@shield-agent/kya 0.4.4 → 0.6.0

package/dist/certify/catalog.js

@@ -0,0 +1,245 @@
+/**
+ * Agent Trust Baseline catalog: types, loader, validator.
+ * The bundled catalog/agent-trust-baseline-v0.json at the package root is the
+ * source of truth (shipped via package.json "files"). Evidence only — a
+ * catalog requirement never ALLOWs anything.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { UsageError } from "../errors.js";
+export const MAX_CATALOG_BYTES = 512 * 1024;
+const SEVERITIES = new Set(["critical", "high", "medium", "low"]);
+const CHECK_KINDS = new Set([
+    "config_mode",
+    "hooks_wired",
+    "trail_zero",
+    "trail_min",
+    "trail_ratio",
+    "orr_overall",
+    "orr_category",
+    "orr_fresh",
+    "sandbox_inventory",
+    "receipts_present",
+    "showback_present",
+    "attest",
+]);
+const ORR_MAX = new Set(["green", "amber"]);
+const TRAIL_MODES = new Set(["observe", "hold", "offline"]);
+const REQ_ID = /^[A-Z]+-\d+$/;
+/** Bundled catalog: <pkg>/catalog/… — works from both src/ (vitest) and dist/ (built). */
+export function defaultCatalogPath() {
+    return fileURLToPath(new URL("../../catalog/agent-trust-baseline-v0.json", import.meta.url));
+}
+export function loadCatalog(path) {
+    const file = path ?? defaultCatalogPath();
+    if (!existsSync(file) || !statSync(file).isFile()) {
+        throw new UsageError(`catalog not found: ${file}`);
+    }
+    if (statSync(file).size > MAX_CATALOG_BYTES) {
+        throw new UsageError(`catalog exceeds ${MAX_CATALOG_BYTES} bytes: ${file}`);
+    }
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch {
+        throw new UsageError(`catalog is not readable: ${file}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new UsageError(`catalog is not valid JSON: ${file}`);
+    }
+    return validateCatalog(raw);
+}
+function reqErr(id, msg) {
+    return new UsageError(`catalog requirement ${id}: ${msg}`);
+}
+function posInt(v) {
+    return typeof v === "number" && Number.isInteger(v) && v > 0;
+}
+function nonEmpty(v) {
+    return typeof v === "string" && v.trim().length > 0;
+}
+function parseMatch(id, raw) {
+    if (raw === undefined)
+        return {};
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw reqErr(id, "match must be an object");
+    }
+    const m = raw;
+    const out = {};
+    if (m.verdict !== undefined) {
+        if (!nonEmpty(m.verdict))
+            throw reqErr(id, "match.verdict must be a non-empty string");
+        out.verdict = m.verdict;
+    }
+    if (m.reasonCode !== undefined) {
+        if (!nonEmpty(m.reasonCode))
+            throw reqErr(id, "match.reasonCode must be a non-empty string");
+        out.reasonCode = m.reasonCode;
+    }
+    if (m.mode !== undefined) {
+        if (typeof m.mode !== "string" || !TRAIL_MODES.has(m.mode)) {
+            throw reqErr(id, "match.mode must be observe|hold|offline");
+        }
+        out.mode = m.mode;
+    }
+    if (m.neverEvent !== undefined) {
+        if (typeof m.neverEvent !== "boolean")
+            throw reqErr(id, "match.neverEvent must be boolean");
+        out.neverEvent = m.neverEvent;
+    }
+    return out;
+}
+function windowDaysOf(id, c) {
+    if (!posInt(c.windowDays))
+        throw reqErr(id, "trail checks require positive integer windowDays");
+    return c.windowDays;
+}
+function minOf(id, c, kind) {
+    if (!posInt(c.min))
+        throw reqErr(id, `${kind} requires positive integer min`);
+    return c.min;
+}
+function orrMaxOf(id, c) {
+    if (typeof c.max !== "string" || !ORR_MAX.has(c.max)) {
+        throw reqErr(id, 'orr checks require max "green" or "amber"');
+    }
+    return c.max;
+}
+function parseCheck(id, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw reqErr(id, "check must be an object");
+    }
+    const c = raw;
+    if (typeof c.kind !== "string" || !CHECK_KINDS.has(c.kind)) {
+        throw reqErr(id, `unknown check kind ${JSON.stringify(c.kind)}`);
+    }
+    switch (c.kind) {
+        case "config_mode":
+            if (c.not !== "observe") {
+                throw reqErr(id, 'config_mode requires not:"observe"');
+            }
+            return { kind: "config_mode", not: "observe" };
+        case "hooks_wired":
+            return { kind: "hooks_wired", min: minOf(id, c, "hooks_wired") };
+        case "sandbox_inventory":
+            return { kind: "sandbox_inventory", min: minOf(id, c, "sandbox_inventory") };
+        case "receipts_present":
+            return { kind: "receipts_present", min: minOf(id, c, "receipts_present") };
+        case "trail_zero":
+            return {
+                kind: "trail_zero",
+                windowDays: windowDaysOf(id, c),
+                match: parseMatch(id, c.match),
+            };
+        case "trail_min":
+            return {
+                kind: "trail_min",
+                windowDays: windowDaysOf(id, c),
+                match: parseMatch(id, c.match),
+                min: minOf(id, c, "trail_min"),
+            };
+        case "trail_ratio": {
+            const maxRatio = c.maxRatio;
+            if (typeof maxRatio !== "number" || !(maxRatio > 0) || maxRatio > 1) {
+                throw reqErr(id, "trail_ratio requires 0 < maxRatio <= 1");
+            }
+            return {
+                kind: "trail_ratio",
+                windowDays: windowDaysOf(id, c),
+                match: parseMatch(id, c.match),
+                maxRatio,
+            };
+        }
+        case "orr_overall":
+            return { kind: "orr_overall", max: orrMaxOf(id, c) };
+        case "orr_category": {
+            if (!nonEmpty(c.id))
+                throw reqErr(id, "orr_category requires non-empty id");
+            return { kind: "orr_category", id: c.id, max: orrMaxOf(id, c) };
+        }
+        case "orr_fresh": {
+            if (!posInt(c.maxAgeDays))
+                throw reqErr(id, "orr_fresh requires positive integer maxAgeDays");
+            return { kind: "orr_fresh", maxAgeDays: c.maxAgeDays };
+        }
+        case "showback_present":
+            return { kind: "showback_present" };
+        case "attest": {
+            if (!nonEmpty(c.prompt))
+                throw reqErr(id, "attest requires non-empty prompt");
+            // Prompts are interpolated into one-line evidence — no control chars.
+            if (/[\x00-\x1f\x7f]/.test(c.prompt)) {
+                throw reqErr(id, "attest prompt must not contain control characters");
+            }
+            return { kind: "attest", prompt: c.prompt };
+        }
+    }
+    // Unreachable: kind membership checked above.
+    throw reqErr(id, `unknown check kind ${JSON.stringify(c.kind)}`);
+}
+export function validateCatalog(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new UsageError("catalog root must be an object");
+    }
+    const c = raw;
+    for (const k of ["id", "version", "updated"]) {
+        if (!nonEmpty(c[k]))
+            throw new UsageError(`catalog.${k} must be a non-empty string`);
+    }
+    if (!Array.isArray(c.domains) ||
+        c.domains.length === 0 ||
+        !c.domains.every((d) => typeof d === "string" && d.length > 0)) {
+        throw new UsageError("catalog.domains must be a non-empty string array");
+    }
+    if (!Array.isArray(c.requirements) || c.requirements.length === 0) {
+        throw new UsageError("catalog.requirements must be a non-empty array");
+    }
+    const domains = c.domains;
+    const domainSet = new Set(domains);
+    const seen = new Set();
+    const requirements = [];
+    for (const item of c.requirements) {
+        if (!item || typeof item !== "object" || Array.isArray(item)) {
+            throw new UsageError("catalog requirement must be an object");
+        }
+        const rec = item;
+        const id = typeof rec.id === "string" ? rec.id : "";
+        if (!REQ_ID.test(id)) {
+            throw new UsageError(`catalog requirement id must match ^[A-Z]+-\\d+$: ${JSON.stringify(rec.id)}`);
+        }
+        if (seen.has(id))
+            throw new UsageError(`duplicate requirement id ${id}`);
+        seen.add(id);
+        if (typeof rec.domain !== "string" || !domainSet.has(rec.domain)) {
+            throw reqErr(id, `unknown domain ${JSON.stringify(rec.domain)}`);
+        }
+        if (!nonEmpty(rec.title))
+            throw reqErr(id, "title required");
+        if (!nonEmpty(rec.text))
+            throw reqErr(id, "text required");
+        if (typeof rec.severity !== "string" || !SEVERITIES.has(rec.severity)) {
+            throw reqErr(id, `bad severity ${JSON.stringify(rec.severity)}`);
+        }
+        requirements.push({
+            id,
+            domain: rec.domain,
+            title: rec.title,
+            text: rec.text,
+            severity: rec.severity,
+            check: parseCheck(id, rec.check),
+        });
+    }
+    return {
+        id: c.id,
+        version: c.version,
+        updated: c.updated,
+        domains,
+        requirements,
+    };
+}
+//# sourceMappingURL=catalog.js.map

package/dist/certify/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA0C1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAClC,aAAa;IACb,aAAa;IACb,YAAY;IACZ,WAAW;IACX,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAClB,IAAI,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,mBAAmB,iBAAiB,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,GAAW;IACrC,OAAO,IAAI,UAAU,CAAC,uBAAuB,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAKL,EAAE,CAAC;IACP,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACvF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC5F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,CAA0B;IAC1D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kDAAkD,CAAC,CAAC;IAChG,OAAO,CAAC,CAAC,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,CAA0B,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,CAA0B;IACtD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,CAAC,GAAwB,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,aAAa;YAChB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACjD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;QACnE,KAAK,mBAAmB;YACtB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC/E,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7E,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;aAC/B,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;aAC/B,CAAC;QACJ,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,CAAC,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACzD,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC9E,sEAAsE;YACtE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,8CAA8C;IAC9C,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAmB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CAClB,oDAAoD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,CAAC,EAAE,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,YAAY,CAAC,IAAI,CAAC;YAChB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAA+B;YAC7C,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAY;QAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/certify/evaluate.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Agent Trust Baseline evaluators. Pure functions over a pre-assembled
+ * EvidenceContext — no I/O here; all loading lives in commands/certify.ts.
+ * Evidence only: never a second PEP, never ALLOWs anything. Empty evidence
+ * windows yield insufficient_evidence, never a vacuous pass.
+ */
+import type { OrrRating } from "../commands/orr.js";
+import type { OrrCard } from "../receipt/enrich.js";
+import type { TrailEvent } from "../trail.js";
+import type { CatalogRequirement, RequirementSeverity, TrailMatch } from "./catalog.js";
+export type RequirementStatus = "pass" | "gap" | "insufficient_evidence" | "attested";
+export interface RequirementAttestation {
+    readonly text: string;
+    readonly at: string;
+}
+export interface CertifyRequirementResult {
+    readonly id: string;
+    readonly domain: string;
+    readonly title: string;
+    readonly severity: RequirementSeverity;
+    readonly status: RequirementStatus;
+    /** One line, redacted, safe for reports and bundles. */
+    readonly evidence: string;
+    readonly attestation?: RequirementAttestation;
+}
+export interface CertifyTrailStats {
+    readonly eventCount: number;
+    readonly verdictMix: {
+        readonly ALLOW: number;
+        readonly DENY: number;
+        readonly REQUIRE_APPROVE: number;
+    };
+    readonly modes: {
+        readonly observe: number;
+        readonly hold: number;
+        readonly offline: number;
+    };
+}
+export interface CertifyReport {
+    readonly format: "shield-kya-certify-report";
+    readonly version: 1;
+    readonly generatedAt: string;
+    readonly catalog: {
+        readonly id: string;
+        readonly version: string;
+        readonly updated: string;
+    };
+    readonly window: {
+        readonly days: number;
+        readonly since: string;
+        readonly until: string;
+    };
+    readonly trail: CertifyTrailStats;
+    readonly requirements: readonly CertifyRequirementResult[];
+    readonly overall: {
+        readonly pass: number;
+        readonly gap: number;
+        readonly insufficientEvidence: number;
+        readonly attested: number;
+        readonly result: "pass" | "gap";
+    };
+}
+export interface EvidenceContext {
+    readonly now: Date;
+    /**
+     * Full merged trail (global + legacy). Each check filters its own window.
+     * Merged `readTrail` output is ts-ascending, but evaluators do not rely on
+     * that ordering.
+     */
+    readonly events: readonly TrailEvent[];
+    readonly gateMode: "observe" | "hold" | "offline";
+    readonly wiredHostCount: number;
+    readonly orr: OrrCard | undefined;
+    /** Category id → rating from the latest ORR report, when present. */
+    readonly orrCategories: Readonly<Record<string, OrrRating>> | undefined;
+    readonly sandboxCount: number;
+    readonly receiptCount: number;
+    readonly showbackPresent: boolean;
+    readonly attestations: ReadonlyMap<string, RequirementAttestation>;
+}
+export declare function matchEvent(e: TrailEvent, m: TrailMatch): boolean;
+/** Events with parseable ts within [now - windowDays, now]. */
+export declare function trailWindow(events: readonly TrailEvent[], windowDays: number, now: Date): TrailEvent[];
+export declare function evaluateRequirement(req: CatalogRequirement, ctx: EvidenceContext): CertifyRequirementResult;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/certify/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EACV,kBAAkB,EAElB,mBAAmB,EACnB,UAAU,EACX,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,GAAG,uBAAuB,GAAG,UAAU,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;KACjC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACpE;AAID,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAQhE;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,UAAU,EAAE,CAMd;AAaD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,eAAe,GACnB,wBAAwB,CA0L1B"}

package/dist/certify/evaluate.js

@@ -0,0 +1,175 @@
+const DAY_MS = 24 * 60 * 60 * 1000;
+export function matchEvent(e, m) {
+    if (m.verdict !== undefined && e.verdict.toUpperCase() !== m.verdict.toUpperCase()) {
+        return false;
+    }
+    if (m.reasonCode !== undefined && e.reasonCode !== m.reasonCode)
+        return false;
+    if (m.mode !== undefined && e.mode !== m.mode)
+        return false;
+    if (m.neverEvent !== undefined && (e.neverEvent === true) !== m.neverEvent)
+        return false;
+    return true;
+}
+/** Events with parseable ts within [now - windowDays, now]. */
+export function trailWindow(events, windowDays, now) {
+    const sinceMs = now.getTime() - windowDays * DAY_MS;
+    return events.filter((e) => {
+        const t = Date.parse(e.ts);
+        return !Number.isNaN(t) && t >= sinceMs && t <= now.getTime();
+    });
+}
+function describeMatch(m) {
+    const parts = [];
+    if (m.verdict)
+        parts.push(`verdict=${m.verdict.toUpperCase()}`);
+    if (m.reasonCode)
+        parts.push(`reason=${m.reasonCode}`);
+    if (m.mode)
+        parts.push(`mode=${m.mode}`);
+    if (m.neverEvent !== undefined)
+        parts.push(`neverEvent=${m.neverEvent}`);
+    return parts.length > 0 ? parts.join(" ") : "any event";
+}
+const RATING_RANK = { green: 0, amber: 1, red: 2 };
+export function evaluateRequirement(req, ctx) {
+    const attestation = ctx.attestations.get(req.id);
+    const result = (status, evidence) => ({
+        id: req.id,
+        domain: req.domain,
+        title: req.title,
+        severity: req.severity,
+        status,
+        evidence,
+        ...(attestation
+            ? { attestation: { text: attestation.text, at: attestation.at } }
+            : {}),
+    });
+    const check = req.check;
+    switch (check.kind) {
+        case "trail_zero": {
+            const window = trailWindow(ctx.events, check.windowDays, ctx.now);
+            if (window.length === 0) {
+                return result("insufficient_evidence", `no trail events in the last ${check.windowDays}d`);
+            }
+            const matches = window.filter((e) => matchEvent(e, check.match));
+            if (matches.length === 0) {
+                return result("pass", `0/${window.length} events match ${describeMatch(check.match)} in ${check.windowDays}d`);
+            }
+            const latestMs = matches.reduce((acc, e) => {
+                const t = Date.parse(e.ts);
+                return Number.isNaN(t) ? acc : Math.max(acc, t);
+            }, Number.NEGATIVE_INFINITY);
+            // ISO-normalized: raw event ts is attacker-controllable, the quoted
+            // value in evidence must stay a single line.
+            const latest = new Date(latestMs).toISOString();
+            return result("gap", `${matches.length} event(s) match ${describeMatch(check.match)} in ${check.windowDays}d (latest ${latest})`);
+        }
+        case "trail_min": {
+            const window = trailWindow(ctx.events, check.windowDays, ctx.now);
+            if (window.length === 0) {
+                return result("insufficient_evidence", `no trail events in the last ${check.windowDays}d`);
+            }
+            const matches = window.filter((e) => matchEvent(e, check.match)).length;
+            if (matches >= check.min) {
+                return result("pass", `${matches} event(s) match ${describeMatch(check.match)} in ${check.windowDays}d (min ${check.min})`);
+            }
+            return result("gap", `${matches} event(s) match ${describeMatch(check.match)} in ${check.windowDays}d, need ${check.min}`);
+        }
+        case "trail_ratio": {
+            const window = trailWindow(ctx.events, check.windowDays, ctx.now);
+            if (window.length === 0) {
+                return result("insufficient_evidence", `no trail events in the last ${check.windowDays}d`);
+            }
+            const matches = window.filter((e) => matchEvent(e, check.match)).length;
+            const ratio = matches / window.length;
+            const pct = `${(ratio * 100).toFixed(1)}%`;
+            // Clean threshold rendering: 0.29 * 100 would print 28.999999999999996.
+            const maxPct = `${+(check.maxRatio * 100).toFixed(4)}%`;
+            if (ratio <= check.maxRatio) {
+                return result("pass", `${matches}/${window.length} = ${pct} ≤ ${maxPct} for ${describeMatch(check.match)}`);
+            }
+            return result("gap", `${matches}/${window.length} = ${pct} > ${maxPct} for ${describeMatch(check.match)}`);
+        }
+        case "config_mode": {
+            if (ctx.gateMode === check.not) {
+                return result("gap", `gate mode is ${ctx.gateMode} — set KYA_HOLD=1 / KYA_OFFLINE=1 or "gateMode" in .kya/config.json`);
+            }
+            return result("pass", `gate mode is ${ctx.gateMode}`);
+        }
+        case "hooks_wired": {
+            if (ctx.wiredHostCount >= check.min) {
+                return result("pass", `${ctx.wiredHostCount} wired host(s) (need ${check.min})`);
+            }
+            return result("gap", `${ctx.wiredHostCount} wired host(s), need ${check.min} — kya connect <host> --hooks`);
+        }
+        case "sandbox_inventory": {
+            if (ctx.sandboxCount >= check.min) {
+                return result("pass", `${ctx.sandboxCount} sandbox record(s)`);
+            }
+            return result("gap", `no sandbox inventory — KYA_SANDBOX=mock kya sandbox spawn`);
+        }
+        case "receipts_present": {
+            if (ctx.receiptCount >= check.min) {
+                return result("pass", `${ctx.receiptCount} receipt file(s) in .kya/receipts`);
+            }
+            return result("gap", `no receipts yet — run kya receipt`);
+        }
+        case "showback_present": {
+            return ctx.showbackPresent
+                ? result("pass", "showback card present (.kya/usage.json)")
+                : result("gap", "no showback card — add .kya/usage.json or run orr with --usage");
+        }
+        case "attest": {
+            if (attestation)
+                return result("attested", `attested ${attestation.at}`);
+            return result("gap", `no attestation recorded — kya certify --attest ${req.id} --text "…" (${check.prompt})`);
+        }
+        case "orr_overall": {
+            if (!ctx.orr) {
+                return result("insufficient_evidence", "no ORR report — kya orr run --path .");
+            }
+            if (RATING_RANK[ctx.orr.overall] <= RATING_RANK[check.max]) {
+                return result("pass", `ORR overall ${ctx.orr.overall} (max ${check.max})`);
+            }
+            return result("gap", `ORR overall ${ctx.orr.overall} exceeds max ${check.max}`);
+        }
+        case "orr_category": {
+            if (!ctx.orrCategories) {
+                return result("insufficient_evidence", "no ORR report — kya orr run --path .");
+            }
+            const rating = ctx.orrCategories[check.id];
+            if (!rating) {
+                return result("insufficient_evidence", `ORR category ${check.id} not present in latest report`);
+            }
+            if (RATING_RANK[rating] <= RATING_RANK[check.max]) {
+                return result("pass", `ORR ${check.id} ${rating} (max ${check.max})`);
+            }
+            return result("gap", `ORR ${check.id} ${rating} exceeds max ${check.max}`);
+        }
+        case "orr_fresh": {
+            if (!ctx.orr || !ctx.orr.generatedAt) {
+                return result("insufficient_evidence", "no ORR report — kya orr run --path .");
+            }
+            const t = Date.parse(ctx.orr.generatedAt);
+            if (Number.isNaN(t)) {
+                return result("insufficient_evidence", "ORR generatedAt unparseable");
+            }
+            const nowMs = ctx.now.getTime();
+            if (t > nowMs) {
+                return result("insufficient_evidence", "ORR generatedAt is in the future — clock skew, re-run kya orr run");
+            }
+            const ageMs = nowMs - t;
+            // Exact ms comparison decides; the floored day count is display-only.
+            const ageDays = Math.floor(ageMs / DAY_MS);
+            if (ageMs <= check.maxAgeDays * DAY_MS) {
+                return result("pass", `ORR is ${ageDays}d old (max ${check.maxAgeDays}d)`);
+            }
+            return result("gap", `ORR is ${ageDays}d old (max ${check.maxAgeDays}d) — re-run kya orr run`);
+        }
+    }
+    // Unreachable: RequirementCheck union is exhaustive (checked at compile time).
+    const exhaustive = check;
+    throw new Error(`unknown check kind ${JSON.stringify(exhaustive)}`);
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/certify/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AA4FA,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CACzB,MAA6B,EAC7B,UAAkB,EAClB,GAAS;IAET,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,CAAa;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1D,CAAC;AAED,MAAM,WAAW,GAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAE9E,MAAM,UAAU,mBAAmB,CACjC,GAAuB,EACvB,GAAoB;IAEpB,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,QAAgB,EAA4B,EAAE,CAAC,CAAC;QACzF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAqB,GAAG,CAAC,KAAK,CAAC;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,KAAK,MAAM,CAAC,MAAM,iBAAiB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,GAAG,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7B,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,CAAC,MAAM,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,aAAa,MAAM,GAAG,CAC5G,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,UAAU,KAAK,CAAC,GAAG,GAAG,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,WAAW,KAAK,CAAC,GAAG,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,wEAAwE;YACxE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,MAAM,CACX,KAAK,EACL,gBAAgB,GAAG,CAAC,QAAQ,qEAAqE,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,+BAA+B,CACtF,CAAC;QACJ,CAAC;QACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,oBAAoB,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,mCAAmC,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,eAAe;gBACxB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,WAAW;gBAAE,OAAO,MAAM,CAAC,UAAU,EAAE,YAAY,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CACX,KAAK,EACL,kDAAkD,GAAG,CAAC,EAAE,gBAAgB,KAAK,CAAC,MAAM,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CACX,uBAAuB,EACvB,gBAAgB,KAAK,CAAC,EAAE,+BAA+B,CACxD,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBACd,OAAO,MAAM,CACX,uBAAuB,EACvB,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;YACxB,sEAAsE;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,yBAAyB,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,MAAM,UAAU,GAAU,KAAK,CAAC;IAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/certify/render.d.ts

@@ -0,0 +1,6 @@
+import type { CertifyReport } from "./evaluate.js";
+/** Catalog order of domains, derived from requirement order in the report. */
+export declare function domainOrder(report: CertifyReport): string[];
+export declare function formatCertifyMarkdown(report: CertifyReport): string;
+export declare function renderCertifyHtml(report: CertifyReport): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/certify/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/certify/render.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,eAAe,CAAC;AAWvB,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAM3D;AASD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CA+CnE;AAiCD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAoJ/D"}