@avi770/testteam 3.0.0 → 3.2.0

package/dist/bridge/design-reader.js

@@ -0,0 +1,105 @@
+/**
+ * Design posture reader (dashboard S6 — The Designer).
+ *
+ * The UI/UX Design sub-orchestrator (agent #15, core/ui-ux) composes the design
+ * toolchain's engine agents — a11y (#8 A11y Guardian, #67 WCAG AAA), ux (#12 UX
+ * Inspector, #80 Usability), responsive (#29) — into a DesignAuditReport. Its
+ * full pipeline (mockup generation, design-token conformance, A/B hypotheses)
+ * needs design-tool inputs the bridge lacks (screenshots, a token registry,
+ * brand guidelines) — a CLI/active concern, like S3's active scan.
+ *
+ * Decision D-UI-9: mirroring S3–S5, this derives a REAL design posture from the
+ * latest run's design-squad findings, faithfully reusing the orchestrator's PURE
+ * helpers — composeA11yViolations / computeUsabilityScore / composeResponsiveResult
+ * — rather than re-summarising raw findings. A11y is the orchestrator's hard
+ * floor: `a11yGatePassed` is false whenever ANY a11y violation is present. A
+ * dimension whose agents did not run is reported as null (N/A) — never a free
+ * perfect pass. Findings are normalised at the trust boundary via the shared
+ * `normalizeFinding` helper (S5 lesson: coerce EVERY string field, not just some).
+ */
+import { listRuns, readRun } from './runs-reader.js';
+import { normalizeFinding } from './finding-normalize.js';
+import { composeA11yViolations, computeUsabilityScore, composeResponsiveResult, } from '../core/ui-ux/index.js';
+/** Design-squad agent ids → the design dimension they feed. */
+const A11Y_AGENT_IDS = new Set([8, 67]);
+const UX_AGENT_IDS = new Set([12, 80]);
+const RESPONSIVE_AGENT_IDS = new Set([29]);
+const DESIGN_AGENT_IDS = new Set([8, 67, 12, 80, 29]);
+/** Synthetic screen id: the reader aggregates a whole run into one posture. */
+const AGGREGATE_SCREEN = 'run-aggregate';
+/** Collect normalised findings from the agents whose ids are in `ids`. */
+function findingsFrom(agents, ids) {
+    return agents
+        .filter((a) => ids.has(a.agentId))
+        .flatMap((a) => (Array.isArray(a.findings) ? a.findings : []))
+        .map(normalizeFinding)
+        .filter((f) => f !== null);
+}
+function emptySnapshot() {
+    return {
+        sourceRunId: null,
+        auditedAt: null,
+        a11yViolations: [],
+        a11yGatePassed: true,
+        usability: null,
+        responsive: null,
+        perAgent: [],
+        totalFindings: 0,
+        enrichment: 'run-derived',
+    };
+}
+const DIMENSION_OF = (agentId) => A11Y_AGENT_IDS.has(agentId) ? 'a11y' : UX_AGENT_IDS.has(agentId) ? 'ux' : 'responsive';
+/** Build the design-posture snapshot from the newest recorded run under `runsDir`.
+ *  Returns an empty snapshot when no run exists or the detail is unreadable; never throws. */
+export function buildDesignPostureSnapshot(runsDir) {
+    const runs = listRuns(runsDir);
+    if (runs.length === 0)
+        return emptySnapshot();
+    const latest = runs[0];
+    if (!latest)
+        return emptySnapshot();
+    const detail = readRun(runsDir, latest.runId);
+    if (!detail)
+        return emptySnapshot();
+    const designAgents = detail.agents.filter((a) => DESIGN_AGENT_IDS.has(a.agentId));
+    const a11yFindings = findingsFrom(designAgents, A11Y_AGENT_IDS);
+    const uxFindings = findingsFrom(designAgents, UX_AGENT_IDS);
+    const responsiveFindings = findingsFrom(designAgents, RESPONSIVE_AGENT_IDS);
+    const a11yViolations = composeA11yViolations({ findings: a11yFindings }, AGGREGATE_SCREEN);
+    // A dimension is only scored when its agents actually ran — an absent agent is
+    // N/A (null), never a free perfect pass (mirrors the layer's checkedCount honesty).
+    const uxAgentRan = designAgents.some((a) => UX_AGENT_IDS.has(a.agentId));
+    const usability = uxAgentRan
+        ? computeUsabilityScore(AGGREGATE_SCREEN, { findings: uxFindings }, [])
+        : null;
+    const responsiveAgentRan = designAgents.some((a) => RESPONSIVE_AGENT_IDS.has(a.agentId));
+    const responsive = responsiveAgentRan
+        ? composeResponsiveResult(AGGREGATE_SCREEN, {
+            findings: responsiveFindings.map((f) => ({
+                id: f.id,
+                severity: f.severity,
+                description: f.description,
+                module: f.module,
+            })),
+        })
+        : null;
+    const perAgent = designAgents.map((a) => ({
+        agentId: a.agentId,
+        agentName: a.agentName,
+        dimension: DIMENSION_OF(a.agentId),
+        findingCount: (Array.isArray(a.findings) ? a.findings : []).length,
+    }));
+    const totalFindings = a11yFindings.length + uxFindings.length + responsiveFindings.length;
+    return {
+        sourceRunId: latest.runId,
+        auditedAt: detail.summary.completedAt || null,
+        a11yViolations,
+        a11yGatePassed: a11yViolations.length === 0,
+        usability,
+        responsive,
+        perAgent,
+        totalFindings,
+        enrichment: 'run-derived',
+    };
+}
+//# sourceMappingURL=design-reader.js.map

package/dist/bridge/design-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-reader.js","sourceRoot":"","sources":["../../bridge/design-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAIvB,+DAA+D;AAC/D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5D,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE3E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC,0EAA0E;AAC1E,SAAS,YAAY,CAAC,MAA8B,EAAE,GAAwB;IAC5E,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACjC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7D,GAAG,CAAC,gBAAgB,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AA+BD,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,OAAe,EAAgC,EAAE,CACrE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;AAEzF;8FAC8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAElF,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,YAAY,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,kBAAkB;QACnC,CAAC,CAAC,uBAAuB,CAAC,gBAAgB,EAAE;YACxC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;SACJ,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAyB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,YAAY,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;KACnE,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAE1F,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI;QAC7C,cAAc;QACd,cAAc,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3C,SAAS;QACT,UAAU;QACV,QAAQ;QACR,aAAa;QACb,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bridge/file-scanner.d.ts

@@ -0,0 +1,21 @@
+/**
+ * FileScanner — scans source files with regex patterns.
+ *
+ * Recursively reads files under a root directory, applies glob-based
+ * filtering, and returns structured match results. Uses only fs APIs
+ * (no shell commands) — safe by design.
+ */
+import type { FileScanMatch } from './types.js';
+export declare class FileScanner {
+    /**
+     * Scan files under rootDir for lines matching any of the given regex patterns.
+     *
+     * @param rootDir   - Root directory to scan
+     * @param patterns  - Array of regex pattern strings
+     * @param fileGlobs - Optional glob patterns to filter files (e.g. ["**\/*.ts"])
+     */
+    scan(rootDir: string, patterns: string[], fileGlobs?: string[]): {
+        matches: FileScanMatch[];
+    };
+}
+//# sourceMappingURL=file-scanner.d.ts.map

package/dist/bridge/file-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.d.ts","sourceRoot":"","sources":["../../bridge/file-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAiD7C,qBAAa,WAAW;IACtB;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE;CA0D9F"}

package/dist/bridge/file-scanner.js

@@ -0,0 +1,117 @@
+/**
+ * FileScanner — scans source files with regex patterns.
+ *
+ * Recursively reads files under a root directory, applies glob-based
+ * filtering, and returns structured match results. Uses only fs APIs
+ * (no shell commands) — safe by design.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** Escape regex metacharacters so input is treated as a literal match. */
+function escapeRegExp(input) {
+    return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Matches a filename against a simple glob pattern (supports * and ** prefix). */
+function matchesGlob(filePath, pattern) {
+    // Normalise to forward slashes for consistent matching
+    const normalised = filePath.replace(/\\/g, '/');
+    if (pattern.startsWith('**/*.')) {
+        const ext = pattern.slice(4); // e.g. "**/*.ts" -> ".ts"
+        return normalised.endsWith(ext);
+    }
+    if (pattern.startsWith('*.')) {
+        const ext = pattern.slice(1); // e.g. "*.ts" -> ".ts"
+        return path.basename(normalised).endsWith(ext);
+    }
+    return normalised.includes(pattern);
+}
+/** Recursively collects file paths under a directory, skipping node_modules and .git. */
+function collectFiles(dir) {
+    const results = [];
+    const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', '.run', 'coverage']);
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name)) {
+                results.push(...collectFiles(fullPath));
+            }
+        }
+        else if (entry.isFile()) {
+            results.push(fullPath);
+        }
+    }
+    return results;
+}
+export class FileScanner {
+    /**
+     * Scan files under rootDir for lines matching any of the given regex patterns.
+     *
+     * @param rootDir   - Root directory to scan
+     * @param patterns  - Array of regex pattern strings
+     * @param fileGlobs - Optional glob patterns to filter files (e.g. ["**\/*.ts"])
+     */
+    scan(rootDir, patterns, fileGlobs) {
+        const matches = [];
+        // Patterns are caller-supplied (the bridge `file-scan` action) — a trust
+        // boundary. Compile defensively: an invalid pattern must NOT throw an
+        // uncaught exception that aborts the whole scan (DoS), and the input is
+        // bounded so a request can't submit an unbounded pattern set.
+        const MAX_PATTERNS = 100;
+        const MAX_PATTERN_LEN = 2000;
+        const compiledPatterns = [];
+        for (const p of patterns.slice(0, MAX_PATTERNS)) {
+            if (typeof p !== 'string' || p.length === 0 || p.length > MAX_PATTERN_LEN)
+                continue;
+            try {
+                compiledPatterns.push(new RegExp(escapeRegExp(p), 'g'));
+            }
+            catch {
+                // Defensive: RegExp construction should not throw after escaping, but do not abort the scan.
+                continue;
+            }
+        }
+        let files = collectFiles(rootDir);
+        // Apply glob filtering if specified
+        if (fileGlobs && fileGlobs.length > 0) {
+            files = files.filter((f) => fileGlobs.some((glob) => matchesGlob(f, glob)));
+        }
+        for (const file of files) {
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split('\n');
+            for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+                const line = lines[lineNum];
+                // Bound ReDoS blast radius from an untrusted pattern: very long lines
+                // (minified/generated) are skipped rather than risk catastrophic
+                // backtracking. A re2 engine would lift this cap (see DECISIONS).
+                if (line.length > 50_000)
+                    continue;
+                for (const regex of compiledPatterns) {
+                    regex.lastIndex = 0; // Reset since we use /g flag
+                    const m = regex.exec(line);
+                    if (m) {
+                        matches.push({
+                            file: path.relative(rootDir, file).replace(/\\/g, '/'),
+                            line: lineNum + 1,
+                            match: m[0],
+                        });
+                    }
+                }
+            }
+        }
+        return { matches };
+    }
+}
+//# sourceMappingURL=file-scanner.js.map

package/dist/bridge/file-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.js","sourceRoot":"","sources":["../../bridge/file-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,0EAA0E;AAC1E,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,uDAAuD;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;QACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,yFAAyF;AACzF,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAEhF,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,WAAW;IACtB;;;;;;OAMG;IACH,IAAI,CAAC,OAAe,EAAE,QAAkB,EAAE,SAAoB;QAC5D,MAAM,OAAO,GAAoB,EAAE,CAAC;QAEpC,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,GAAG,CAAC;QACzB,MAAM,eAAe,GAAG,IAAI,CAAC;QAC7B,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,eAAe;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,gBAAgB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,6FAA6F;gBAC7F,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAElC,oCAAoC;QACpC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,sEAAsE;gBACtE,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;oBAAE,SAAS;gBACnC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;oBACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,6BAA6B;oBAClD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,CAAC,EAAE,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC;4BACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;4BACtD,IAAI,EAAE,OAAO,GAAG,CAAC;4BACjB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;yBACZ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/bridge/finding-normalize.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared finding normalisation for the dashboard posture readers.
+ *
+ * Run artifacts are `JSON.parse(...) as AgentResult` with NO runtime shape check
+ * (see runs-reader), so a partial/old-schema finding can reach a reader with a
+ * missing `id`, `module`, or `description` (all typed `string` on {@link Finding})
+ * or a non-enum `severity`. Each posture reader feeds findings through its own
+ * pure functions — the Sentinel (S3) dereferences `description` via `.toLowerCase()`
+ * and renders `id`; the Inspector (S4) regex-tests `id`/`description`; the Border
+ * Guard (S5) renders `id`/`module`/`description` into typed view fields — so a
+ * missing field must never leak `undefined` into a `string` (violating the
+ * trust-boundary contract) or 500 a posture endpoint.
+ *
+ * Coercing the boundary fields here keeps every reader's documented
+ * never-throw / typed-contract guarantee in ONE place (previously the identical
+ * logic was copied per reader). Non-object entries are dropped (returns null).
+ */
+import type { Finding } from '../core/types.js';
+/**
+ * Coerce a persisted finding to a safe, typed shape. Returns `null` for a
+ * non-object entry (so callers can `.filter((f): f is Finding => f !== null)`).
+ */
+export declare function normalizeFinding(raw: unknown): Finding | null;
+//# sourceMappingURL=finding-normalize.d.ts.map

package/dist/bridge/finding-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-normalize.d.ts","sourceRoot":"","sources":["../../bridge/finding-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAI9D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAsB7D"}

package/dist/bridge/finding-normalize.js

@@ -0,0 +1,46 @@
+/**
+ * Shared finding normalisation for the dashboard posture readers.
+ *
+ * Run artifacts are `JSON.parse(...) as AgentResult` with NO runtime shape check
+ * (see runs-reader), so a partial/old-schema finding can reach a reader with a
+ * missing `id`, `module`, or `description` (all typed `string` on {@link Finding})
+ * or a non-enum `severity`. Each posture reader feeds findings through its own
+ * pure functions — the Sentinel (S3) dereferences `description` via `.toLowerCase()`
+ * and renders `id`; the Inspector (S4) regex-tests `id`/`description`; the Border
+ * Guard (S5) renders `id`/`module`/`description` into typed view fields — so a
+ * missing field must never leak `undefined` into a `string` (violating the
+ * trust-boundary contract) or 500 a posture endpoint.
+ *
+ * Coercing the boundary fields here keeps every reader's documented
+ * never-throw / typed-contract guarantee in ONE place (previously the identical
+ * logic was copied per reader). Non-object entries are dropped (returns null).
+ */
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info']);
+/**
+ * Coerce a persisted finding to a safe, typed shape. Returns `null` for a
+ * non-object entry (so callers can `.filter((f): f is Finding => f !== null)`).
+ */
+export function normalizeFinding(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const f = raw;
+    const severity = typeof f['severity'] === 'string' && VALID_SEVERITIES.has(f['severity'])
+        ? f['severity']
+        : 'info';
+    return {
+        ...f,
+        // Coerce every typed `string` field a reader/view dereferences — a partial
+        // artifact must never leak `undefined` into a `string` field (S5 review lesson).
+        id: typeof f['id'] === 'string' ? f['id'] : '',
+        module: typeof f['module'] === 'string' ? f['module'] : '',
+        description: typeof f['description'] === 'string' ? f['description'] : '',
+        severity,
+        // `file`/`line` are optional, but the run-detail consumers (dashboard
+        // FindingsBrowser does `file.slice(0, 300)` behind a truthiness-only guard;
+        // both render them) would throw on a truthy non-string `file`. Coerce a
+        // non-string/non-number back to `undefined` so those guards stay well-typed.
+        file: typeof f['file'] === 'string' ? f['file'] : undefined,
+        line: typeof f['line'] === 'number' ? f['line'] : undefined,
+    };
+}
+//# sourceMappingURL=finding-normalize.js.map

package/dist/bridge/finding-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-normalize.js","sourceRoot":"","sources":["../../bridge/finding-normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,CAAE,CAAC,CAAC,UAAU,CAAqB;QACpC,CAAC,CAAC,MAAM,CAAC;IACb,OAAO;QACL,GAAI,CAAwB;QAC5B,2EAA2E;QAC3E,iFAAiF;QACjF,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,EAAE;QACtE,WAAW,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,aAAa,CAAY,CAAC,CAAC,CAAC,EAAE;QACrF,QAAQ;QACR,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,6EAA6E;QAC7E,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,SAAS;QACvE,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC"}

package/dist/bridge/http-client.d.ts

@@ -0,0 +1,44 @@
+/**
+ * HttpClient — HTTP client for API testing within the Execution Bridge.
+ *
+ * Uses the native `fetch` API. Measures response time and supports
+ * concurrent request execution with configurable parallelism.
+ */
+export interface HttpResponse {
+    status: number;
+    body: unknown;
+    headers: Record<string, string>;
+    durationMs: number;
+}
+export interface HttpRequest {
+    url: string;
+    method?: string;
+    body?: unknown;
+    headers?: Record<string, string>;
+    timeout?: number;
+}
+/**
+ * Validate an outbound request URL (SSRF guard).
+ *
+ * Enforces http/https and refuses the cloud-metadata / link-local range
+ * (`169.254.0.0/16`, incl. `169.254.169.254` and `metadata.google.internal` /
+ * the AWS IMDSv6 alias) — the canonical SSRF pivot to steal cloud credentials,
+ * and never a legitimate test target. Private ranges (10/172.16/192.168) and
+ * localhost are intentionally NOT blocked: the bridge's job is to exercise the
+ * user's own app, which is usually local. Throws on a bad/forbidden URL.
+ */
+export declare function assertSafeRequestUrl(url: string): void;
+export declare class HttpClient {
+    /**
+     * Execute a single HTTP request and measure its duration.
+     */
+    request(url: string, method?: string, body?: unknown, headers?: Record<string, string>, timeout?: number): Promise<HttpResponse>;
+    /**
+     * Execute multiple HTTP requests with limited concurrency.
+     *
+     * @param requests       - Array of request configurations
+     * @param maxConcurrency - Maximum parallel requests (default 5)
+     */
+    concurrent(requests: HttpRequest[], maxConcurrency?: number): Promise<HttpResponse[]>;
+}
+//# sourceMappingURL=http-client.d.ts.map

package/dist/bridge/http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../bridge/http-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA8BtD;AAED,qBAAa,UAAU;IACrB;;OAEG;IACG,OAAO,CACX,GAAG,EAAE,MAAM,EACX,MAAM,SAAQ,EACd,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,SAAS,GACf,OAAO,CAAC,YAAY,CAAC;IAkExB;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,WAAW,EAAE,EACvB,cAAc,SAAI,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC;CA0B3B"}

package/dist/bridge/http-client.js

@@ -0,0 +1,130 @@
+/**
+ * HttpClient — HTTP client for API testing within the Execution Bridge.
+ *
+ * Uses the native `fetch` API. Measures response time and supports
+ * concurrent request execution with configurable parallelism.
+ */
+/**
+ * Validate an outbound request URL (SSRF guard).
+ *
+ * Enforces http/https and refuses the cloud-metadata / link-local range
+ * (`169.254.0.0/16`, incl. `169.254.169.254` and `metadata.google.internal` /
+ * the AWS IMDSv6 alias) — the canonical SSRF pivot to steal cloud credentials,
+ * and never a legitimate test target. Private ranges (10/172.16/192.168) and
+ * localhost are intentionally NOT blocked: the bridge's job is to exercise the
+ * user's own app, which is usually local. Throws on a bad/forbidden URL.
+ */
+export function assertSafeRequestUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`HttpClient: invalid URL: ${String(url).slice(0, 200)}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`HttpClient: unsupported URL scheme '${parsed.protocol}' (http/https only)`);
+    }
+    const host = parsed.hostname
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '');
+    // Reject non-canonical numeric hostnames that can encode link-local IPs (e.g. 0xA9FEA9FE).
+    if (/^(?:0x[0-9a-f]+|\d+)$/i.test(host)) {
+        throw new Error('HttpClient: refusing a non-canonical numeric hostname (SSRF guard)');
+    }
+    const isIpv4 = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+    if (host === '169.254.169.254' ||
+        (isIpv4 && host.startsWith('169.254.')) ||
+        host === 'metadata.google.internal' ||
+        host === 'fd00:ec2::254') {
+        throw new Error('HttpClient: refusing the cloud-metadata/link-local address (SSRF guard)');
+    }
+}
+export class HttpClient {
+    /**
+     * Execute a single HTTP request and measure its duration.
+     */
+    async request(url, method = 'GET', body, headers, timeout = 30_000) {
+        assertSafeRequestUrl(url);
+        const start = performance.now();
+        const controller = new AbortController();
+        // Clamp the caller-supplied timeout to a bounded integer range so untrusted
+        // input cannot create a pathological long-lived timer (resource exhaustion).
+        // The value reaching setTimeout is upper-bounded by MAX_TIMEOUT_MS.
+        const DEFAULT_TIMEOUT_MS = 30_000;
+        const MIN_TIMEOUT_MS = 100;
+        const MAX_TIMEOUT_MS = 120_000;
+        const parsedTimeout = Number(timeout);
+        const safeTimeout = Number.isFinite(parsedTimeout)
+            ? Math.min(Math.max(Math.trunc(parsedTimeout), MIN_TIMEOUT_MS), MAX_TIMEOUT_MS)
+            : DEFAULT_TIMEOUT_MS;
+        const timer = setTimeout(() => controller.abort(), safeTimeout);
+        try {
+            const init = {
+                method,
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                },
+                signal: controller.signal,
+            };
+            if (body !== undefined && method !== 'GET' && method !== 'HEAD') {
+                init.body = typeof body === 'string' ? body : JSON.stringify(body);
+            }
+            const res = await fetch(url, init);
+            const durationMs = Math.round(performance.now() - start);
+            let responseBody;
+            const contentType = res.headers.get('content-type') ?? '';
+            if (contentType.includes('application/json')) {
+                responseBody = await res.json();
+            }
+            else {
+                responseBody = await res.text();
+            }
+            const responseHeaders = {};
+            res.headers.forEach((value, key) => {
+                responseHeaders[key] = value;
+            });
+            return {
+                status: res.status,
+                body: responseBody,
+                headers: responseHeaders,
+                durationMs,
+            };
+        }
+        catch {
+            const durationMs = Math.round(performance.now() - start);
+            return {
+                status: 0,
+                body: null,
+                headers: {},
+                durationMs,
+            };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Execute multiple HTTP requests with limited concurrency.
+     *
+     * @param requests       - Array of request configurations
+     * @param maxConcurrency - Maximum parallel requests (default 5)
+     */
+    async concurrent(requests, maxConcurrency = 5) {
+        const results = new Array(requests.length);
+        let index = 0;
+        const worker = async () => {
+            while (index < requests.length) {
+                const currentIndex = index++;
+                const req = requests[currentIndex];
+                results[currentIndex] = await this.request(req.url, req.method, req.body, req.headers, req.timeout);
+            }
+        };
+        const workers = Array.from({ length: Math.min(maxConcurrency, requests.length) }, () => worker());
+        await Promise.all(workers);
+        return results;
+    }
+}
+//# sourceMappingURL=http-client.js.map

package/dist/bridge/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../bridge/http-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtB,2FAA2F;IAC3F,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtD,IACE,IAAI,KAAK,iBAAiB;QAC1B,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,KAAK,0BAA0B;QACnC,IAAI,KAAK,eAAe,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACrB;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,GAAW,EACX,MAAM,GAAG,KAAK,EACd,IAAc,EACd,OAAgC,EAChC,OAAO,GAAG,MAAM;QAEhB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,4EAA4E;QAC5E,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,kBAAkB,GAAG,MAAM,CAAC;QAClC,MAAM,cAAc,GAAG,GAAG,CAAC;QAC3B,MAAM,cAAc,GAAG,OAAO,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,EAAE,cAAc,CAAC;YAC/E,CAAC,CAAC,kBAAkB,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,IAAI,GAAgB;gBACxB,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;iBACX;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YAEF,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;YAEzD,IAAI,YAAqB,CAAC;YAC1B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7C,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAED,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,eAAe;gBACxB,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;YACzD,OAAO;gBACL,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,EAAE;gBACX,UAAU;aACX,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,QAAuB,EACvB,cAAc,GAAG,CAAC;QAElB,MAAM,OAAO,GAAmB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,OAAO,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,KAAK,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;gBACnC,OAAO,CAAC,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CACxC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,OAAO,CACZ,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EACrD,GAAG,EAAE,CAAC,MAAM,EAAE,CACf,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/bridge/knowledge-reader.d.ts

@@ -0,0 +1,10 @@
+import type { MapSnapshot, HealthState } from '../core/knowledge/index.js';
+export interface SystemMapView {
+    readonly snapshot: MapSnapshot;
+    readonly healthRollup: HealthState;
+    readonly nodeCount: number;
+    readonly edgeCount: number;
+}
+/** Build a SystemMap snapshot from the agent registry + phase dispatch table. */
+export declare function buildSystemMapSnapshot(): SystemMapView;
+//# sourceMappingURL=knowledge-reader.d.ts.map

package/dist/bridge/knowledge-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-reader.d.ts","sourceRoot":"","sources":["../../bridge/knowledge-reader.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGlE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,IAAI,aAAa,CA4BtD"}

package/dist/bridge/knowledge-reader.js

@@ -0,0 +1,46 @@
+/**
+ * Knowledge system-map reader (dashboard S2).
+ *
+ * Master Knowledge (#25) `SystemMap` is a library with no populated instance in
+ * the running product, so the dashboard's blast-radius view needs a real graph
+ * to render. We build one from data the bridge already owns (decision D-UI-4):
+ *   - nodes: the 120 agents (kind 'agent') + the pipeline phases (kind 'capability')
+ *   - edges: each phase depends-on every agent it dispatches (PHASE_DISPATCH),
+ *     provenance 'phase-dispatch', confidence 1 — a real, non-guessed dependency.
+ *
+ * Edge semantics (from core/knowledge): `from depends-on to` — changing `to`
+ * breaks `from`. So a phase (`from`) depends-on each agent (`to`) it runs, and
+ * blast-radius(agent) = the phases that break if that agent changes. Health is
+ * 'unknown' throughout (never a guessed state).
+ */
+import { AGENT_REGISTRY } from './agent-registry.js';
+import { PHASE_DISPATCH } from '../core/orchestrator.js';
+import { SystemMap } from '../core/knowledge/index.js';
+/** Build a SystemMap snapshot from the agent registry + phase dispatch table. */
+export function buildSystemMapSnapshot() {
+    const map = new SystemMap();
+    for (const agent of AGENT_REGISTRY) {
+        map.upsertNode({ id: `agent-${agent.agentId}`, kind: 'agent', label: `#${agent.agentId} ${agent.name}` });
+    }
+    let edgeCount = 0;
+    for (const phase of Object.keys(PHASE_DISPATCH)) {
+        map.upsertNode({ id: `phase-${phase}`, kind: 'capability', label: phase });
+        for (const agentId of PHASE_DISPATCH[phase]) {
+            map.addEdge({
+                from: `phase-${phase}`,
+                to: `agent-${agentId}`,
+                relation: 'dispatches',
+                provenance: 'phase-dispatch',
+                confidence: 1,
+            });
+            edgeCount += 1;
+        }
+    }
+    return {
+        snapshot: map.snapshot(),
+        healthRollup: map.healthRollup(),
+        nodeCount: map.nodeCount,
+        edgeCount,
+    };
+}
+//# sourceMappingURL=knowledge-reader.js.map

package/dist/bridge/knowledge-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-reader.js","sourceRoot":"","sources":["../../bridge/knowledge-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAW9C,iFAAiF;AACjF,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAY,EAAE,CAAC;QAC3D,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,SAAS,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,CAAC;gBACV,IAAI,EAAE,SAAS,KAAK,EAAE;gBACtB,EAAE,EAAE,SAAS,OAAO,EAAE;gBACtB,QAAQ,EAAE,YAAY;gBACtB,UAAU,EAAE,gBAAgB;gBAC5B,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS;KACV,CAAC;AACJ,CAAC"}