@n8r/surface 0.1.0-experimental.2 → 0.1.0-experimental.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (118) hide show
  1. package/README.md +30 -4
  2. package/dist/cli.js +174 -22
  3. package/dist/codec.d.ts +2 -0
  4. package/dist/codec.js +22 -7
  5. package/dist/codex.d.ts +1 -1
  6. package/dist/codex.js +26 -10
  7. package/dist/contracts.d.ts +108 -2
  8. package/dist/cyclonedx-schemas/bom-1.7.schema.json +6700 -0
  9. package/dist/cyclonedx-schemas/cryptography-defs.schema.json +576 -0
  10. package/dist/cyclonedx-schemas/jsf-0.82.schema.json +240 -0
  11. package/dist/cyclonedx-schemas/spdx.schema.json +786 -0
  12. package/dist/cyclonedx-validation.d.ts +1 -0
  13. package/dist/cyclonedx-validation.js +45 -0
  14. package/dist/html.js +27 -3
  15. package/dist/recent.d.ts +9 -0
  16. package/dist/recent.js +71 -0
  17. package/dist/revisions.js +42 -0
  18. package/dist/skill-artifacts-cli.d.ts +1 -0
  19. package/dist/skill-artifacts-cli.js +13 -0
  20. package/dist/skill-artifacts.d.ts +15 -0
  21. package/dist/skill-artifacts.js +184 -0
  22. package/dist/skill-cyclonedx.d.ts +26 -0
  23. package/dist/skill-cyclonedx.js +214 -0
  24. package/dist/skill-presentation.d.ts +10 -0
  25. package/dist/skill-presentation.js +108 -0
  26. package/dist/skill-surface-cli.d.ts +1 -0
  27. package/dist/skill-surface-cli.js +37 -0
  28. package/dist/skill-surface-store.d.ts +7 -0
  29. package/dist/skill-surface-store.js +126 -0
  30. package/dist/surface-bom.d.ts +73 -0
  31. package/dist/surface-bom.js +139 -0
  32. package/dist/surface-draft.d.ts +6 -3
  33. package/dist/surface-draft.js +20 -3
  34. package/dist/surface-instructions.d.ts +2 -1
  35. package/dist/surface-instructions.js +10 -1
  36. package/dist/surface-overview.d.ts +15 -0
  37. package/dist/surface-overview.js +86 -0
  38. package/dist/surface-store.d.ts +5 -7
  39. package/dist/surface-store.js +34 -2
  40. package/dist/surface-view.d.ts +3 -0
  41. package/dist/surface-view.js +50 -0
  42. package/dist/validate.js +298 -0
  43. package/docs/n8r-surface/cli-bundles.md +72 -0
  44. package/docs/n8r-surface/command-outcomes.md +151 -4
  45. package/docs/n8r-surface/contracts.md +10 -0
  46. package/docs/n8r-surface/critical-path.md +21 -0
  47. package/docs/n8r-surface/first-use-access.md +143 -0
  48. package/docs/n8r-surface/first-use-overview.md +262 -0
  49. package/docs/n8r-surface/getting-started.md +55 -88
  50. package/docs/n8r-surface/guided-journey-verification.md +137 -0
  51. package/docs/n8r-surface/implementation-decisions.md +14 -14
  52. package/docs/n8r-surface/instance-first-research.md +209 -0
  53. package/docs/n8r-surface/npm-distribution.md +39 -69
  54. package/docs/n8r-surface/npm-release.md +141 -14
  55. package/docs/n8r-surface/product-direction.md +327 -0
  56. package/docs/n8r-surface/researcher-skill.md +105 -51
  57. package/docs/n8r-surface/security-assurance-strategy.md +267 -0
  58. package/docs/n8r-surface/skill-bom-verification.md +142 -0
  59. package/docs/n8r-surface/skill-cyclonedx-verification.md +144 -0
  60. package/docs/n8r-surface/skill-cyclonedx.md +85 -0
  61. package/docs/n8r-surface/skill-manual.md +129 -0
  62. package/docs/n8r-surface/skill-surface-artifacts.md +234 -0
  63. package/docs/n8r-surface/skill-usefulness-verification.md +135 -0
  64. package/docs/n8r-surface/skill-workspace-automation.md +359 -0
  65. package/docs/n8r-surface/surface-description-contract.md +224 -0
  66. package/docs/n8r-surface/surface-descriptions.md +173 -0
  67. package/docs/n8r-surface/surface-relationships.md +231 -0
  68. package/docs/n8r-surface/tester-candidate.md +158 -0
  69. package/docs/n8r-surface/versioning.md +55 -66
  70. package/docs/n8r-surface/workspace-human-check.md +101 -0
  71. package/docs/n8r-surface/workspace-installation.md +68 -0
  72. package/docs/n8r-surface/workspace-verification.md +350 -0
  73. package/docs/n8r-surface/workspace.md +83 -0
  74. package/examples/researcher/README.md +8 -0
  75. package/examples/researcher/cyclonedx/configured/README.md +7 -0
  76. package/examples/researcher/cyclonedx/configured/manifest.json +10 -0
  77. package/examples/researcher/cyclonedx/configured/mapping.json +323 -0
  78. package/examples/researcher/cyclonedx/configured/surface-records.json +1275 -0
  79. package/examples/researcher/cyclonedx/configured/surface.cdx.json +79 -0
  80. package/examples/researcher/descriptions/README.md +29 -0
  81. package/examples/researcher/descriptions/bound-r1.json +141 -0
  82. package/examples/researcher/descriptions/bound-r2.json +153 -0
  83. package/examples/researcher/descriptions/capability.json +167 -0
  84. package/examples/researcher/descriptions/research-r1.json +153 -0
  85. package/examples/researcher/descriptions/research-r2.json +157 -0
  86. package/examples/researcher/descriptions/sources.md +24 -0
  87. package/examples/researcher/relationships/README.md +34 -0
  88. package/examples/researcher/relationships/bound-r1.json +346 -0
  89. package/examples/researcher/relationships/bound-r2.json +358 -0
  90. package/examples/researcher/relationships/capability.json +325 -0
  91. package/examples/researcher/relationships/config/assistant.env.example +4 -0
  92. package/examples/researcher/relationships/research-r1.json +300 -0
  93. package/examples/researcher/relationships/research-r2.json +304 -0
  94. package/examples/researcher/relationships/sources.md +38 -0
  95. package/examples/researcher/surface-bom/README.md +17 -0
  96. package/examples/researcher/surface-bom/initial.cdx.json +188 -0
  97. package/package.json +1 -1
  98. package/plugins/n8r-surface/.codex-plugin/plugin.json +2 -2
  99. package/plugins/n8r-surface/LICENSING.md +3 -0
  100. package/plugins/n8r-surface/plugin.json +2 -2
  101. package/plugins/n8r-surface/skills/research/SKILL.md +79 -38
  102. package/plugins/n8r-surface/skills/research/references/artifacts.md +152 -0
  103. package/plugins/n8r-surface/skills/research/references/cyclonedx.md +207 -0
  104. package/plugins/n8r-surface/skills/research/references/discovery-map.md +20 -2
  105. package/plugins/n8r-surface/skills/research/references/examples/bound-r1.json +346 -0
  106. package/plugins/n8r-surface/skills/research/references/examples/capability.json +325 -0
  107. package/plugins/n8r-surface/skills/research/references/examples/research-r1.json +300 -0
  108. package/plugins/n8r-surface/skills/research/references/examples/surface.cdx.json +188 -0
  109. package/plugins/n8r-surface/skills/research/references/first-use-access.md +97 -0
  110. package/plugins/n8r-surface/skills/research/references/first-use-overview.md +101 -0
  111. package/plugins/n8r-surface/skills/research/references/instance-first.md +125 -0
  112. package/plugins/n8r-surface/skills/research/references/working-notes.md +6 -1
  113. package/plugins/n8r-surface/skills/research/references/workspace.md +89 -0
  114. package/plugins/n8r-surface/skills/research/scripts/THIRD-PARTY-NOTICES.txt +273 -0
  115. package/plugins/n8r-surface/skills/research/scripts/artifacts.mjs +8348 -0
  116. package/plugins/n8r-surface/skills/research/scripts/cyclonedx.mjs +28113 -0
  117. package/plugins/n8r-surface/skills/research/scripts/surface.mjs +27800 -0
  118. package/plugins/n8r-surface/skills/research/scripts/workspace.mjs +120 -0
@@ -0,0 +1,153 @@
1
+ {
2
+ "id": "urn:demo:research",
3
+ "title": "Synthetic capability and binding evidence",
4
+ "scope": "Synthetic role/product identities only; runtime unverified.",
5
+ "revision": {
6
+ "id": "r1",
7
+ "parent": null,
8
+ "createdAt": "2026-11-08T00:00:00Z",
9
+ "author": "Synthetic author",
10
+ "reason": "Initial synthetic example"
11
+ },
12
+ "extensions": {},
13
+ "contract": "n8r.research/0.1",
14
+ "sources": [
15
+ {
16
+ "id": "urn:source:summary",
17
+ "location": "sources.md",
18
+ "version": "synthetic-1",
19
+ "digest": "sha256:892be031542be26860afe70102a0293aa30b6cfaf15d091e95549c0e11277e49",
20
+ "inspectedAt": "2026-11-08T00:00:00Z",
21
+ "coverage": [
22
+ {
23
+ "path": "sources.md",
24
+ "status": "inspected",
25
+ "note": "Sanitized synthetic source pack, not raw configuration."
26
+ }
27
+ ]
28
+ }
29
+ ],
30
+ "findings": [
31
+ {
32
+ "id": "urn:f:database",
33
+ "subject": "urn:node:app",
34
+ "property": "supports",
35
+ "state": "known",
36
+ "note": "Synthetic source assertion; not runtime evidence.",
37
+ "claims": [
38
+ {
39
+ "value": "urn:node:mongodb",
40
+ "evidence": [
41
+ {
42
+ "source": "urn:source:summary",
43
+ "locator": "Product guide"
44
+ }
45
+ ]
46
+ }
47
+ ]
48
+ },
49
+ {
50
+ "id": "urn:f:oidc",
51
+ "subject": "urn:node:app",
52
+ "property": "supports",
53
+ "state": "known",
54
+ "note": "Synthetic source assertion; not runtime evidence.",
55
+ "claims": [
56
+ {
57
+ "value": "urn:node:oidc",
58
+ "evidence": [
59
+ {
60
+ "source": "urn:source:summary",
61
+ "locator": "Product guide"
62
+ }
63
+ ]
64
+ }
65
+ ]
66
+ },
67
+ {
68
+ "id": "urn:f:saml",
69
+ "subject": "urn:node:app",
70
+ "property": "supports",
71
+ "state": "known",
72
+ "note": "Synthetic source assertion; not runtime evidence.",
73
+ "claims": [
74
+ {
75
+ "value": "urn:node:saml",
76
+ "evidence": [
77
+ {
78
+ "source": "urn:source:summary",
79
+ "locator": "Product guide"
80
+ }
81
+ ]
82
+ }
83
+ ]
84
+ },
85
+ {
86
+ "id": "urn:f:database-bound",
87
+ "subject": "urn:instance:demo",
88
+ "property": "urn:cap:database",
89
+ "state": "known",
90
+ "note": "Synthetic source assertion; not runtime evidence.",
91
+ "claims": [
92
+ {
93
+ "value": "urn:target:atlas",
94
+ "evidence": [
95
+ {
96
+ "source": "urn:source:summary",
97
+ "locator": "Sanitized instance configuration summary, revision 1"
98
+ }
99
+ ]
100
+ }
101
+ ]
102
+ },
103
+ {
104
+ "id": "urn:f:identity",
105
+ "subject": "urn:instance:demo",
106
+ "property": "urn:cap:oidc",
107
+ "state": "conflicting",
108
+ "note": "Synthetic source assertion; not runtime evidence.",
109
+ "claims": [
110
+ {
111
+ "value": "urn:target:oidc",
112
+ "evidence": [
113
+ {
114
+ "source": "urn:source:summary",
115
+ "locator": "Sanitized instance configuration summary, revision 1"
116
+ }
117
+ ]
118
+ },
119
+ {
120
+ "value": "urn:target:saml",
121
+ "evidence": [
122
+ {
123
+ "source": "urn:source:summary",
124
+ "locator": "Sanitized instance configuration summary, revision 1"
125
+ }
126
+ ]
127
+ }
128
+ ]
129
+ }
130
+ ],
131
+ "alternatives": [
132
+ {
133
+ "id": "urn:option:oidc",
134
+ "title": "Prefer OIDC",
135
+ "findings": [
136
+ "urn:f:identity"
137
+ ],
138
+ "requirements": []
139
+ }
140
+ ],
141
+ "decisions": [
142
+ {
143
+ "id": "urn:decision:oidc",
144
+ "alternative": "urn:option:oidc",
145
+ "choice": "selected",
146
+ "reason": "Synthetic human preference; conflict unresolved.",
147
+ "by": "Synthetic reviewer",
148
+ "at": "2026-11-08T00:00:00Z"
149
+ }
150
+ ],
151
+ "questions": [],
152
+ "notes": []
153
+ }
@@ -0,0 +1,157 @@
1
+ {
2
+ "id": "urn:demo:research",
3
+ "title": "Synthetic capability and binding evidence",
4
+ "scope": "Synthetic role/product identities only; runtime unverified.",
5
+ "revision": {
6
+ "id": "r2",
7
+ "parent": {
8
+ "id": "urn:demo:research",
9
+ "revision": "r1",
10
+ "digest": "sha256:628d3c612d4afbb09852ec51436cf8b51f4fb96f02407c2b99e45dc06a3dfec0"
11
+ },
12
+ "createdAt": "2026-11-08T00:00:00Z",
13
+ "author": "Synthetic author",
14
+ "reason": "Changed database binding evidence"
15
+ },
16
+ "extensions": {},
17
+ "contract": "n8r.research/0.1",
18
+ "sources": [
19
+ {
20
+ "id": "urn:source:summary",
21
+ "location": "sources.md",
22
+ "version": "synthetic-1",
23
+ "digest": "sha256:892be031542be26860afe70102a0293aa30b6cfaf15d091e95549c0e11277e49",
24
+ "inspectedAt": "2026-11-08T00:00:00Z",
25
+ "coverage": [
26
+ {
27
+ "path": "sources.md",
28
+ "status": "inspected",
29
+ "note": "Sanitized synthetic source pack, not raw configuration."
30
+ }
31
+ ]
32
+ }
33
+ ],
34
+ "findings": [
35
+ {
36
+ "id": "urn:f:database",
37
+ "subject": "urn:node:app",
38
+ "property": "supports",
39
+ "state": "known",
40
+ "note": "Synthetic source assertion; not runtime evidence.",
41
+ "claims": [
42
+ {
43
+ "value": "urn:node:mongodb",
44
+ "evidence": [
45
+ {
46
+ "source": "urn:source:summary",
47
+ "locator": "Product guide"
48
+ }
49
+ ]
50
+ }
51
+ ]
52
+ },
53
+ {
54
+ "id": "urn:f:oidc",
55
+ "subject": "urn:node:app",
56
+ "property": "supports",
57
+ "state": "known",
58
+ "note": "Synthetic source assertion; not runtime evidence.",
59
+ "claims": [
60
+ {
61
+ "value": "urn:node:oidc",
62
+ "evidence": [
63
+ {
64
+ "source": "urn:source:summary",
65
+ "locator": "Product guide"
66
+ }
67
+ ]
68
+ }
69
+ ]
70
+ },
71
+ {
72
+ "id": "urn:f:saml",
73
+ "subject": "urn:node:app",
74
+ "property": "supports",
75
+ "state": "known",
76
+ "note": "Synthetic source assertion; not runtime evidence.",
77
+ "claims": [
78
+ {
79
+ "value": "urn:node:saml",
80
+ "evidence": [
81
+ {
82
+ "source": "urn:source:summary",
83
+ "locator": "Product guide"
84
+ }
85
+ ]
86
+ }
87
+ ]
88
+ },
89
+ {
90
+ "id": "urn:f:database-bound",
91
+ "subject": "urn:instance:demo",
92
+ "property": "urn:cap:database",
93
+ "state": "known",
94
+ "note": "Synthetic source assertion; not runtime evidence.",
95
+ "claims": [
96
+ {
97
+ "value": "urn:target:mongodb",
98
+ "evidence": [
99
+ {
100
+ "source": "urn:source:summary",
101
+ "locator": "Sanitized instance configuration summary, revision 2"
102
+ }
103
+ ]
104
+ }
105
+ ]
106
+ },
107
+ {
108
+ "id": "urn:f:identity",
109
+ "subject": "urn:instance:demo",
110
+ "property": "urn:cap:oidc",
111
+ "state": "conflicting",
112
+ "note": "Synthetic source assertion; not runtime evidence.",
113
+ "claims": [
114
+ {
115
+ "value": "urn:target:oidc",
116
+ "evidence": [
117
+ {
118
+ "source": "urn:source:summary",
119
+ "locator": "Sanitized instance configuration summary, revision 1"
120
+ }
121
+ ]
122
+ },
123
+ {
124
+ "value": "urn:target:saml",
125
+ "evidence": [
126
+ {
127
+ "source": "urn:source:summary",
128
+ "locator": "Sanitized instance configuration summary, revision 1"
129
+ }
130
+ ]
131
+ }
132
+ ]
133
+ }
134
+ ],
135
+ "alternatives": [
136
+ {
137
+ "id": "urn:option:oidc",
138
+ "title": "Prefer OIDC",
139
+ "findings": [
140
+ "urn:f:identity"
141
+ ],
142
+ "requirements": []
143
+ }
144
+ ],
145
+ "decisions": [
146
+ {
147
+ "id": "urn:decision:oidc",
148
+ "alternative": "urn:option:oidc",
149
+ "choice": "selected",
150
+ "reason": "Synthetic human preference; conflict unresolved.",
151
+ "by": "Synthetic reviewer",
152
+ "at": "2026-11-08T00:00:00Z"
153
+ }
154
+ ],
155
+ "questions": [],
156
+ "notes": []
157
+ }
@@ -0,0 +1,24 @@
1
+ # Fictional assistant source pack
2
+
3
+ ## Product guide
4
+
5
+ The assistant supports MongoDB storage, OIDC authentication, and SAML authentication.
6
+ OIDC and SAML are mutually exclusive for this example instance. Inference support
7
+ has not been researched.
8
+
9
+ ## Sanitized instance configuration summary, revision 1
10
+
11
+ The database relationship is configured for MongoDB Atlas. No endpoint, username,
12
+ password or key is included. The two permitted summaries disagree about identity:
13
+ one identifies the OIDC service, the other the SAML service. Neither establishes
14
+ runtime use. Inference binding evidence is missing.
15
+
16
+ ## Human decision
17
+
18
+ A synthetic reviewer prefers OIDC. This decision does not resolve the contradictory
19
+ configuration summaries.
20
+
21
+ ## Sanitized instance configuration summary, revision 2
22
+
23
+ The database relationship is now configured for a self-hosted MongoDB service.
24
+ The other evidence remains unchanged. No actual setting values are supplied.
@@ -0,0 +1,34 @@
1
+ # Shared node-and-relationship examples
2
+
3
+ Start here for the revised #50 verification. These developer-authored fixtures
4
+ exercise [contract 0.3](../../../docs/n8r-surface/surface-relationships.md). The
5
+ fictional assistant and setting names are not findings about LibreChat or any
6
+ real deployment. Earlier [0.2 fixtures](../descriptions/README.md) stay unchanged.
7
+
8
+ | File | What to inspect |
9
+ | --- | --- |
10
+ | [Capability](capability.json) | Component nodes and relationship edges with purpose, integration mechanism, configuration references and individual evidence. |
11
+ | [Bound r1](bound-r1.json) | The same relationship structure and identities, annotated with configured Atlas, conflicting identity and unknown inference bindings. |
12
+ | [Bound r2](bound-r2.json) | Same relationship ID, role endpoints and purpose; changed concrete database target. |
13
+ | [Research r1](research-r1.json), [research r2](research-r2.json) | Support evidence, property-level findings, source hashes/locators, human decisions and immutable predecessor references. |
14
+ | [Source pack](sources.md) | Synthetic purpose, protocol, alternatives, configuration summaries and uncertainty. |
15
+ | [Config reference](config/assistant.env.example) | Setting name and owner, without an actual setting value. |
16
+
17
+ `urn:v:demo` version `1` gives node type `component` and edge types `persists-data`
18
+ (stores application data), `authenticates-via` (uses an identity service), and `uses`
19
+ (generic possible dependence with the specific integration unresearched). Types do
20
+ not imply protocol compatibility or exercised connections. Known configuration
21
+ metadata does not establish a configured instance binding.
22
+
23
+ The database edge's `from`/`to` connect Assistant and the MongoDB role. The Bound
24
+ edge's `binding` identifies Atlas as the configured target; its successor selects
25
+ self-hosted MongoDB without changing the role graph or rewriting the earlier file.
26
+ Missing details stay unknown. Conflicts remain visible alongside human preference.
27
+
28
+ Follow the [human inspection and runnable readback](../../../docs/n8r-surface/surface-relationships.md#human-verification-task-list).
29
+ The library checks are offline after dependency setup; no CLI or AI runner is
30
+ required. They do not establish installed-skill acceptance or model conformance.
31
+
32
+ Machine-readable fixtures and the config example use [Apache-2.0](../../../LICENSE).
33
+ This guide and synthetic source prose use [CC-BY-4.0](../../../LICENSE-DOCS); credit
34
+ AI Surface Model contributors. No third-party source material is included.