@bryan-thompson/inspector-assessment-client 1.22.13 → 1.22.16

package/lib/lib/assessment/coreTypes.js

@@ -0,0 +1,101 @@
+/**
+ * Core Assessment Types
+ *
+ * Foundational types used across all assessment modules.
+ * These are the building blocks that other type files depend on.
+ *
+ * @module assessment/coreTypes
+ */
+/**
+ * Category metadata mapping for all assessment modules.
+ * Used for CLI output and downstream consumers to understand category context.
+ *
+ * Note: Uses `satisfies` to preserve literal key types while ensuring type safety.
+ * This allows deriving AssessmentModuleName from the object keys.
+ */
+const ASSESSMENT_CATEGORY_METADATA_INTERNAL = {
+    functionality: {
+        tier: "core",
+        description: "Tool functionality validation",
+    },
+    security: {
+        tier: "core",
+        description: "Security vulnerability detection",
+    },
+    documentation: {
+        tier: "core",
+        description: "Documentation quality",
+    },
+    errorHandling: {
+        tier: "core",
+        description: "Error handling compliance",
+    },
+    usability: { tier: "core", description: "Usability assessment" },
+    mcpSpecCompliance: {
+        tier: "core",
+        description: "MCP protocol compliance",
+    },
+    aupCompliance: {
+        tier: "core",
+        description: "Acceptable use policy compliance",
+    },
+    toolAnnotations: {
+        tier: "core",
+        description: "Tool annotation validation",
+    },
+    prohibitedLibraries: {
+        tier: "core",
+        description: "Prohibited library detection",
+    },
+    manifestValidation: {
+        tier: "optional",
+        description: "MCPB manifest validation",
+        applicableTo: "MCPB bundles",
+    },
+    portability: {
+        tier: "optional",
+        description: "Portability checks",
+        applicableTo: "MCPB bundles",
+    },
+    externalAPIScanner: {
+        tier: "core",
+        description: "External API detection",
+    },
+    authentication: {
+        tier: "core",
+        description: "OAuth/auth evaluation",
+    },
+    temporal: {
+        tier: "core",
+        description: "Temporal/rug pull detection",
+    },
+    resources: { tier: "core", description: "Resource security" },
+    prompts: { tier: "core", description: "Prompt security" },
+    crossCapability: {
+        tier: "core",
+        description: "Cross-capability security",
+    },
+};
+/**
+ * Re-export with original name for backward compatibility.
+ * Type is preserved as Record<AssessmentModuleName, AssessmentCategoryMetadata>.
+ */
+export const ASSESSMENT_CATEGORY_METADATA = ASSESSMENT_CATEGORY_METADATA_INTERNAL;
+/**
+ * Generate module configuration derived from ASSESSMENT_CATEGORY_METADATA.
+ * Single source of truth for all assessment module names.
+ *
+ * @param options.sourceCodePath - If true, enables externalAPIScanner
+ * @param options.skipTemporal - If true, disables temporal assessment
+ * @returns Record of module names to enabled state (type-safe)
+ */
+export function getAllModulesConfig(options) {
+    return Object.keys(ASSESSMENT_CATEGORY_METADATA).reduce((acc, key) => ({
+        ...acc,
+        [key]: key === "externalAPIScanner"
+            ? Boolean(options.sourceCodePath)
+            : key === "temporal"
+                ? !options.skipTemporal
+                : true,
+    }), {});
+}

package/lib/lib/assessment/extendedTypes.d.ts

@@ -0,0 +1,415 @@
+/**
+ * Extended Assessment Types
+ *
+ * Types for extended assessment modules including AUP compliance,
+ * tool annotations, temporal detection, and capability assessors.
+ *
+ * @module assessment/extendedTypes
+ */
+import type { AssessmentStatus, SecurityRiskLevel, InferenceConfidence, AlignmentStatus } from "./coreTypes.js";
+export type AUPCategory = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" | "I" | "J" | "K" | "L" | "M" | "N";
+export type AUPSeverity = "CRITICAL" | "HIGH" | "MEDIUM" | "FLAG";
+export interface AUPViolation {
+    category: AUPCategory;
+    categoryName: string;
+    severity: AUPSeverity;
+    pattern: string;
+    matchedText: string;
+    location: "tool_name" | "tool_description" | "readme" | "source_code";
+    filePath?: string;
+    lineNumber?: number;
+    confidence: "high" | "medium" | "low";
+    requiresHumanReview: boolean;
+    reviewGuidance?: string;
+}
+export interface AUPComplianceAssessment {
+    violations: AUPViolation[];
+    highRiskDomains: string[];
+    scannedLocations: {
+        toolNames: boolean;
+        toolDescriptions: boolean;
+        readme: boolean;
+        sourceCode: boolean;
+    };
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+/**
+ * Source of tool annotations
+ */
+export type AnnotationSource = "mcp" | "source-code" | "inferred" | "none";
+export interface ToolAnnotationResult {
+    toolName: string;
+    hasAnnotations: boolean;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        title?: string;
+        description?: string;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+    };
+    /** Where the annotations were extracted from */
+    annotationSource?: AnnotationSource;
+    inferredBehavior?: {
+        expectedReadOnly: boolean;
+        expectedDestructive: boolean;
+        reason: string;
+        /** Confidence level of the inference */
+        confidence: InferenceConfidence;
+        /** True if the tool name matches an ambiguous pattern */
+        isAmbiguous: boolean;
+    };
+    /** Alignment status between annotations and inferred behavior */
+    alignmentStatus?: AlignmentStatus;
+    issues: string[];
+    recommendations: string[];
+    /** Description poisoning detection (Issue #8) */
+    descriptionPoisoning?: {
+        detected: boolean;
+        patterns: Array<{
+            name: string;
+            pattern: string;
+            severity: "LOW" | "MEDIUM" | "HIGH";
+            category: string;
+            evidence: string;
+        }>;
+        riskLevel: "NONE" | "LOW" | "MEDIUM" | "HIGH";
+    };
+}
+export interface ToolAnnotationAssessment {
+    toolResults: ToolAnnotationResult[];
+    annotatedCount: number;
+    missingAnnotationsCount: number;
+    /** Count of high-confidence misalignments only (excludes REVIEW_RECOMMENDED) */
+    misalignedAnnotationsCount: number;
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+    /** Detailed metrics for annotation quality */
+    metrics?: {
+        /** Percentage of tools with any annotations (0-100) */
+        coverage: number;
+        /** Percentage of tools without contradictions (0-100) */
+        consistency: number;
+        /** Percentage of high-confidence alignments (0-100) */
+        correctness: number;
+        /** Count of tools needing manual review */
+        reviewRequired: number;
+    };
+    /** Breakdown of tools by alignment status */
+    alignmentBreakdown?: {
+        aligned: number;
+        misaligned: number;
+        reviewRecommended: number;
+        unknown: number;
+    };
+    /** Summary of where annotations were extracted from */
+    annotationSources?: {
+        /** Count from MCP protocol (tools/list response) */
+        mcp: number;
+        /** Count from source code analysis */
+        sourceCode: number;
+        /** Count where behavior was inferred from patterns */
+        inferred: number;
+        /** Count with no annotations found */
+        none: number;
+    };
+    /** Count of tools with poisoned descriptions detected (Issue #8) */
+    poisonedDescriptionsDetected?: number;
+}
+export type ProhibitedLibraryCategory = "financial" | "media" | "payments" | "banking";
+export interface ProhibitedLibraryMatch {
+    name: string;
+    category: ProhibitedLibraryCategory;
+    location: "package.json" | "source_import" | "requirements.txt" | "cargo.toml";
+    filePath?: string;
+    lineNumber?: number;
+    severity: "BLOCKING" | "HIGH" | "MEDIUM";
+    reason: string;
+    policyReference: string;
+}
+export interface ProhibitedLibrariesAssessment {
+    matches: ProhibitedLibraryMatch[];
+    scannedFiles: string[];
+    hasFinancialLibraries: boolean;
+    hasMediaLibraries: boolean;
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface ManifestJsonSchema {
+    manifest_version: string;
+    name: string;
+    version: string;
+    description?: string;
+    author?: string;
+    repository?: string;
+    license?: string;
+    mcp_config: {
+        command: string;
+        args?: string[];
+        env?: Record<string, string>;
+    };
+    icon?: string;
+    homepage?: string;
+    keywords?: string[];
+    privacy_policies?: string[];
+}
+/**
+ * Privacy Policy URL Validation Result
+ * Validates that privacy_policies URLs are accessible
+ */
+export interface PrivacyPolicyValidation {
+    url: string;
+    accessible: boolean;
+    statusCode?: number;
+    contentType?: string;
+    error?: string;
+}
+export interface ManifestValidationResult {
+    field: string;
+    valid: boolean;
+    value?: unknown;
+    expectedType?: string;
+    issue?: string;
+    severity: "ERROR" | "WARNING" | "INFO";
+}
+export interface ManifestValidationAssessment {
+    hasManifest: boolean;
+    manifestVersion?: string;
+    validationResults: ManifestValidationResult[];
+    hasIcon: boolean;
+    hasRequiredFields: boolean;
+    missingFields: string[];
+    /** Privacy policy URL validation results */
+    privacyPolicies?: {
+        declared: string[];
+        validationResults: PrivacyPolicyValidation[];
+        allAccessible: boolean;
+    };
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface PortabilityIssue {
+    type: "hardcoded_path" | "platform_specific" | "bundle_root_antipattern" | "absolute_path" | "user_home_path";
+    filePath: string;
+    lineNumber?: number;
+    matchedText: string;
+    severity: "HIGH" | "MEDIUM" | "LOW";
+    recommendation: string;
+}
+export interface PortabilityAssessment {
+    issues: PortabilityIssue[];
+    scannedFiles: number;
+    platformSpecificCount: number;
+    hardcodedPathCount: number;
+    usesDirname: boolean;
+    usesBundleRoot: boolean;
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+    /** Shell command portability analysis */
+    shellCommands?: Array<{
+        command: string;
+        isPortable: boolean;
+        alternativeCommand?: string;
+    }>;
+    /** Platform coverage summary */
+    platformCoverage?: {
+        supported: "all" | "windows" | "macos" | "linux";
+        missing: string[];
+    };
+}
+export interface DetectedAPI {
+    url: string;
+    service: string;
+    filePath: string;
+}
+export interface ExternalAPIScannerAssessment {
+    detectedAPIs: DetectedAPI[];
+    uniqueServices: string[];
+    affiliationWarning?: string;
+    scannedFiles: number;
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export type AuthMethod = "oauth" | "api_key" | "none" | "unknown";
+export interface AuthAppropriateness {
+    isAppropriate: boolean;
+    concerns: string[];
+    explanation: string;
+}
+export interface TransportSecurityAnalysis {
+    usesTLS: boolean;
+    tlsEnforced: boolean;
+    hasInsecurePatterns: boolean;
+    insecurePatterns: string[];
+    hasSecurePatterns: boolean;
+    securePatterns: string[];
+    corsConfigured: boolean;
+    corsPermissive: boolean;
+    sessionSecure: boolean;
+    recommendations: string[];
+}
+export interface AuthenticationAssessment {
+    authMethod: AuthMethod;
+    hasLocalDependencies: boolean;
+    transportType: string;
+    appropriateness: AuthAppropriateness;
+    recommendation: string;
+    detectedPatterns: {
+        oauthIndicators: string[];
+        localResourceIndicators: string[];
+        apiKeyIndicators: string[];
+    };
+    transportSecurity?: TransportSecurityAnalysis;
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface TemporalToolResult {
+    tool: string;
+    vulnerable: boolean;
+    totalInvocations: number;
+    firstDeviationAt: number | null;
+    deviationCount: number;
+    errorCount: number;
+    pattern: "RUG_PULL_TEMPORAL" | "RUG_PULL_DEFINITION" | null;
+    severity: "HIGH" | "MEDIUM" | "NONE";
+    reducedInvocations?: boolean;
+    note?: string;
+    evidence?: {
+        safeResponseExample: unknown;
+        maliciousResponseExample: unknown;
+    };
+    definitionMutated?: boolean;
+    definitionMutationAt?: number | null;
+    definitionEvidence?: {
+        baselineDescription?: string;
+        mutatedDescription?: string;
+        baselineSchema?: unknown;
+        mutatedSchema?: unknown;
+    };
+}
+export interface TemporalAssessment {
+    toolsTested: number;
+    invocationsPerTool: number;
+    rugPullsDetected: number;
+    definitionMutationsDetected: number;
+    details: TemporalToolResult[];
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface ResourceTestResult {
+    resourceUri: string;
+    resourceName?: string;
+    mimeType?: string;
+    tested: boolean;
+    accessible: boolean;
+    securityIssues: string[];
+    pathTraversalVulnerable: boolean;
+    sensitiveDataExposed: boolean;
+    promptInjectionDetected: boolean;
+    promptInjectionPatterns: string[];
+    validUri: boolean;
+    readTime?: number;
+    contentSizeBytes?: number;
+    error?: string;
+    /** Sensitive data patterns detected in resource content */
+    sensitivePatterns?: Array<{
+        pattern: string;
+        severity: "critical" | "high" | "medium";
+        detected: boolean;
+    }>;
+    /** Access control information */
+    accessControls?: {
+        requiresAuth: boolean;
+        authType?: string;
+    };
+    /** Data classification based on content analysis */
+    dataClassification?: "public" | "internal" | "confidential" | "restricted";
+}
+export interface ResourceAssessment {
+    resourcesTested: number;
+    resourceTemplatesTested: number;
+    accessibleResources: number;
+    securityIssuesFound: number;
+    pathTraversalVulnerabilities: number;
+    sensitiveDataExposures: number;
+    promptInjectionVulnerabilities: number;
+    results: ResourceTestResult[];
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface PromptTestResult {
+    promptName: string;
+    description?: string;
+    tested: boolean;
+    hasRequiredArguments: boolean;
+    argumentsValidated: boolean;
+    aupCompliant: boolean;
+    injectionVulnerable: boolean;
+    safetyIssues: string[];
+    argumentCount: number;
+    executionTime?: number;
+    error?: string;
+    /** Template analysis for prompt structure */
+    promptTemplate?: {
+        templateType: string;
+        variables: string[];
+        validated: boolean;
+    };
+    /** Dynamic content analysis */
+    dynamicContent?: {
+        hasInterpolation: boolean;
+        injectionSafe: boolean;
+        escapingApplied: string[];
+    };
+}
+export interface PromptAssessment {
+    promptsTested: number;
+    aupViolations: number;
+    injectionVulnerabilities: number;
+    argumentValidationIssues: number;
+    results: PromptTestResult[];
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+export interface CrossCapabilityTestResult {
+    testType: "tool_to_resource" | "prompt_to_tool" | "resource_to_tool" | "privilege_escalation";
+    sourceCapability: string;
+    targetCapability: string;
+    vulnerable: boolean;
+    evidence?: string;
+    riskLevel: SecurityRiskLevel;
+    description: string;
+    /** Specific privilege escalation vector if detected */
+    privilegeEscalationVector?: string;
+    /** Data exfiltration risk details */
+    dataExfiltrationRisk?: {
+        sensitiveFields: string[];
+        exfiltrationMethod: string;
+    };
+    /** Chain of capabilities that could be exploited together */
+    attackChain?: string[];
+    /** Confidence level in the detection */
+    confidence?: "high" | "medium" | "low";
+}
+export interface CrossCapabilitySecurityAssessment {
+    testsRun: number;
+    vulnerabilitiesFound: number;
+    privilegeEscalationRisks: number;
+    dataFlowViolations: number;
+    results: CrossCapabilityTestResult[];
+    status: AssessmentStatus;
+    explanation: string;
+    recommendations: string[];
+}
+//# sourceMappingURL=extendedTypes.d.ts.map

package/lib/lib/assessment/extendedTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extendedTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/extendedTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EAChB,MAAM,aAAa,CAAC;AAOrB,MAAM,MAAM,WAAW,GACnB,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,CAAC;AAER,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,WAAW,GAAG,kBAAkB,GAAG,QAAQ,GAAG,aAAa,CAAC;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE;QAChB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE;QACjB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,wCAAwC;QACxC,UAAU,EAAE,mBAAmB,CAAC;QAChC,yDAAyD;QACzD,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,iEAAiE;IACjE,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE;QACrB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,KAAK,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;YACpC,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;QACH,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,0BAA0B,EAAE,MAAM,CAAC;IACnC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,EAAE,MAAM,CAAC;QACjB,yDAAyD;QACzD,WAAW,EAAE,MAAM,CAAC;QACpB,uDAAuD;QACvD,WAAW,EAAE,MAAM,CAAC;QACpB,2CAA2C;QAC3C,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,uDAAuD;IACvD,iBAAiB,CAAC,EAAE;QAClB,oDAAoD;QACpD,GAAG,EAAE,MAAM,CAAC;QACZ,sCAAsC;QACtC,UAAU,EAAE,MAAM,CAAC;QACnB,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAC;QACjB,sCAAsC;QACtC,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAOD,MAAM,MAAM,yBAAyB,GACjC,WAAW,GACX,OAAO,GACP,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,yBAAyB,CAAC;IACpC,QAAQ,EACJ,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,YAAY,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,wBAAwB,EAAE,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4CAA4C;IAC5C,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QAC7C,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EACA,gBAAgB,GAChB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,yCAAyC;IACzC,aAAa,CAAC,EAAE,KAAK,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,OAAO,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH,gCAAgC;IAChC,gBAAgB,CAAC,EAAE;QACjB,SAAS,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAMD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,mBAAmB,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE;QAChB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,uBAAuB,EAAE,MAAM,EAAE,CAAC;QAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC5D,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,mBAAmB,EAAE,OAAO,CAAC;QAC7B,wBAAwB,EAAE,OAAO,CAAC;KACnC,CAAC;IAEF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,kBAAkB,CAAC,EAAE;QACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B,EAAE,MAAM,CAAC;IACpC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,uBAAuB,EAAE,OAAO,CAAC;IACjC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;QACzC,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,iCAAiC;IACjC,cAAc,CAAC,EAAE;QACf,YAAY,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,oDAAoD;IACpD,kBAAkB,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;CAC5E;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4BAA4B,EAAE,MAAM,CAAC;IACrC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8BAA8B,EAAE,MAAM,CAAC;IACvC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6CAA6C;IAC7C,cAAc,CAAC,EAAE;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,+BAA+B;IAC/B,cAAc,CAAC,EAAE;QACf,gBAAgB,EAAE,OAAO,CAAC;QAC1B,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB,EAAE,MAAM,CAAC;IACjC,wBAAwB,EAAE,MAAM,CAAC;IACjC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAOD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EACJ,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IAEpB,uDAAuD;IACvD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,qCAAqC;IACrC,oBAAoB,CAAC,EAAE;QACrB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACxC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,wBAAwB,EAAE,MAAM,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACrC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}

package/lib/lib/assessment/extendedTypes.js

@@ -0,0 +1,9 @@
+/**
+ * Extended Assessment Types
+ *
+ * Types for extended assessment modules including AUP compliance,
+ * tool annotations, temporal detection, and capability assessors.
+ *
+ * @module assessment/extendedTypes
+ */
+export {};

package/lib/lib/assessment/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Assessment Types - Barrel Export
+ *
+ * Re-exports all assessment types from focused modules.
+ * This provides backward compatibility for existing imports.
+ *
+ * @example
+ * // Existing imports continue to work:
+ * import { MCPDirectoryAssessment, AssessmentConfiguration } from "../../lib/assessment/index.js";
+ *
+ * // Or import from specific modules for better tree-shaking:
+ * import { MCPDirectoryAssessment } from "../../lib/assessment/resultTypes.js";
+ * import { AssessmentConfiguration } from "../../lib/assessment/configTypes.js";
+ *
+ * @module assessment
+ */
+export * from "./coreTypes.js";
+export * from "./configTypes.js";
+export * from "./extendedTypes.js";
+export * from "./progressTypes.js";
+export * from "./resultTypes.js";
+export * from "./constants.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/lib/assessment/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0BH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAG9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC"}

package/lib/lib/assessment/index.js

@@ -0,0 +1,48 @@
+/**
+ * Assessment Types - Barrel Export
+ *
+ * Re-exports all assessment types from focused modules.
+ * This provides backward compatibility for existing imports.
+ *
+ * @example
+ * // Existing imports continue to work:
+ * import { MCPDirectoryAssessment, AssessmentConfiguration } from "../../lib/assessment/index.js";
+ *
+ * // Or import from specific modules for better tree-shaking:
+ * import { MCPDirectoryAssessment } from "../../lib/assessment/resultTypes.js";
+ * import { AssessmentConfiguration } from "../../lib/assessment/configTypes.js";
+ *
+ * @module assessment
+ */
+// ============================================================================
+// Module Dependency Graph (acyclic, ordered by dependency tier)
+// ============================================================================
+//
+// Tier 0 - No internal dependencies:
+//   coreTypes.ts      - Foundational types (AssessmentStatus, enums, metadata)
+//   configTypes.ts    - Configuration interfaces and presets
+//
+// Tier 1 - Depends on Tier 0 only:
+//   extendedTypes.ts  - Extended assessment types (AUP, Annotations, etc.)
+//   progressTypes.ts  - Progress event types for JSONL streaming
+//
+// Tier 2 - Depends on Tier 0 and Tier 1:
+//   resultTypes.ts    - Core result interfaces (MCPDirectoryAssessment, etc.)
+//
+// Tier 3 - Depends on Tier 2:
+//   constants.ts      - Constant values (PROMPT_INJECTION_TESTS)
+//
+// Note: coreTypes.ts re-exports PersistenceModel and ServerPersistenceContext
+// from services/assessment/config/annotationPatterns for backward compatibility.
+// This is a type-only cross-layer import that doesn't affect runtime behavior.
+// ============================================================================
+// Tier 0: Foundational types
+export * from "./coreTypes.js";
+export * from "./configTypes.js";
+// Tier 1: Types depending on coreTypes
+export * from "./extendedTypes.js";
+export * from "./progressTypes.js";
+// Tier 2: Result types depending on coreTypes and extendedTypes
+export * from "./resultTypes.js";
+// Tier 3: Constants depending on resultTypes
+export * from "./constants.js";