@sourcey/catalog-verifier 1.1.4 → 1.1.5

package/dist/modules/agent-readiness-policy/src/current-policy-metrics.js

@@ -1,721 +0,0 @@
-import { agentReadinessInterfaceModalitySchema, } from "../../../contracts/agent-readiness/src/declaration.js";
-import { MCP_REQUIREMENTS, OPENAPI_REQUIREMENTS } from "./current-policy-standards.js";
-const resource = (...roles) => ({ kind: "resource_role", roles });
-const endpoint = (...roles) => ({ kind: "endpoint_role", roles });
-const standard = (requirement) => ({ kind: "standard_requirement", requirement });
-const target = (membership) => ({
-    kind: "assessment_target_membership",
-    membership,
-});
-const interfaceSignature = (functions) => ({
-    kind: "interface_signature",
-    modalities: agentReadinessInterfaceModalitySchema.options,
-    functions,
-});
-export const METRICS = [
-    {
-        stage: "evaluate",
-        code: "service_discovery",
-        role: "graded",
-        selectorAlternatives: [[resource("discovery")]],
-        evidence: "availability",
-        evidenceTerms: [
-            "service",
-            "api",
-            "documentation",
-            "quickstart",
-            "get started",
-            "no account",
-            "without an account",
-            "no sign up",
-            "anonymous access",
-            "endpoint",
-            "base url",
-            "access",
-        ],
-        condition: "Can an agent find the exact service and its stable entrypoints?",
-        ready: "The exact service and stable evaluation or access entrypoints are publicly discoverable.",
-        limited: "Discovery works but is incomplete, context-dependent, split, or unstable.",
-        blocked: "The vendor explicitly states that the exact service has no stable public route.",
-        factPredicates: {
-            yes: "A retrieved first-party page names the exact service and gives a stable canonical evaluation or access route.",
-            partial: "A first-party route reaches the exact service but is explicitly conditional, fragmented, or unstable.",
-            no: "The vendor explicitly says there is no stable public discovery route to the exact service.",
-        },
-        remediation: "Publish and link one stable canonical service and access entrypoint.",
-    },
-    {
-        stage: "evaluate",
-        code: "pricing_decidability",
-        role: "graded",
-        selectorAlternatives: [[resource("pricing")]],
-        evidence: "availability",
-        evidenceTerms: [
-            "pricing",
-            "price",
-            "cost",
-            "free",
-            "currency",
-            "usage",
-            "billing",
-            "billed",
-            "rate",
-        ],
-        condition: "Can an agent estimate cost or confirm no-charge status before commitment?",
-        ready: "Price or no-charge status, variables, currency, and material conditions are explicit.",
-        limited: "The pricing model is visible but omits a material variable or condition.",
-        blocked: "Cost or no-charge status cannot be determined before commitment.",
-        factPredicates: {
-            yes: "The exact service is explicitly no-charge, or its applicable rate, currency, usage variables, and material conditions are disclosed before commitment.",
-            partial: "The vendor states a price or rate for this service but explicitly makes a material variable or condition contextual or deferred.",
-            no: "The vendor explicitly withholds the assessed service's cost until after a commitment or undisclosed decision point.",
-        },
-        remediation: "Publish readable complete pricing or explicit no-charge status and conditions.",
-    },
-    {
-        stage: "evaluate",
-        code: "structured_evaluation_discovery",
-        role: "informational",
-        selectorAlternatives: [[resource("descriptor", "discovery")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "llms.txt",
-            "openapi",
-            "descriptor",
-            "structured",
-            "machine-readable",
-            "schema",
-            "agents.json",
-        ],
-        condition: "Are verified structured discovery artifacts available?",
-        ready: "Verified structured artifacts accelerate discovery of the evaluation surface.",
-        limited: "Structured discovery exists but covers only part of the evaluation surface.",
-        blocked: "No verified structured discovery artifact was established.",
-        factPredicates: {
-            yes: "An exact versioned standards result verifies a structured descriptor that links to this assessed service.",
-            partial: "A first-party structured descriptor is documented for the assessed service, but an exact protocol or descriptor check has not verified it.",
-            no: "A completed exact descriptor check reports the assessed descriptor is not satisfied.",
-        },
-        remediation: "Publish optional structured discovery that links back to canonical service facts.",
-    },
-    {
-        stage: "evaluate",
-        code: "verified_web_agent_access",
-        role: "informational",
-        selectorAlternatives: [[resource("policy", "descriptor", "discovery")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "robots",
-            "crawler",
-            "bot",
-            "agent",
-            "web bot auth",
-            "signature",
-            "allow",
-            "disallow",
-        ],
-        condition: "Does the vendor deliberately describe access for web agents?",
-        ready: "Web-agent access policy is explicit and verified for the assessed resources.",
-        limited: "Web-agent access policy exists but is incomplete or inconsistent.",
-        blocked: "Verified policy blocks agents from the assessed public resources.",
-        factPredicates: {
-            yes: "An explicit first-party policy permits the assessed web-agent class to retrieve the exact public resources, or describes its verified-agent admission path.",
-            partial: "A first-party web-agent policy applies to the assessed resources but explicitly limits access or leaves the admitted class conditional.",
-            no: "An explicit applicable first-party policy denies the assessed web-agent class access to those resources.",
-        },
-        remediation: "Publish deliberate crawler policy and a verified-agent path where appropriate.",
-    },
-    {
-        stage: "sign_up",
-        code: "access_entrypoint_stability",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [[resource("access")], [endpoint("registration")]],
-        evidence: "availability",
-        evidenceTerms: [
-            "sign up",
-            "signup",
-            "register",
-            "registration",
-            "create account",
-            "login",
-            "console",
-            "dashboard",
-            "get started",
-            "no account",
-            "without an account",
-            "no sign up",
-            "anonymous access",
-        ],
-        condition: "Is there a stable route to begin obtaining service access?",
-        ready: "A stable canonical route begins the required access bootstrap.",
-        limited: "The access route works but is conditional, tenant-specific, or unstable.",
-        blocked: "The vendor explicitly states that no stable access route is available.",
-        factPredicates: {
-            yes: "A stable first-party route begins the access bootstrap required by this exact service path. OAuth, device-code approval or API-token issuance for an existing account does not establish new-account creation.",
-            partial: "The access route is explicitly tenant-specific, conditional, or unstable for this service path.",
-            no: "The vendor explicitly states that no stable route exists for required access bootstrap.",
-            not_applicable: "A first-party statement establishes that the assessed operation is open without account creation or any access bootstrap.",
-        },
-        remediation: "Publish one stable canonical access bootstrap entrypoint.",
-    },
-    {
-        stage: "sign_up",
-        code: "access_control_operability",
-        role: "barrier",
-        allowNotApplicable: true,
-        // First-party access and authentication documentation can establish the
-        // exact control and handoff contract without performing account creation.
-        // A live registration endpoint remains the fallback when no such resource
-        // is declared.
-        selectorAlternatives: [[resource("access", "authentication")], [endpoint("registration")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "form",
-            "field",
-            "button",
-            "submit",
-            "validation",
-            "approval",
-            "redirect",
-            "callback",
-            "continue",
-        ],
-        condition: "Can an agent operate the access controls and safe handoffs deterministically?",
-        ready: "Required controls, validation, navigation, and handoffs are machine-operable.",
-        limited: "Only part of the access flow is operable or a bounded human step remains.",
-        blocked: "Required controls or hidden state cannot be operated by an agent.",
-        factPredicates: {
-            yes: "The required access controls, validation, navigation and any authorization handoff are documented or observed as deterministic for the assessed path.",
-            partial: "The vendor explicitly identifies a required human access-control step with a bounded handoff and deterministic continuation.",
-            no: "The vendor explicitly requires an unsupported control or hidden human state without an agent-safe alternative.",
-            not_applicable: "A first-party statement establishes that this assessed path has no access-control or account-bootstrap step.",
-        },
-        remediation: "Expose deterministic controls, validation, and resumable authorization handoffs.",
-    },
-    {
-        stage: "sign_up",
-        code: "captcha_compatible_access",
-        role: "barrier",
-        allowNotApplicable: true,
-        selectorAlternatives: [[endpoint("registration")], [resource("access", "policy")]],
-        coverage: "all_matches",
-        evidence: "compatible_absence",
-        evidenceTerms: ["captcha", "recaptcha", "challenge", "bot", "verification", "verified agent"],
-        condition: "Can an agent obtain access without an unsupported CAPTCHA boundary?",
-        ready: "The vendor states that no CAPTCHA is required on this access path, or documents an agent-safe alternative.",
-        limited: "A conditional CAPTCHA has a deterministic alternative or resumable human handoff.",
-        blocked: "A mandatory CAPTCHA has no supported agent-safe route.",
-        factPredicates: {
-            yes: "The vendor explicitly says this access path has no required CAPTCHA, or documents an agent-safe alternative that bypasses the required CAPTCHA.",
-            partial: "A conditional CAPTCHA is explicitly paired with a bounded, resumable human handoff for this access path.",
-            no: "The vendor explicitly requires CAPTCHA on this access path and provides no supported agent-safe or resumable route.",
-            not_applicable: "A first-party statement establishes that this assessed path has no signup or access-control step where CAPTCHA could apply.",
-        },
-        remediation: "Provide a lawful verified-agent alternative or explicit resumable approval handoff.",
-    },
-    {
-        stage: "sign_up",
-        code: "phone_verification_compatible",
-        role: "barrier",
-        allowNotApplicable: true,
-        // First-party flow documentation can state downstream phone boundaries
-        // that the non-submitting registration capture cannot reach. Prefer that
-        // declared evidence when it exists; the live endpoint remains the exact
-        // fallback for declarations without an access or policy resource.
-        selectorAlternatives: [[resource("access", "policy")], [endpoint("registration")]],
-        evidence: "compatible_absence",
-        evidenceTerms: ["phone", "sms", "mobile", "verification", "one-time code", "security code"],
-        condition: "Can required phone verification be completed through a supported boundary?",
-        ready: "Phone verification is absent, optional, or available through delegated authority.",
-        limited: "A mandatory human phone step has a safe explicit resumable handoff.",
-        blocked: "Access requires impersonating or possessing unsupported human phone state.",
-        factPredicates: {
-            yes: "The vendor explicitly says phone verification is absent or optional on this path, or documents agent-operable delegated verification.",
-            partial: "A required human phone step has an explicitly bounded handoff and deterministic agent continuation after verification.",
-            no: "The vendor explicitly requires unsupported human phone possession or impersonation with no safe handoff.",
-            not_applicable: "A first-party statement establishes that no phone-verification step occurs on the assessed access path.",
-        },
-        remediation: "Add delegated verification or an explicit resumable human approval boundary.",
-    },
-    {
-        stage: "sign_up",
-        code: "delegated_identity_access",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("authentication"), target("selected_path")],
-            [endpoint("authorization", "token", "registration"), target("selected_path")],
-            [interfaceSignature(["authentication"]), target("selected_path")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "oauth",
-            "openid",
-            "oidc",
-            "token",
-            "scope",
-            "consent",
-            "authorize",
-            "service account",
-            "api key",
-            "revoke",
-            "no account",
-            "without an account",
-            "no api key",
-            "unauthenticated",
-        ],
-        condition: "Can an agent obtain scoped, revocable authority for this service?",
-        ready: "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.",
-        limited: "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.",
-        blocked: "Only shared human credentials, hidden sessions, or an unusable identity flow are available.",
-        factPredicates: {
-            yes: "The exact service documents scoped, revocable delegated authority with consent and deterministic resumption, or a programmatic credential lifecycle with equivalent scope and revocation.",
-            partial: "Scoped machine credentials exist for this service, but the vendor explicitly requires manual issuance or transfer, broad authority, or weak lifecycle handling.",
-            no: "The vendor explicitly requires shared human credentials, hidden human sessions, or another unsupported identity flow for the assessed path.",
-            not_applicable: "A first-party statement explicitly establishes that this assessed path requires no account or delegated identity acquisition.",
-        },
-        remediation: "Provide scoped delegated authorization with consent, revocation, and deterministic resumption.",
-    },
-    {
-        stage: "pay",
-        code: "commitment_disclosure",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("pricing"), resource("checkout")],
-            [resource("pricing")],
-            [resource("checkout")],
-            [resource("terms")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "billing",
-            "price",
-            "charge",
-            "currency",
-            "monthly",
-            "annual",
-            "recurring",
-            "subscription",
-            "commitment",
-            "fee",
-            "no charge",
-            "no payment",
-            "free to use",
-        ],
-        condition: "Is the exact commercial commitment disclosed before authorization?",
-        ready: "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.",
-        limited: "The public commitment omits a material component until later in the flow.",
-        blocked: "The commitment cannot be known before authorization.",
-        factPredicates: {
-            yes: "The exact service discloses charge or no-charge status and every applicable material rate, currency, recurrence and condition before authorization.",
-            partial: "The vendor discloses a charge or no-charge commitment but explicitly defers a material add-on, volume term, recurrence or other cost component.",
-            no: "The vendor explicitly requires authorization before disclosing the material commercial commitment for this path.",
-            not_applicable: "A first-party statement establishes no commercial commitment on the assessed service path.",
-        },
-        remediation: "Disclose the complete commitment before payment authorization.",
-    },
-    {
-        stage: "pay",
-        code: "checkout_operability",
-        role: "barrier",
-        allowNotApplicable: true,
-        selectorAlternatives: [[resource("checkout")], [endpoint("checkout")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "checkout",
-            "payment",
-            "billing",
-            "card",
-            "purchase",
-            "upgrade",
-            "plan",
-            "approval",
-            "confirmation",
-            "receipt",
-        ],
-        condition: "Can an agent construct checkout, hand off approval safely, and resume?",
-        ready: "An API, protocol, or accessible web flow supports deterministic checkout and resumption.",
-        limited: "Checkout is partly operable but needs additional bounded human work.",
-        blocked: "Checkout requires unsupported hidden or manual interaction.",
-        factPredicates: {
-            yes: "An exact API, protocol or accessible web checkout supports deterministic construction, explicit bounded authorization handoff and resumption for this service.",
-            partial: "The vendor documents a checkout path with an explicit bounded human step or other named operability constraint and a continuation route.",
-            no: "The vendor explicitly requires hidden or unsupported checkout interaction with no agent-safe continuation.",
-            not_applicable: "A first-party statement establishes that this assessed access path has no checkout step.",
-        },
-        remediation: "Expose deterministic checkout with an explicit approval and resumption contract.",
-    },
-    {
-        stage: "pay",
-        code: "payment_authorization",
-        role: "barrier",
-        allowNotApplicable: true,
-        selectorAlternatives: [[resource("checkout")], [endpoint("checkout")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "payment",
-            "authorize",
-            "approval",
-            "card",
-            "bank",
-            "wallet",
-            "delegated",
-            "receipt",
-            "invoice",
-            "charge",
-            "no payment",
-            "no card required",
-        ],
-        condition: "Can payment be authorized within scoped agent or explicit human authority?",
-        ready: "A documented rail supports scoped delegation or explicit human-confirmed authorization with receipts.",
-        limited: "Payment needs additional bounded human handling or uses weak delegation.",
-        blocked: "No supported authorization rail exists for the assessed checkout.",
-        factPredicates: {
-            yes: "The assessed payment path documents scoped agent delegation or explicit human-confirmed authorization, with a receipt and deterministic resumption.",
-            partial: "The payment path explicitly needs bounded additional human handling or weak delegation, and documents how authorization resumes or yields a receipt.",
-            no: "The vendor explicitly requires unsupported payment authorization without scoped delegation or a bounded human approval route.",
-            not_applicable: "A first-party statement establishes that no payment authorization occurs on this exact assessed path; a free allowance on an otherwise billable path is not enough.",
-        },
-        remediation: "Support scoped payment authorization and deterministic receipt and failure semantics.",
-    },
-    {
-        stage: "pay",
-        code: "self_service_purchase",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [[resource("checkout")], [endpoint("checkout")]],
-        evidence: "quality",
-        evidenceTerms: [
-            "payment",
-            "billing",
-            "credit card",
-            "plan",
-            "upgrade",
-            "subscription",
-            "monthly",
-            "annual",
-            "checkout",
-            "buy now",
-            "purchase",
-            "activate",
-            "add payment method",
-            "account settings",
-            "sales",
-            "contact",
-            "no purchase",
-            "free to use",
-        ],
-        condition: "Is a direct self-service path to paid access documented?",
-        ready: "A documented direct purchase path reaches paid access without a vendor decision point.",
-        limited: "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.",
-        blocked: "Paid access requires opaque or unbounded sales intervention.",
-        factPredicates: {
-            yes: "A documented, identified account or billing route lets an authorized user buy, subscribe, upgrade or activate paid access without a vendor decision point; a live purchase need not be performed.",
-            partial: "The vendor documents self-service only for named tiers or conditions, or an explicit bounded vendor review with machine-readable status and resumption.",
-            no: "The vendor explicitly requires opaque or unbounded sales approval before the assessed paid access is available.",
-            not_applicable: "A first-party statement establishes that the assessed path has no paid-access purchase step; a generic free trial does not establish this.",
-        },
-        remediation: "Document a direct purchase path or bounded vendor review with machine-readable status.",
-    },
-    {
-        stage: "provision",
-        code: "provisioning_operability",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("provisioning"), target("selected_path")],
-            [endpoint("service", "registration"), target("selected_path")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "create",
-            "provision",
-            "deploy",
-            "activate",
-            "initialize",
-            "post",
-            "api",
-            "request",
-            "no provisioning",
-            "immediate access",
-        ],
-        condition: "Can provisioning be initiated within supported agent authority?",
-        ready: "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.",
-        limited: "Bounded human or vendor review remains in the provisioning path.",
-        blocked: "Provisioning requires unsupported or unbounded manual intervention.",
-        factPredicates: {
-            yes: "The exact service documents a machine-triggerable provisioning action or a deterministic initiation after an allowed bounded human handoff.",
-            partial: "Provisioning initiation explicitly requires a bounded human or vendor step with a documented continuation route.",
-            no: "The vendor explicitly requires unsupported or unbounded manual intervention to initiate provisioning.",
-            not_applicable: "A first-party statement explicitly establishes that this assessed service path requires no resource provisioning.",
-        },
-        remediation: "Expose a deterministic provisioning initiation and bounded approval contract.",
-    },
-    {
-        stage: "provision",
-        code: "access_material_delivery",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("authentication"), target("selected_path")],
-            [endpoint("token", "protected_resource"), target("selected_path")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "api key",
-            "secret",
-            "token",
-            "credential",
-            "connection string",
-            "certificate",
-            "display",
-            "create",
-            "download",
-            "no credentials",
-            "no api key",
-            "anonymous access",
-        ],
-        condition: "Can usable access material be delivered securely to an authorized agent?",
-        ready: "Credentials, grants, or configuration are delivered through a documented agent-usable flow.",
-        limited: "Delivery needs additional human transfer or has weak scope or lifecycle semantics.",
-        blocked: "Usable access requires unsupported human secrets or hidden state.",
-        factPredicates: {
-            yes: "The exact service documents programmatic, agent-usable CLI, workload-identity or equivalent secure delivery of the required credentials, grants or configuration.",
-            partial: "The vendor explicitly delivers required access material through a constrained human dashboard, manual copy, or similarly bounded transfer.",
-            no: "The vendor explicitly requires unsupported human-only secrets or hidden state for usable access material.",
-            not_applicable: "A first-party statement explicitly establishes that this assessed path requires no access material delivery.",
-        },
-        remediation: "Deliver scoped access material through a secure documented machine-usable flow.",
-    },
-    {
-        stage: "provision",
-        code: "provisioning_completion",
-        role: "barrier",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("provisioning"), resource("status"), target("selected_path")],
-            [resource("provisioning"), resource("authentication"), target("selected_path")],
-            [endpoint("status", "webhook"), target("selected_path")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "created",
-            "status",
-            "state",
-            "ready",
-            "active",
-            "complete",
-            "completion",
-            "operation",
-            "polling",
-            "progress",
-            "terminal",
-            "failure",
-            "response",
-            "returns",
-            "returned",
-            "output",
-            "success",
-            "successful",
-            "usable",
-            "connection string",
-            "no provisioning",
-            "immediate access",
-        ],
-        condition: "Can an agent determine successful provisioning completion and reconcile asynchronous failure?",
-        ready: "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.",
-        limited: "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.",
-        blocked: "Provisioning completion is opaque or unbounded.",
-        factPredicates: {
-            yes: "A synchronous response returns a usable resource or access result, or the documented asynchronous path exposes bounded progress, terminal success and failure, and reconciliation for the exact target.",
-            partial: "The vendor explicitly documents progress or terminal state but also identifies a material completion constraint such as manual reconciliation or unbounded delay.",
-            no: "The vendor explicitly states that required provisioning completion is opaque or unbounded with no reliable terminal outcome.",
-            not_applicable: "A first-party statement explicitly establishes that no provisioning step occurs on this assessed path.",
-        },
-        remediation: "Expose bounded machine-readable terminal status and reconciliation semantics.",
-    },
-    {
-        stage: "operate",
-        code: "target_interface_access",
-        role: "graded",
-        selectorAlternatives: [[target("direct"), interfaceSignature(["service_operation"])]],
-        coverage: "all_matches",
-        serviceExchange: true,
-        evidence: "availability",
-        evidenceTerms: ["api", "cli", "sdk", "endpoint", "request", "operation", "tool", "interface"],
-        condition: "Does every essential assessment target have a documented agent-usable interface?",
-        ready: "Every essential target has a stable documented agent-usable interface alternative.",
-        limited: "Interfaces cover only part of an essential target or require a constrained bridge.",
-        blocked: "An essential service target has no machine-operable interface.",
-        factPredicates: {
-            yes: "Every named essential target has a stable, documented agent-usable operation interface; if an approved public probe is supplied, its response may additionally prove an observed exchange.",
-            partial: "The vendor explicitly documents only partial target coverage or a named constrained bridge for at least one essential target.",
-            no: "The vendor explicitly states that an essential assessed target has no machine-operable operation path.",
-        },
-        remediation: "Expose and document an agent-usable interface for every essential service target.",
-    },
-    {
-        stage: "operate",
-        code: "operation_authentication",
-        role: "graded",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("authentication"), target("selected_path")],
-            [target("selected_path"), endpoint("authorization", "token", "protected_resource")],
-            [target("selected_path"), interfaceSignature(["authentication"])],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "authentication",
-            "authorization",
-            "bearer",
-            "token",
-            "api key",
-            "oauth",
-            "header",
-            "credential",
-            "no api key",
-            "unauthenticated",
-        ],
-        condition: "Can an agent authenticate service operations with scoped authority?",
-        ready: "Request-time authentication is documented and usable under scoped agent authority.",
-        limited: "Authentication works only with broad or manual credential handling.",
-        blocked: "Operations require unsupported human session state or secrets.",
-        factPredicates: {
-            yes: "The selected operation documents exact scoped request-time authentication usable by an authorized agent.",
-            partial: "The operation supports machine authentication but explicitly depends on broad, manually handled or weakly scoped credentials.",
-            no: "The vendor explicitly requires unsupported human session state or secrets to invoke the selected operation.",
-            not_applicable: "A first-party statement explicitly establishes that the selected operation accepts credential-free requests.",
-        },
-        remediation: "Provide scoped request authentication with explicit consent and resumption boundaries.",
-    },
-    {
-        stage: "operate",
-        code: "operation_contract",
-        role: "graded",
-        selectorAlternatives: [[target("direct"), interfaceSignature(["service_operation"])]],
-        coverage: "all_matches",
-        evidence: "quality",
-        evidenceTerms: [
-            "request",
-            "response",
-            "parameter",
-            "schema",
-            "endpoint",
-            "method",
-            "return",
-            "effect",
-            "example",
-        ],
-        condition: "Are essential operation inputs, outputs, and effects stable and decidable?",
-        ready: "Essential operations have stable readable request, response, and effect semantics.",
-        limited: "The operation contract omits a material operation, field, or effect.",
-        blocked: "An agent cannot determine how to invoke or interpret an essential target.",
-        factPredicates: {
-            yes: "For every essential target, first-party material specifies stable request inputs, response outputs and consequential effects sufficiently to invoke and interpret the operation.",
-            partial: "The vendor explicitly describes a constrained or unstable part of an otherwise usable request, response or effect contract for an essential target.",
-            no: "The vendor explicitly states a material ambiguity that prevents invocation or interpretation of an essential operation.",
-        },
-        remediation: "Document stable inputs, outputs, effects, and target coverage for essential operations.",
-    },
-    {
-        stage: "operate",
-        code: "failure_contract",
-        role: "barrier",
-        selectorAlternatives: [
-            [
-                target("selected_path"),
-                interfaceSignature(["service_operation"]),
-                standard(MCP_REQUIREMENTS.errorResponse),
-            ],
-            [
-                target("selected_path"),
-                interfaceSignature(["service_operation"]),
-                standard(OPENAPI_REQUIREMENTS.errorResponses),
-            ],
-            [resource("recovery"), target("selected_path")],
-            [target("selected_path"), endpoint("recovery")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "error",
-            "retry",
-            "rate limit",
-            "idempotency",
-            "cancel",
-            "failure",
-            "timeout",
-            "status code",
-            "reconciliation",
-        ],
-        condition: "Can an agent handle applicable failure modes safely?",
-        ready: "Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.",
-        limited: "Safe failure handling is documented only partially.",
-        blocked: "A material failure mode required for safe operation is opaque.",
-        factPredicates: {
-            yes: "For the selected operation, first-party material documents applicable structured errors and limits plus safe retry, cancellation and reconciliation where those effects are possible.",
-            partial: "The vendor explicitly documents a safe error or limit path but identifies a material constrained retry, cancellation or reconciliation boundary.",
-            no: "The vendor explicitly says a material failure mode required for safe operation is opaque or cannot be reconciled.",
-        },
-        remediation: "Document applicable structured errors, retry, cancellation, and reconciliation semantics.",
-    },
-    {
-        stage: "operate",
-        code: "credential_lifecycle",
-        role: "barrier",
-        allowNotApplicable: true,
-        selectorAlternatives: [
-            [resource("authentication"), target("selected_path")],
-            [endpoint("token"), endpoint("recovery"), target("selected_path")],
-            [interfaceSignature(["authentication", "recovery"]), target("selected_path")],
-        ],
-        evidence: "quality",
-        evidenceTerms: [
-            "rotate",
-            "revoke",
-            "expire",
-            "delete",
-            "disable",
-            "compromised",
-            "recovery",
-            "secret",
-            "key",
-            "token",
-            "no credentials",
-            "no api key",
-            "unauthenticated",
-        ],
-        condition: "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?",
-        ready: "Credential lifecycle and recovery are documented and executable within delegated authority.",
-        limited: "Only part of the credential lifecycle is agent-operable.",
-        blocked: "Recovery depends on unsupported human-only control or broader shared secrets.",
-        factPredicates: {
-            yes: "The exact credential has documented issuance or use, replacement or rotation, revocation or compromise response, and recovery within delegated authority.",
-            partial: "The vendor documents one or more lifecycle operations but explicitly restricts a required rotation, revocation, compromise or recovery step to bounded manual or broader authority.",
-            no: "The vendor explicitly requires unsupported human-only recovery or shared secrets for the assessed credential.",
-            not_applicable: "A first-party statement explicitly establishes that no credential lifecycle exists on this assessed path.",
-        },
-        remediation: "Provide scoped expiry, rotation, revocation, compromise, and recovery operations.",
-    },
-    {
-        stage: "operate",
-        code: "agent_protocol_interface",
-        role: "informational",
-        selectorAlternatives: [[target("reachable"), interfaceSignature(["service_operation"])]],
-        evidence: "quality",
-        evidenceTerms: ["mcp", "a2a", "agent", "openapi", "protocol", "tool", "capability", "manifest"],
-        condition: "Does a declared service interface respond through a verified agent-native protocol?",
-        ready: "A retained exchange verifies the declared interface's protocol version.",
-        limited: "An agent-native interface is documented but no protocol exchange was verified.",
-        blocked: "No declared service interface completed exact agent-native protocol verification.",
-        factPredicates: {
-            yes: "An exact standards adapter exchange verifies the declared agent-native interface and protocol version.",
-            partial: "The vendor documents an agent-native interface for this service, but no exact versioned exchange was verified.",
-            no: "A completed exact protocol check reports that the declared interface did not satisfy the protocol requirement.",
-        },
-        remediation: "Optionally publish a protocol endpoint that completes exact version discovery.",
-    },
-];
-//# sourceMappingURL=current-policy-metrics.js.map