent = [];
+    const allFindings = [];
+    for (const { agentId, dimension } of INTEGRITY_AGENTS) {
+        const agent = detail.agents.find((a) => a.agentId === agentId);
+        if (!agent)
+            continue; // absent agent → no row; never a fabricated zero
+        const findings = findingsFor(detail.agents, agentId);
+        allFindings.push(...findings);
+        perAgent.push({ agentId, agentName: agent.agentName, dimension, findingCount: findings.length });
+    }
+    // Feed the findings through the LAYER's own composition surface so the
+    // summary semantics (severity buckets, requiresEscalation) are the layer's.
+    const session = new DataIntegritySession({ clock: () => runMs, sessionId: `bridge-${latest.runId}` });
+    session.ingestEngineFindings(allFindings);
+    const report = session.buildReport();
+    const ranked = [...allFindings].sort((a, b) => (SEVERITY_RANK[a.severity] ?? 5) - (SEVERITY_RANK[b.severity] ?? 5));
+    return {
+        sourceRunId: latest.runId,
+        auditedAt,
+        summary: report.summary,
+        findings: ranked.slice(0, FINDINGS_CAP),
+        totalFindings: allFindings.length,
+        perAgent,
+        enrichment: 'run-derived',
+    };
+}
+//# sourceMappingURL=data-integrity-reader.js.map

package/dist/bridge/data-integrity-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-integrity-reader.js","sourceRoot":"","sources":["../../bridge/data-integrity-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAI9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG;IACvB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;IAC3C,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE;IACzC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;IACpC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;CAC7B,CAAC;AAIX,iEAAiE;AACjE,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AA+BnG,MAAM,aAAa,GAAqB;IACtC,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,MAA8B,EAAE,OAAe;IAClE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;SACpC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7D,GAAG,CAAC,gBAAgB,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IACrD,kFAAkF;IAClF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,iDAAiD;QACvE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9E,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;QACvC,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,QAAQ;QACR,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bridge/design-reader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Design posture reader (dashboard S6 — The Designer).
+ *
+ * The UI/UX Design sub-orchestrator (agent #15, core/ui-ux) composes the design
+ * toolchain's engine agents — a11y (#8 A11y Guardian, #67 WCAG AAA), ux (#12 UX
+ * Inspector, #80 Usability), responsive (#29) — into a DesignAuditReport. Its
+ * full pipeline (mockup generation, design-token conformance, A/B hypotheses)
+ * needs design-tool inputs the bridge lacks (screenshots, a token registry,
+ * brand guidelines) — a CLI/active concern, like S3's active scan.
+ *
+ * Decision D-UI-9: mirroring S3–S5, this derives a REAL design posture from the
+ * latest run's design-squad findings, faithfully reusing the orchestrator's PURE
+ * helpers — composeA11yViolations / computeUsabilityScore / composeResponsiveResult
+ * — rather than re-summarising raw findings. A11y is the orchestrator's hard
+ * floor: `a11yGatePassed` is false whenever ANY a11y violation is present. A
+ * dimension whose agents did not run is reported as null (N/A) — never a free
+ * perfect pass. Findings are normalised at the trust boundary via the shared
+ * `normalizeFinding` helper (S5 lesson: coerce EVERY string field, not just some).
+ */
+import type { A11yViolation, UsabilityScore, ResponsiveResult } from '../core/ui-ux/index.js';
+export interface DesignAgentSummary {
+    readonly agentId: number;
+    readonly agentName: string;
+    readonly dimension: 'a11y' | 'ux' | 'responsive';
+    readonly findingCount: number;
+}
+export interface DesignPostureSnapshot {
+    readonly sourceRunId: string | null;
+    readonly auditedAt: string | null;
+    /** A11y violations (ALWAYS blocking — the orchestrator's hard floor). */
+    readonly a11yViolations: readonly A11yViolation[];
+    /** False whenever any a11y violation is present. */
+    readonly a11yGatePassed: boolean;
+    /** Usability score for the run, or null when no ux agent (#12/#80) ran. */
+    readonly usability: UsabilityScore | null;
+    /** Responsive result for the run, or null when the responsive agent (#29) didn't run. */
+    readonly responsive: ResponsiveResult | null;
+    /** Per-agent rollup for the design squad, only agents present in the run. */
+    readonly perAgent: readonly DesignAgentSummary[];
+    readonly totalFindings: number;
+    /**
+     * 'run-derived' — from the latest run's design-squad findings via the
+     * orchestrator's pure helpers. Mockup generation / token conformance / A-B
+     * need design-tool inputs and are NOT part of this view.
+     */
+    readonly enrichment: 'run-derived';
+}
+/** Build the design-posture snapshot from the newest recorded run under `runsDir`.
+ *  Returns an empty snapshot when no run exists or the detail is unreadable; never throws. */
+export declare function buildDesignPostureSnapshot(runsDir: string): DesignPostureSnapshot;
+//# sourceMappingURL=design-reader.d.ts.map

package/dist/bridge/design-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-reader.d.ts","sourceRoot":"","sources":["../../bridge/design-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAqBrF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD,oDAAoD;IACpD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAmBD;8FAC8F;AAC9F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAuDjF"}