@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/demo-workspace.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Demo Workspace (W4.1 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Pre-built collection of 25 synthetic agent manifests across the major
+ * frameworks. Used by the no-install demo flow on my-cc.io — prospects can
+ * "Run Demo" without supplying their own code. Every manifest is scan-able
+ * and auto-pack-generatable end-to-end through the W1.7 + W2.3 path.
+ *
+ * Verticals covered: healthcare, finance, legal, retail, manufacturing,
+ * education, devtools, government, hospitality.
+ *
+ * No external dependencies — pure data + a small accessor so this module
+ * bundles cleanly for browser-side demo rendering.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-DEMO-WORKSPACE
+ */
+import type { AgentManifest } from './owasp-agentic-scanner.js';
+export type DemoVertical = 'healthcare' | 'finance' | 'legal' | 'retail' | 'manufacturing' | 'education' | 'devtools' | 'government' | 'hospitality';
+export interface DemoAgent extends AgentManifest {
+    vertical: DemoVertical;
+    framework: 'claude-code' | 'openai-agents' | 'langchain' | 'crew-ai' | 'langgraph' | 'mcp';
+    /** One-line marketing description for the demo card. */
+    description: string;
+    /** Expected build-structure-score band the customer will see post-scan. */
+    expectedScoreBand: 'EXCELLENT' | 'GOOD' | 'NEEDS_REVIEW' | 'POOR' | 'CRITICAL';
+}
+export declare const DEMO_AGENTS: DemoAgent[];
+export interface DemoWorkspace {
+    agents: DemoAgent[];
+    verticals: ReadonlyArray<DemoVertical>;
+}
+export declare function getDemoWorkspace(filter?: {
+    vertical?: DemoVertical;
+}): DemoWorkspace;
+//# sourceMappingURL=demo-workspace.d.ts.map

package/dist/governance/demo-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-workspace.d.ts","sourceRoot":"","sources":["../../src/governance/demo-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,SAAS,GACT,OAAO,GACP,QAAQ,GACR,eAAe,GACf,WAAW,GACX,UAAU,GACV,YAAY,GACZ,aAAa,CAAC;AAElB,MAAM,WAAW,SAAU,SAAQ,aAAa;IAC9C,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,KAAK,CAAC;IAC3F,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,iBAAiB,EAAE,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,MAAM,GAAG,UAAU,CAAC;CAChF;AA2BD,eAAO,MAAM,WAAW,EAAE,SAAS,EA+VlC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACxC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,GAAG,aAAa,CAMpF"}

package/dist/governance/demo-workspace.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * Demo Workspace (W4.1 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Pre-built collection of 25 synthetic agent manifests across the major
+ * frameworks. Used by the no-install demo flow on my-cc.io — prospects can
+ * "Run Demo" without supplying their own code. Every manifest is scan-able
+ * and auto-pack-generatable end-to-end through the W1.7 + W2.3 path.
+ *
+ * Verticals covered: healthcare, finance, legal, retail, manufacturing,
+ * education, devtools, government, hospitality.
+ *
+ * No external dependencies — pure data + a small accessor so this module
+ * bundles cleanly for browser-side demo rendering.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-DEMO-WORKSPACE
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEMO_AGENTS = void 0;
+exports.getDemoWorkspace = getDemoWorkspace;
+const capability_classes_js_1 = require("./capability-classes.js");
+function makeAgent(agentId, vertical, framework, description, fields, expectedScoreBand) {
+    return {
+        agentId,
+        name: agentId,
+        tools: [],
+        hooks: { preToolUse: false, postToolUse: false, postResponse: false },
+        rateLimitsConfigured: false,
+        pluginIntegrityVerified: false,
+        declaredApprovalGates: [],
+        declaredForbiddenCapabilities: [],
+        ...fields,
+        vertical,
+        framework,
+        description,
+        expectedScoreBand,
+    };
+}
+exports.DEMO_AGENTS = [
+    // ---- Healthcare ----
+    makeAgent('hc-claim-summarizer', 'healthcare', 'claude-code', 'Summarizes inbound claims for adjudicator review.', {
+        tools: ['Read', 'WebFetch'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'NEEDS_REVIEW'),
+    makeAgent('hc-phi-router', 'healthcare', 'openai-agents', 'Routes PHI-tagged messages to the correct downstream system.', {
+        tools: ['email_send', 'postgres_query', 'Bash'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    makeAgent('hc-eligibility-bot', 'healthcare', 'claude-code', 'Checks payer eligibility against external APIs.', {
+        tools: ['WebFetch', 'Read', 'Write'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+    }, 'CRITICAL'),
+    // ---- Finance ----
+    makeAgent('fin-fraud-reviewer', 'finance', 'langgraph', 'Reviews fraud alerts and escalates suspicious transactions.', {
+        tools: ['postgres_query', 'kafka_publish', 'email_send'],
+        llmProvider: 'connexum-proxy/anthropic',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+        declaredApprovalGates: [
+            { capability: capability_classes_js_1.CAPABILITY_CLASS.EXTERNAL_DB_WRITE, reviewer: 'fraud-lead' },
+        ],
+    }, 'EXCELLENT'),
+    makeAgent('fin-trade-executor', 'finance', 'openai-agents', 'Executes paper trades against a sandbox broker.', {
+        tools: ['http_post', 'Bash', 'postgres_query'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    makeAgent('fin-treasury-bot', 'finance', 'crew-ai', 'Tracks daily cash positions and posts treasury reports.', {
+        tools: ['postgres_query', 'Write', 'email_send'],
+        llmProvider: 'connexum-proxy/openai',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: false },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'CRITICAL'),
+    // ---- Legal ----
+    makeAgent('lg-discovery-bot', 'legal', 'langchain', 'E-discovery: surfaces relevant documents across litigation corpora.', {
+        tools: ['vector_search', 'Read'],
+        llmProvider: 'connexum-proxy/anthropic',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'GOOD'),
+    makeAgent('lg-contract-redliner', 'legal', 'openai-agents', 'Redlines contract drafts against the firm standard playbook.', {
+        tools: ['Read', 'Edit', 'WebFetch'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    // ---- Retail ----
+    makeAgent('re-pricing-bot', 'retail', 'crew-ai', 'Adjusts SKU prices nightly based on competitor scraping.', {
+        tools: ['WebFetch', 'postgres_query', 'Bash'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    makeAgent('re-customer-care', 'retail', 'claude-code', 'Triage customer-care tickets via chat history.', {
+        tools: ['Read', 'email_send'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'NEEDS_REVIEW'),
+    // ---- Manufacturing ----
+    makeAgent('mf-yield-analyzer', 'manufacturing', 'langgraph', 'Analyses sensor telemetry for yield-loss patterns.', {
+        tools: ['postgres_query', 'Write'],
+        llmProvider: 'connexum-proxy/anthropic',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'CRITICAL'),
+    makeAgent('mf-mes-writer', 'manufacturing', 'openai-agents', 'Writes MES override flags during shift changes.', {
+        tools: ['postgres_query', 'Bash'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    // ---- Education ----
+    makeAgent('ed-grading-assistant', 'education', 'claude-code', 'Pre-grades short-answer responses for instructor review.', {
+        tools: ['Read', 'Write'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: false, postResponse: true },
+    }, 'CRITICAL'),
+    makeAgent('ed-tutor-bot', 'education', 'crew-ai', 'One-to-one tutoring conversations with curriculum binding.', {
+        tools: ['vector_search', 'Read'],
+        llmProvider: 'connexum-proxy/openai',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'GOOD'),
+    // ---- DevTools ----
+    makeAgent('dt-incident-responder', 'devtools', 'claude-code', 'Pages on-call and drafts incident retrospectives.', {
+        tools: ['Bash', 'http_post', 'Write'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        declaredApprovalGates: [
+            { capability: capability_classes_js_1.CAPABILITY_CLASS.SHELL_EXEC, reviewer: 'sre-on-call' },
+        ],
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'NEEDS_REVIEW'),
+    makeAgent('dt-code-reviewer', 'devtools', 'openai-agents', 'Reviews PRs for the engineering team.', {
+        tools: ['Read', 'WebFetch', 'Write'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    makeAgent('dt-deploy-bot', 'devtools', 'langchain', 'Promotes builds from staging to production.', {
+        tools: ['Bash', 'http_post'],
+        llmProvider: 'langchain',
+    }, 'CRITICAL'),
+    // ---- Government ----
+    makeAgent('gov-foia-handler', 'government', 'claude-code', 'Redacts FOIA responses against PII rules.', {
+        tools: ['Read', 'Write'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+        declaredForbiddenCapabilities: [capability_classes_js_1.CAPABILITY_CLASS.NETWORK_EGRESS],
+    }, 'NEEDS_REVIEW'),
+    makeAgent('gov-benefits-screener', 'government', 'crew-ai', 'Pre-screens benefits applications for case workers.', {
+        tools: ['postgres_query', 'Read'],
+        llmProvider: 'connexum-proxy/anthropic',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'NEEDS_REVIEW'),
+    // ---- Hospitality ----
+    makeAgent('hp-reservations-bot', 'hospitality', 'openai-agents', 'Handles booking modifications across channel-managers.', {
+        tools: ['http_post', 'postgres_query'],
+        llmProvider: 'openai/agents-sdk',
+    }, 'CRITICAL'),
+    // ---- Cross-vertical MCP-heavy agents ----
+    makeAgent('shared-mcp-orchestrator', 'devtools', 'mcp', 'Generic MCP orchestrator wiring multiple MCP servers together.', {
+        tools: ['mcp__github', 'mcp__filesystem', 'mcp__postgres'],
+        mcpServers: ['stdio:mcp-server-github', 'stdio:mcp-server-fs', 'stdio:mcp-server-postgres'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: false, postResponse: false },
+    }, 'CRITICAL'),
+    makeAgent('shared-rag-retriever', 'finance', 'langchain', 'RAG retriever that hits internal vector store and external APIs.', {
+        tools: ['vector_search', 'WebFetch'],
+        llmProvider: 'connexum-proxy/openai',
+        hooks: { preToolUse: true, postToolUse: false, postResponse: true },
+    }, 'CRITICAL'),
+    makeAgent('shared-summarizer', 'education', 'openai-agents', 'Pure text summarizer — no tools, just LLM reasoning.', {
+        tools: [],
+        llmProvider: 'connexum-proxy/openai',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+        declaredForbiddenCapabilities: [
+            capability_classes_js_1.CAPABILITY_CLASS.MCP,
+            capability_classes_js_1.CAPABILITY_CLASS.WEB_FETCH,
+            capability_classes_js_1.CAPABILITY_CLASS.SHELL_EXEC,
+            capability_classes_js_1.CAPABILITY_CLASS.FILESYSTEM_WRITE,
+            capability_classes_js_1.CAPABILITY_CLASS.EXTERNAL_DB_WRITE,
+        ],
+    }, 'EXCELLENT'),
+    makeAgent('shared-classifier', 'retail', 'crew-ai', 'Tags inbound messages by intent.', {
+        tools: ['Read'],
+        llmProvider: 'connexum-proxy/anthropic',
+        hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+        pluginIntegrityVerified: true,
+        rateLimitsConfigured: true,
+    }, 'GOOD'),
+    makeAgent('shared-archive-bot', 'legal', 'claude-code', 'Archives closed matters to cold storage.', {
+        tools: ['Read', 'Write', 'Bash'],
+        llmProvider: 'anthropic/claude-code',
+        hooks: { preToolUse: true, postToolUse: false, postResponse: false },
+    }, 'CRITICAL'),
+];
+function getDemoWorkspace(filter) {
+    const agents = filter?.vertical
+        ? exports.DEMO_AGENTS.filter((a) => a.vertical === filter.vertical)
+        : [...exports.DEMO_AGENTS];
+    const verticals = Array.from(new Set(agents.map((a) => a.vertical))).sort();
+    return { agents, verticals };
+}
+//# sourceMappingURL=demo-workspace.js.map

package/dist/governance/demo-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-workspace.js","sourceRoot":"","sources":["../../src/governance/demo-workspace.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwZH,4CAMC;AA3ZD,mEAA2D;AAsB3D,SAAS,SAAS,CAChB,OAAe,EACf,QAAsB,EACtB,SAAiC,EACjC,WAAmB,EACnB,MAA8B,EAC9B,iBAAiD;IAEjD,OAAO;QACL,OAAO;QACP,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;QACrE,oBAAoB,EAAE,KAAK;QAC3B,uBAAuB,EAAE,KAAK;QAC9B,qBAAqB,EAAE,EAAE;QACzB,6BAA6B,EAAE,EAAE;QACjC,GAAG,MAAM;QACT,QAAQ;QACR,SAAS;QACT,WAAW;QACX,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAEY,QAAA,WAAW,GAAgB;IACtC,uBAAuB;IACvB,SAAS,CACP,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,mDAAmD,EACnD;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC3B,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,cAAc,CACf;IACD,SAAS,CACP,eAAe,EACf,YAAY,EACZ,eAAe,EACf,8DAA8D,EAC9D;QACE,KAAK,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC;QAC/C,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IACD,SAAS,CACP,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,iDAAiD,EACjD;QACE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;QACpC,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;KACnE,EACD,UAAU,CACX;IAED,oBAAoB;IACpB,SAAS,CACP,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,6DAA6D,EAC7D;QACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,YAAY,CAAC;QACxD,WAAW,EAAE,0BAA0B;QACvC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE;YACrB,EAAE,UAAU,EAAE,wCAAgB,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC3E;KACF,EACD,WAAW,CACZ;IACD,SAAS,CACP,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,iDAAiD,EACjD;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC;QAC9C,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IACD,SAAS,CACP,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,yDAAyD,EACzD;QACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,OAAO,EAAE,YAAY,CAAC;QAChD,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;QACnE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,UAAU,CACX;IAED,kBAAkB;IAClB,SAAS,CACP,kBAAkB,EAClB,OAAO,EACP,WAAW,EACX,qEAAqE,EACrE;QACE,KAAK,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC;QAChC,WAAW,EAAE,0BAA0B;QACvC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,MAAM,CACP;IACD,SAAS,CACP,sBAAsB,EACtB,OAAO,EACP,eAAe,EACf,8DAA8D,EAC9D;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QACnC,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IAED,mBAAmB;IACnB,SAAS,CACP,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,0DAA0D,EAC1D;QACE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC;QAC7C,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IACD,SAAS,CACP,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,gDAAgD,EAChD;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;QAC7B,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,cAAc,CACf;IAED,0BAA0B;IAC1B,SAAS,CACP,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,oDAAoD,EACpD;QACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAClC,WAAW,EAAE,0BAA0B;QACvC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,UAAU,CACX;IACD,SAAS,CACP,eAAe,EACf,eAAe,EACf,eAAe,EACf,iDAAiD,EACjD;QACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IAED,sBAAsB;IACtB,SAAS,CACP,sBAAsB,EACtB,WAAW,EACX,aAAa,EACb,0DAA0D,EAC1D;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE;KACpE,EACD,UAAU,CACX;IACD,SAAS,CACP,cAAc,EACd,WAAW,EACX,SAAS,EACT,4DAA4D,EAC5D;QACE,KAAK,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC;QAChC,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,MAAM,CACP;IAED,qBAAqB;IACrB,SAAS,CACP,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,mDAAmD,EACnD;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC;QACrC,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,qBAAqB,EAAE;YACrB,EAAE,UAAU,EAAE,wCAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE;SACrE;QACD,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,cAAc,CACf;IACD,SAAS,CACP,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,uCAAuC,EACvC;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC;QACpC,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IACD,SAAS,CACP,eAAe,EACf,UAAU,EACV,WAAW,EACX,6CAA6C,EAC7C;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5B,WAAW,EAAE,WAAW;KACzB,EACD,UAAU,CACX;IAED,uBAAuB;IACvB,SAAS,CACP,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,2CAA2C,EAC3C;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;QAC1B,6BAA6B,EAAE,CAAC,wCAAgB,CAAC,cAAc,CAAC;KACjE,EACD,cAAc,CACf;IACD,SAAS,CACP,uBAAuB,EACvB,YAAY,EACZ,SAAS,EACT,qDAAqD,EACrD;QACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,0BAA0B;QACvC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,cAAc,CACf;IAED,wBAAwB;IACxB,SAAS,CACP,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,wDAAwD,EACxD;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACtC,WAAW,EAAE,mBAAmB;KACjC,EACD,UAAU,CACX;IAED,4CAA4C;IAC5C,SAAS,CACP,yBAAyB,EACzB,UAAU,EACV,KAAK,EACL,gEAAgE,EAChE;QACE,KAAK,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,eAAe,CAAC;QAC1D,UAAU,EAAE,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,2BAA2B,CAAC;QAC3F,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;KACrE,EACD,UAAU,CACX;IACD,SAAS,CACP,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,kEAAkE,EAClE;QACE,KAAK,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;QACpC,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE;KACpE,EACD,UAAU,CACX;IACD,SAAS,CACP,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,sDAAsD,EACtD;QACE,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;QAC1B,6BAA6B,EAAE;YAC7B,wCAAgB,CAAC,GAAG;YACpB,wCAAgB,CAAC,SAAS;YAC1B,wCAAgB,CAAC,UAAU;YAC3B,wCAAgB,CAAC,gBAAgB;YACjC,wCAAgB,CAAC,iBAAiB;SACnC;KACF,EACD,WAAW,CACZ;IACD,SAAS,CACP,mBAAmB,EACnB,QAAQ,EACR,SAAS,EACT,kCAAkC,EAClC;QACE,KAAK,EAAE,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,0BAA0B;QACvC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,EACD,MAAM,CACP;IACD,SAAS,CACP,oBAAoB,EACpB,OAAO,EACP,aAAa,EACb,0CAA0C,EAC1C;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;QAChC,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;KACrE,EACD,UAAU,CACX;CACF,CAAC;AAOF,SAAgB,gBAAgB,CAAC,MAAoC;IACnE,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ;QAC7B,CAAC,CAAC,mBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC;QAC3D,CAAC,CAAC,CAAC,GAAG,mBAAW,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}

package/dist/governance/demo-workspace.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-DEMO-WORKSPACE (W4.1).
+ *
+ * Validates the demo fixtures are scan-able, auto-pack-generatable, and
+ * their expectedScoreBand annotations reflect the real OWASP scanner output
+ * (drift-protection — if scanner severity penalties change, this test
+ * catches the mismatch).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-DEMO-WORKSPACE
+ */
+export {};
+//# sourceMappingURL=demo-workspace.test.d.ts.map

package/dist/governance/demo-workspace.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-workspace.test.d.ts","sourceRoot":"","sources":["../../src/governance/demo-workspace.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/governance/demo-workspace.test.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-DEMO-WORKSPACE (W4.1).
+ *
+ * Validates the demo fixtures are scan-able, auto-pack-generatable, and
+ * their expectedScoreBand annotations reflect the real OWASP scanner output
+ * (drift-protection — if scanner severity penalties change, this test
+ * catches the mismatch).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-DEMO-WORKSPACE
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const demo_workspace_1 = require("./demo-workspace");
+const owasp_agentic_scanner_1 = require("./owasp-agentic-scanner");
+const auto_pack_generator_1 = require("./auto-pack-generator");
+(0, node_test_1.describe)('F-NEW-PRODUCT-DEMO-WORKSPACE (W4.1)', () => {
+    (0, node_test_1.it)('ships exactly 25 demo agents', () => {
+        assert.equal(demo_workspace_1.DEMO_AGENTS.length, 25);
+    });
+    (0, node_test_1.it)('covers at least 8 distinct verticals', () => {
+        const verticals = new Set(demo_workspace_1.DEMO_AGENTS.map((a) => a.vertical));
+        assert.ok(verticals.size >= 8);
+    });
+    (0, node_test_1.it)('every agent has a unique agentId', () => {
+        const ids = new Set(demo_workspace_1.DEMO_AGENTS.map((a) => a.agentId));
+        assert.equal(ids.size, demo_workspace_1.DEMO_AGENTS.length);
+    });
+    (0, node_test_1.it)('every agent scans without throwing', () => {
+        for (const agent of demo_workspace_1.DEMO_AGENTS) {
+            const report = (0, owasp_agentic_scanner_1.scanAgent)(agent);
+            assert.ok(report.findings, `${agent.agentId} produces findings array`);
+            assert.ok(report.buildStructureScore >= 0 && report.buildStructureScore <= 100);
+        }
+    });
+    (0, node_test_1.it)('every agent auto-pack-generates without throwing', () => {
+        for (const agent of demo_workspace_1.DEMO_AGENTS) {
+            const result = (0, auto_pack_generator_1.autoGenerateCompanyPack)(agent, { acceptAllSuggestedRules: true });
+            assert.ok(result.pack.id.startsWith('auto-pack-'));
+            assert.ok(result.scanReport.findings.length >= 0);
+        }
+    });
+    (0, node_test_1.it)('expectedScoreBand annotations match the OWASP scanner output', () => {
+        const mismatches = [];
+        for (const agent of demo_workspace_1.DEMO_AGENTS) {
+            const report = (0, owasp_agentic_scanner_1.scanAgent)(agent);
+            if (report.verdict !== agent.expectedScoreBand) {
+                mismatches.push({
+                    agentId: agent.agentId,
+                    expected: agent.expectedScoreBand,
+                    actual: report.verdict,
+                });
+            }
+        }
+        assert.deepEqual(mismatches, [], `Demo agents have stale expectedScoreBand annotations: ${JSON.stringify(mismatches, null, 2)}`);
+    });
+    (0, node_test_1.it)('at least one EXCELLENT, one CRITICAL, and one NEEDS_REVIEW agent exists in the demo', () => {
+        const bands = new Set(demo_workspace_1.DEMO_AGENTS.map((a) => a.expectedScoreBand));
+        assert.ok(bands.has('EXCELLENT'));
+        assert.ok(bands.has('CRITICAL'));
+        assert.ok(bands.has('NEEDS_REVIEW'));
+    });
+    (0, node_test_1.it)('getDemoWorkspace() returns all agents and unique verticals', () => {
+        const w = (0, demo_workspace_1.getDemoWorkspace)();
+        assert.equal(w.agents.length, demo_workspace_1.DEMO_AGENTS.length);
+        assert.ok(w.verticals.length >= 8);
+    });
+    (0, node_test_1.it)('getDemoWorkspace({ vertical: "healthcare" }) filters correctly', () => {
+        const w = (0, demo_workspace_1.getDemoWorkspace)({ vertical: 'healthcare' });
+        assert.ok(w.agents.length > 0);
+        assert.ok(w.agents.every((a) => a.vertical === 'healthcare'));
+    });
+    (0, node_test_1.it)('demo includes representative frameworks', () => {
+        const frameworks = new Set(demo_workspace_1.DEMO_AGENTS.map((a) => a.framework));
+        assert.ok(frameworks.has('claude-code'));
+        assert.ok(frameworks.has('openai-agents'));
+        assert.ok(frameworks.has('langchain'));
+        assert.ok(frameworks.has('crew-ai'));
+    });
+});
+//# sourceMappingURL=demo-workspace.test.js.map

package/dist/governance/demo-workspace.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-workspace.test.js","sourceRoot":"","sources":["../../src/governance/demo-workspace.test.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,qDAAiF;AACjF,mEAAoD;AACpD,+DAAgE;AAEhE,IAAA,oBAAQ,EAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAA,cAAE,EAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,4BAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,4BAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,4BAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,KAAK,MAAM,KAAK,IAAI,4BAAW,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,iCAAS,EAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;YACvE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,KAAK,MAAM,KAAK,IAAI,4BAAW,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,6CAAuB,EAAC,KAAK,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,UAAU,GAAiE,EAAE,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,4BAAW,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,iCAAS,EAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC/C,UAAU,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,iBAAiB;oBACjC,MAAM,EAAE,MAAM,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,CAAC,SAAS,CACd,UAAU,EACV,EAAE,EACF,yDAAyD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,4BAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,IAAA,iCAAgB,GAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,4BAAW,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,GAAG,IAAA,iCAAgB,EAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,4BAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/discovery-cli.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Discovery CLI Runner — closes the customer-facing loop.
+ *
+ * Wires together (all already shipped):
+ *   W2.1 discoverAgents             — walk the project, build manifests
+ *   signed-manifest helper          — Ed25519 + canonical JSON
+ *   ManifestPushEmitter             — POST with retry on transient failures
+ *
+ * Customer invocation pattern (final binary lives in bin/discover.ts which
+ * imports runDiscoveryCli; this module stays pure / testable):
+ *
+ *   npx @connexum/ai-governance discover \
+ *       --root ./my-project \
+ *       --org-id my-org \
+ *       --key /etc/connexum/org-private-key.pem \
+ *       --endpoint https://proxy.my-cc.io/api/v1/manifests
+ *
+ * @connexum/ai-governance  W2.1 + push transport binary
+ */
+import * as crypto from 'node:crypto';
+import { type DiscoveryOptions } from './agent-discovery.js';
+import { type PushResult } from './manifest-push-emitter.js';
+import type { AgentManifest } from './owasp-agentic-scanner.js';
+import type { HttpsTransport } from './approval-channel-adapters.js';
+export interface DiscoveryCliInput {
+    rootDir: string;
+    orgId: string;
+    privateKey: crypto.KeyObject;
+    endpoint: string;
+    /** Pass-through to discoverAgents. */
+    discovery?: DiscoveryOptions;
+    /** Injectable transport for tests. */
+    transport?: HttpsTransport;
+    /** Injectable sleep for tests. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Override maxRetries on push. */
+    maxRetries?: number;
+    /** If true, skip the network push and return manifests only (dry-run). */
+    dryRun?: boolean;
+}
+export interface AgentPushReport {
+    manifest: AgentManifest;
+    push: PushResult | null;
+}
+export interface DiscoveryCliResult {
+    rootDir: string;
+    agentCount: number;
+    successCount: number;
+    failureCount: number;
+    reports: AgentPushReport[];
+    /** Aggregate flag — true when every manifest pushed successfully. */
+    ok: boolean;
+}
+/**
+ * Pure runnable surface: discover -> for each -> push -> aggregate.
+ */
+export declare function runDiscoveryCli(input: DiscoveryCliInput): Promise<DiscoveryCliResult>;
+/**
+ * Format a CLI result as a human-readable text report (for stdout).
+ * Browser-bundleable; no node-builtin imports.
+ */
+export declare function formatCliReport(result: DiscoveryCliResult): string;
+//# sourceMappingURL=discovery-cli.d.ts.map

package/dist/governance/discovery-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cli.d.ts","sourceRoot":"","sources":["../../src/governance/discovery-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,sCAAsC;IACtC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,kCAAkC;IAClC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,qEAAqE;IACrE,EAAE,EAAE,OAAO,CAAC;CACb;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuD3F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAiBlE"}

package/dist/governance/discovery-cli.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Discovery CLI Runner — closes the customer-facing loop.
+ *
+ * Wires together (all already shipped):
+ *   W2.1 discoverAgents             — walk the project, build manifests
+ *   signed-manifest helper          — Ed25519 + canonical JSON
+ *   ManifestPushEmitter             — POST with retry on transient failures
+ *
+ * Customer invocation pattern (final binary lives in bin/discover.ts which
+ * imports runDiscoveryCli; this module stays pure / testable):
+ *
+ *   npx @connexum/ai-governance discover \
+ *       --root ./my-project \
+ *       --org-id my-org \
+ *       --key /etc/connexum/org-private-key.pem \
+ *       --endpoint https://proxy.my-cc.io/api/v1/manifests
+ *
+ * @connexum/ai-governance  W2.1 + push transport binary
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDiscoveryCli = runDiscoveryCli;
+exports.formatCliReport = formatCliReport;
+const agent_discovery_js_1 = require("./agent-discovery.js");
+const manifest_push_emitter_js_1 = require("./manifest-push-emitter.js");
+/**
+ * Pure runnable surface: discover -> for each -> push -> aggregate.
+ */
+async function runDiscoveryCli(input) {
+    if (!input.rootDir || input.rootDir.trim() === '') {
+        throw new Error('runDiscoveryCli: rootDir is required');
+    }
+    if (!input.orgId || input.orgId.trim() === '') {
+        throw new Error('runDiscoveryCli: orgId is required');
+    }
+    if (!input.endpoint || input.endpoint.trim() === '') {
+        throw new Error('runDiscoveryCli: endpoint is required');
+    }
+    const manifests = (0, agent_discovery_js_1.discoverAgents)(input.rootDir, input.discovery);
+    const reports = [];
+    if (input.dryRun) {
+        for (const manifest of manifests) {
+            reports.push({ manifest, push: null });
+        }
+        return {
+            rootDir: input.rootDir,
+            agentCount: manifests.length,
+            successCount: 0,
+            failureCount: 0,
+            reports,
+            ok: true,
+        };
+    }
+    const emitter = new manifest_push_emitter_js_1.ManifestPushEmitter({
+        orgId: input.orgId,
+        privateKey: input.privateKey,
+        endpoint: input.endpoint,
+        transport: input.transport,
+        sleep: input.sleep,
+        maxRetries: input.maxRetries,
+    });
+    let successCount = 0;
+    let failureCount = 0;
+    for (const manifest of manifests) {
+        const push = await emitter.push(manifest);
+        reports.push({ manifest, push });
+        if (push.ok)
+            successCount += 1;
+        else
+            failureCount += 1;
+    }
+    return {
+        rootDir: input.rootDir,
+        agentCount: manifests.length,
+        successCount,
+        failureCount,
+        reports,
+        ok: failureCount === 0,
+    };
+}
+/**
+ * Format a CLI result as a human-readable text report (for stdout).
+ * Browser-bundleable; no node-builtin imports.
+ */
+function formatCliReport(result) {
+    const lines = [];
+    lines.push(`Connexum Discovery — ${result.rootDir}`);
+    lines.push(`Found ${result.agentCount} agent${result.agentCount === 1 ? '' : 's'}. ` +
+        `Pushed ${result.successCount} ok, ${result.failureCount} failed.`);
+    lines.push('');
+    for (const r of result.reports) {
+        const m = r.manifest;
+        const status = r.push === null ? '[DRY-RUN]' : r.push.ok ? '[OK]' : '[FAIL]';
+        lines.push(`${status}  ${m.agentId.padEnd(40)}  tools=${m.tools.length}  ` +
+            (r.push?.receiptId ? `receipt=${r.push.receiptId}` : r.push?.error ?? ''));
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=discovery-cli.js.map

package/dist/governance/discovery-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cli.js","sourceRoot":"","sources":["../../src/governance/discovery-cli.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AA2CH,0CAuDC;AAMD,0CAiBC;AAtHD,6DAA6E;AAC7E,yEAAkF;AAoClF;;GAEG;AACI,KAAK,UAAU,eAAe,CAAC,KAAwB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,mCAAc,EAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,SAAS,CAAC,MAAM;YAC5B,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,OAAO;YACP,EAAE,EAAE,IAAI;SACT,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,8CAAmB,CAAC;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,EAAE;YAAE,YAAY,IAAI,CAAC,CAAC;;YAC1B,YAAY,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,SAAS,CAAC,MAAM;QAC5B,YAAY;QACZ,YAAY;QACZ,OAAO;QACP,EAAE,EAAE,YAAY,KAAK,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAA0B;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CACR,SAAS,MAAM,CAAC,UAAU,SAAS,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACvE,UAAU,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,YAAY,UAAU,CACrE,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI;YAC7D,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/governance/discovery-cli.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RED-GREEN tests for the discovery CLI runner.
+ *
+ * @connexum/ai-governance  discovery-cli (W2.1 + push transport binary)
+ */
+export {};
+//# sourceMappingURL=discovery-cli.test.d.ts.map

package/dist/governance/discovery-cli.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cli.test.d.ts","sourceRoot":"","sources":["../../src/governance/discovery-cli.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}