@tangle-network/agent-eval 0.23.1 → 0.24.0

package/dist/chunk-KKHDIONI.js

@@ -0,0 +1,414 @@
+// src/governance/types.ts
+function renderMarkdown(report) {
+  const sevEmoji = {
+    info: "\u2139\uFE0E",
+    low: "\xB7",
+    medium: "!",
+    high: "!!",
+    critical: "\u203C"
+  };
+  const lines = [];
+  lines.push(`# ${report.framework} report \u2014 ${report.context.systemName}`);
+  lines.push("");
+  lines.push(`- Organization: **${report.context.organization}**`);
+  lines.push(`- Period: ${report.context.periodStart} \u2192 ${report.context.periodEnd}`);
+  lines.push(
+    `- Owner: ${report.context.owner.role} ${report.context.owner.name} <${report.context.owner.email}>`
+  );
+  lines.push(`- Generated: ${report.generatedAt}`);
+  lines.push("");
+  lines.push(`## Summary \u2014 ${report.summary.overall}`);
+  lines.push("");
+  lines.push(`${report.summary.findings} finding(s).`);
+  for (const [sev, n] of Object.entries(report.summary.byeverity)) {
+    if (n > 0) lines.push(`- ${sevEmoji[sev]} ${sev}: ${n}`);
+  }
+  lines.push("");
+  lines.push("## Findings");
+  lines.push("");
+  for (const f of report.findings) {
+    lines.push(`### ${sevEmoji[f.severity]} ${f.id} \u2014 ${f.control}`);
+    lines.push("");
+    lines.push(f.summary);
+    if (f.evidence) {
+      lines.push("");
+      lines.push(`**Evidence:** ${f.evidence}`);
+    }
+    if (f.remediation) {
+      lines.push("");
+      lines.push(`**Remediation:** ${f.remediation}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function summarize(findings) {
+  const byeverity = {
+    info: 0,
+    low: 0,
+    medium: 0,
+    high: 0,
+    critical: 0
+  };
+  for (const f of findings) byeverity[f.severity]++;
+  const overall = byeverity.critical + byeverity.high > 0 ? "non-compliant" : byeverity.medium + byeverity.low > 0 ? "compliant-with-findings" : "compliant";
+  return { findings: findings.length, byeverity, overall };
+}
+
+// src/governance/eu-ai-act.ts
+function classifyEuAiRisk(signals) {
+  if (signals.biometricPublic || signals.socialScoring || signals.subliminal) return "unacceptable";
+  if (signals.annexIII) return "high";
+  if (signals.chatbot || signals.generatesSyntheticMedia) return "limited";
+  return "minimal";
+}
+async function euAiActReport(ctx, signals) {
+  const riskClass = classifyEuAiRisk(signals);
+  const findings = [];
+  if (riskClass === "unacceptable") {
+    findings.push({
+      id: "EU-ART-5",
+      severity: "critical",
+      control: "EU-AI-ACT:Article-5",
+      summary: "Use case matches a prohibited practice under Article 5.",
+      remediation: "Discontinue or substantially redesign the use case."
+    });
+  }
+  if (riskClass === "high") {
+    if (!ctx.redTeam) {
+      findings.push({
+        id: "EU-ART-9",
+        severity: "high",
+        control: "EU-AI-ACT:Article-9",
+        summary: "High-risk system lacks documented adversarial-testing evidence (Art. 9 risk mgmt).",
+        remediation: "Run redTeamDataset() + attach the report."
+      });
+    }
+    if (ctx.datasets.length === 0) {
+      findings.push({
+        id: "EU-ART-10",
+        severity: "high",
+        control: "EU-AI-ACT:Article-10",
+        summary: "No training/eval datasets recorded with provenance (Art. 10)."
+      });
+    }
+    const runs = await ctx.traceStore.listRuns({
+      since: Date.parse(ctx.periodStart),
+      until: Date.parse(ctx.periodEnd)
+    });
+    if (runs.length === 0) {
+      findings.push({
+        id: "EU-ART-11",
+        severity: "high",
+        control: "EU-AI-ACT:Article-11",
+        summary: "No eval runs recorded (Art. 11 technical documentation)."
+      });
+    }
+    if (!signals.chatbot && !signals.generatesSyntheticMedia) {
+    } else {
+      findings.push({
+        id: "EU-ART-13",
+        severity: "info",
+        control: "EU-AI-ACT:Article-13",
+        summary: "Chatbot/synthetic-media transparency obligations apply; verify user-facing disclosures."
+      });
+    }
+    if (!ctx.owner?.email) {
+      findings.push({
+        id: "EU-ART-14",
+        severity: "high",
+        control: "EU-AI-ACT:Article-14",
+        summary: "No designated human overseer (Art. 14).",
+        remediation: "Populate GovernanceContext.owner with the responsible individual."
+      });
+    }
+    if (!ctx.outcomeStore) {
+      findings.push({
+        id: "EU-ART-15",
+        severity: "medium",
+        control: "EU-AI-ACT:Article-15",
+        summary: "No post-deployment outcome measurement; accuracy + robustness are un-attested.",
+        remediation: "Attach an OutcomeStore + run correlationStudy() over the reporting period."
+      });
+    }
+  }
+  if (riskClass === "limited") {
+    findings.push({
+      id: "EU-ART-52",
+      severity: "info",
+      control: "EU-AI-ACT:Article-52",
+      summary: "Transparency obligations apply: disclose AI nature + synthetic content labeling.",
+      remediation: "Ensure user-facing surfaces label AI-generated content."
+    });
+  }
+  const payload = {
+    riskClass,
+    signals,
+    articlesReviewed: riskClass === "high" ? ["5", "9", "10", "11", "13", "14", "15"] : riskClass === "limited" ? ["52"] : ["none"]
+  };
+  return {
+    framework: "EU-AI-ACT",
+    version: "Regulation-2024-1689",
+    context: {
+      organization: ctx.organization,
+      systemName: ctx.systemName,
+      periodStart: ctx.periodStart,
+      periodEnd: ctx.periodEnd,
+      owner: ctx.owner
+    },
+    summary: summarize(findings),
+    findings,
+    payload,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/governance/nist-ai-rmf.ts
+async function nistAiRmfReport(ctx) {
+  const findings = [];
+  if (!ctx.owner?.email) {
+    findings.push({
+      id: "G-1.1",
+      severity: "high",
+      control: "NIST-AI-RMF:GOVERN-1.1",
+      summary: "No responsible owner recorded for the AI system.",
+      remediation: "Assign an accountable individual + email in GovernanceContext.owner."
+    });
+  }
+  if (ctx.datasets.length === 0) {
+    findings.push({
+      id: "G-1.3",
+      severity: "high",
+      control: "NIST-AI-RMF:GOVERN-1.3",
+      summary: "No versioned datasets recorded for the evaluation period.",
+      remediation: "Register each dataset with a Dataset manifest (content hash + provenance)."
+    });
+  } else {
+    for (const manifest of ctx.datasets) {
+      if (!manifest.contentHash || manifest.contentHash.length < 16) {
+        findings.push({
+          id: "G-1.3-hash",
+          severity: "medium",
+          control: "NIST-AI-RMF:GOVERN-1.3",
+          summary: `Dataset "${manifest.name}" has weak or missing content hash.`,
+          evidence: `contentHash="${manifest.contentHash}"`,
+          remediation: "Call dataset.manifest() to compute SHA-256; commit the manifest alongside releases."
+        });
+      }
+    }
+  }
+  if (!ctx.redTeam) {
+    findings.push({
+      id: "M-2.6",
+      severity: "high",
+      control: "NIST-AI-RMF:MEASURE-2.6",
+      summary: "No red-team evaluation attached to the report period.",
+      remediation: "Run redTeamDataset() against the system and attach the RedTeamReport to context.redTeam."
+    });
+  } else if (ctx.redTeam.overallPassRate < 0.8) {
+    findings.push({
+      id: "M-2.6-rate",
+      severity: "high",
+      control: "NIST-AI-RMF:MEASURE-2.6",
+      summary: `Red-team pass rate ${(ctx.redTeam.overallPassRate * 100).toFixed(1)}% below 80% threshold.`,
+      evidence: JSON.stringify(ctx.redTeam.passRateByCategory),
+      remediation: "Harden the failing categories; rerun the battery."
+    });
+  }
+  const runs = await ctx.traceStore.listRuns({
+    since: Date.parse(ctx.periodStart),
+    until: Date.parse(ctx.periodEnd)
+  });
+  if (runs.length === 0) {
+    findings.push({
+      id: "M-2.1",
+      severity: "critical",
+      control: "NIST-AI-RMF:MEASURE-2.1",
+      summary: "No eval runs recorded for the reporting period.",
+      remediation: "Emit traces for every deployment-relevant evaluation."
+    });
+  }
+  if (!ctx.judgeCalibration || ctx.judgeCalibration.length === 0) {
+    findings.push({
+      id: "M-2.11",
+      severity: "medium",
+      control: "NIST-AI-RMF:MEASURE-2.11",
+      summary: "No judge-vs-human calibration recorded.",
+      remediation: "Build a human golden set; run calibrateJudge() before trusting LLM judge scores."
+    });
+  } else {
+    const weak = ctx.judgeCalibration.filter((c) => Number.isFinite(c.pearson) && c.pearson < 0.6);
+    if (weak.length > 0) {
+      findings.push({
+        id: "M-2.11-weak",
+        severity: "medium",
+        control: "NIST-AI-RMF:MEASURE-2.11",
+        summary: `${weak.length} judge(s) show weak agreement with humans (Pearson < 0.6).`,
+        remediation: "Retrain or replace the underperforming judges."
+      });
+    }
+  }
+  if (!ctx.outcomeStore) {
+    findings.push({
+      id: "MN-1.1",
+      severity: "medium",
+      control: "NIST-AI-RMF:MANAGE-1.1",
+      summary: "No deployment outcomes captured \u2014 meta-eval correlation cannot be computed.",
+      remediation: "Attach an OutcomeStore and ingest production outcome metrics."
+    });
+  } else {
+    const outcomes = await ctx.outcomeStore.list({
+      since: Date.parse(ctx.periodStart),
+      until: Date.parse(ctx.periodEnd)
+    });
+    if (outcomes.length === 0) {
+      findings.push({
+        id: "MN-1.1-empty",
+        severity: "medium",
+        control: "NIST-AI-RMF:MANAGE-1.1",
+        summary: "OutcomeStore present but no outcomes captured for the period."
+      });
+    }
+  }
+  const hashChecks = [];
+  for (const manifest of ctx.datasets) {
+    hashChecks.push({ name: manifest.name, ok: /^[0-9a-f]{64}$/.test(manifest.contentHash) });
+  }
+  const payload = {
+    controlsEvaluated: [
+      "GOVERN-1.1",
+      "GOVERN-1.3",
+      "MEASURE-2.1",
+      "MEASURE-2.6",
+      "MEASURE-2.11",
+      "MANAGE-1.1"
+    ],
+    runCount: runs.length,
+    redTeamPassRate: ctx.redTeam?.overallPassRate ?? null,
+    datasetHashChecks: hashChecks
+  };
+  return {
+    framework: "NIST-AI-RMF",
+    version: "1.0.0",
+    context: {
+      organization: ctx.organization,
+      systemName: ctx.systemName,
+      periodStart: ctx.periodStart,
+      periodEnd: ctx.periodEnd,
+      owner: ctx.owner
+    },
+    summary: summarize(findings),
+    findings,
+    payload,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/governance/soc2.ts
+async function soc2Report(ctx) {
+  const findings = [];
+  const start = Date.parse(ctx.periodStart);
+  const end = Date.parse(ctx.periodEnd);
+  const runs = await ctx.traceStore.listRuns({ since: start, until: end });
+  const failureRate = runs.length > 0 ? runs.filter((r) => r.outcome?.pass === false).length / runs.length : null;
+  if (failureRate !== null && failureRate > 0.2) {
+    findings.push({
+      id: "CC7.1-fail-rate",
+      severity: "medium",
+      control: "SOC2:CC7.1",
+      summary: `System failure rate ${(failureRate * 100).toFixed(1)}% over the period exceeds 20%.`,
+      remediation: "Investigate failure clusters (failureClusterView) + prioritize remediation."
+    });
+  }
+  if (runs.length === 0) {
+    findings.push({
+      id: "CC7.1-coverage",
+      severity: "high",
+      control: "SOC2:CC7.1",
+      summary: "No telemetry runs recorded for the period \u2014 monitoring regime is incomplete."
+    });
+  }
+  const aborted = runs.filter((r) => r.status === "aborted");
+  if (aborted.length > runs.length * 0.05 && aborted.length >= 3) {
+    findings.push({
+      id: "CC7.2-abort",
+      severity: "medium",
+      control: "SOC2:CC7.2",
+      summary: `${aborted.length} run(s) aborted \u2014 investigate pattern.`,
+      remediation: "Use the bisector + failureClusterView to localize the trigger."
+    });
+  }
+  const incidentEvents = await ctx.traceStore.events({
+    kind: "policy_violation",
+    since: start,
+    until: end
+  });
+  const errorEvents = await ctx.traceStore.events({ kind: "error", since: start, until: end });
+  const totalIncidents = incidentEvents.length + errorEvents.length;
+  if (totalIncidents > 0) {
+    findings.push({
+      id: "CC7.3-resolution",
+      severity: "low",
+      control: "SOC2:CC7.3",
+      summary: `${totalIncidents} incident-class event(s) recorded; resolution tracking is informal.`,
+      remediation: 'Emit a resolution event (kind="log" with payload.resolves=<eventId>) per remediated incident.'
+    });
+  }
+  const modelFingerprints = new Set(runs.map((r) => r.modelFingerprint).filter(Boolean));
+  const promptHashes = new Set(runs.map((r) => r.promptSha).filter(Boolean));
+  const codeSha = new Set(runs.map((r) => r.codeSha).filter(Boolean));
+  if (codeSha.size === 0) {
+    findings.push({
+      id: "CC7.4-code",
+      severity: "high",
+      control: "SOC2:CC7.4",
+      summary: "No codeSha recorded on runs \u2014 cannot attribute scores to a specific release.",
+      remediation: "Populate Run.codeSha with the git SHA of the system at run time."
+    });
+  }
+  if (promptHashes.size === 0) {
+    findings.push({
+      id: "CC7.4-prompt",
+      severity: "medium",
+      control: "SOC2:CC7.4",
+      summary: "No promptSha recorded \u2014 prompt changes are untracked."
+    });
+  }
+  const payload = {
+    controls: ["CC7.1", "CC7.2", "CC7.3", "CC7.4"],
+    runCount: runs.length,
+    failureRate,
+    abortedCount: aborted.length,
+    incidentEventCount: totalIncidents,
+    distinctReleases: {
+      codeShas: codeSha.size,
+      promptHashes: promptHashes.size,
+      modelFingerprints: modelFingerprints.size
+    }
+  };
+  return {
+    framework: "SOC2",
+    version: "2017-Common-Criteria",
+    context: {
+      organization: ctx.organization,
+      systemName: ctx.systemName,
+      periodStart: ctx.periodStart,
+      periodEnd: ctx.periodEnd,
+      owner: ctx.owner
+    },
+    summary: summarize(findings),
+    findings,
+    payload,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+export {
+  renderMarkdown,
+  summarize,
+  classifyEuAiRisk,
+  euAiActReport,
+  nistAiRmfReport,
+  soc2Report
+};
+//# sourceMappingURL=chunk-KKHDIONI.js.map

package/dist/chunk-KKHDIONI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/governance/types.ts","../src/governance/eu-ai-act.ts","../src/governance/nist-ai-rmf.ts","../src/governance/soc2.ts"],"sourcesContent":["/**\n * Governance reporting — shared types.\n *\n * The framework collects a `GovernanceContext` (traces + outcomes +\n * dataset manifests + red-team results + judge calibration) and each\n * specific template (NIST AI RMF, SOC2, EU AI Act) renders a\n * structured report from it.\n *\n * Reports are machine-readable JSON first; human-readable Markdown is a\n * pure transform on top. External auditors consume the Markdown; CI\n * consumes the JSON.\n */\n\nimport type { DatasetManifest } from '../dataset'\nimport type { CalibrationResult } from '../judge-calibration'\nimport type { OutcomeStore } from '../meta-eval/outcome-store'\nimport type { RedTeamReport } from '../red-team'\nimport type { TraceStore } from '../trace/store'\n\nexport interface GovernanceContext {\n  /** Legal / org identity for the report. */\n  organization: string\n  /** System / agent identifier. */\n  systemName: string\n  /** ISO8601 period the report covers. */\n  periodStart: string\n  periodEnd: string\n  /** Versioned dataset manifests used during the period. */\n  datasets: DatasetManifest[]\n  traceStore: TraceStore\n  outcomeStore?: OutcomeStore\n  /** Cached red-team results for the period, if available. */\n  redTeam?: RedTeamReport\n  /** Judge-vs-human calibration results, if measured. */\n  judgeCalibration?: CalibrationResult[]\n  /** Responsible owner for the system — role + name + email. */\n  owner: { role: string; name: string; email: string }\n}\n\nexport interface GovernanceFinding {\n  id: string\n  severity: 'info' | 'low' | 'medium' | 'high' | 'critical'\n  /** Control reference the finding maps to (e.g. \"NIST-AI-RMF:MEASURE-2.1\"). */\n  control: string\n  summary: string\n  evidence?: string\n  remediation?: string\n}\n\nexport interface GovernanceReport {\n  framework: 'NIST-AI-RMF' | 'SOC2' | 'EU-AI-ACT'\n  version: string\n  context: Pick<\n    GovernanceContext,\n    'organization' | 'systemName' | 'periodStart' | 'periodEnd' | 'owner'\n  >\n  summary: {\n    findings: number\n    byeverity: Record<GovernanceFinding['severity'], number>\n    overall: 'compliant' | 'compliant-with-findings' | 'non-compliant'\n  }\n  findings: GovernanceFinding[]\n  /** Framework-specific structured payload (mapped controls, risk class, etc.). */\n  payload: Record<string, unknown>\n  generatedAt: string\n}\n\nexport function renderMarkdown(report: GovernanceReport): string {\n  const sevEmoji: Record<GovernanceFinding['severity'], string> = {\n    info: 'ℹ︎',\n    low: '·',\n    medium: '!',\n    high: '!!',\n    critical: '‼',\n  }\n  const lines: string[] = []\n  lines.push(`# ${report.framework} report — ${report.context.systemName}`)\n  lines.push('')\n  lines.push(`- Organization: **${report.context.organization}**`)\n  lines.push(`- Period: ${report.context.periodStart} → ${report.context.periodEnd}`)\n  lines.push(\n    `- Owner: ${report.context.owner.role} ${report.context.owner.name} <${report.context.owner.email}>`,\n  )\n  lines.push(`- Generated: ${report.generatedAt}`)\n  lines.push('')\n  lines.push(`## Summary — ${report.summary.overall}`)\n  lines.push('')\n  lines.push(`${report.summary.findings} finding(s).`)\n  for (const [sev, n] of Object.entries(report.summary.byeverity) as Array<\n    [GovernanceFinding['severity'], number]\n  >) {\n    if (n > 0) lines.push(`- ${sevEmoji[sev]} ${sev}: ${n}`)\n  }\n  lines.push('')\n  lines.push('## Findings')\n  lines.push('')\n  for (const f of report.findings) {\n    lines.push(`### ${sevEmoji[f.severity]} ${f.id} — ${f.control}`)\n    lines.push('')\n    lines.push(f.summary)\n    if (f.evidence) {\n      lines.push('')\n      lines.push(`**Evidence:** ${f.evidence}`)\n    }\n    if (f.remediation) {\n      lines.push('')\n      lines.push(`**Remediation:** ${f.remediation}`)\n    }\n    lines.push('')\n  }\n  return lines.join('\\n')\n}\n\nexport function summarize(findings: GovernanceFinding[]): GovernanceReport['summary'] {\n  const byeverity: GovernanceReport['summary']['byeverity'] = {\n    info: 0,\n    low: 0,\n    medium: 0,\n    high: 0,\n    critical: 0,\n  }\n  for (const f of findings) byeverity[f.severity]++\n  const overall: GovernanceReport['summary']['overall'] =\n    byeverity.critical + byeverity.high > 0\n      ? 'non-compliant'\n      : byeverity.medium + byeverity.low > 0\n        ? 'compliant-with-findings'\n        : 'compliant'\n  return { findings: findings.length, byeverity, overall }\n}\n","/**\n * EU AI Act — risk-class classification + compliance checklist.\n *\n * Classification is declarative: caller supplies the domain/use-case\n * signals (biometric? critical infrastructure? education? employment?\n * access to services?) and we map to the Act's risk tiers:\n *   - \"unacceptable\" (prohibited)\n *   - \"high\"        (Annex III — strict obligations)\n *   - \"limited\"     (transparency obligations)\n *   - \"minimal\"     (voluntary codes of conduct)\n *\n * Then the compliance checklist enumerates Article 9 (risk mgmt),\n * 10 (data + data governance), 11 (technical documentation), 13\n * (transparency), 14 (human oversight), 15 (accuracy + robustness)\n * requirements and flags gaps.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport type EuRiskClass = 'unacceptable' | 'high' | 'limited' | 'minimal'\n\nexport interface UseCaseSignals {\n  /** Used for biometric identification in public spaces? (Art. 5 — unacceptable). */\n  biometricPublic?: boolean\n  /** Social scoring by public authorities? (Art. 5). */\n  socialScoring?: boolean\n  /** Subliminal manipulation? (Art. 5). */\n  subliminal?: boolean\n  /** Annex III sector: critical infrastructure / education / employment /\n   *  access to essential services / law enforcement / migration /\n   *  administration of justice / democratic processes? */\n  annexIII?: boolean\n  /** Interacts directly with natural persons (chatbot, agent)? — limited risk. */\n  chatbot?: boolean\n  /** Generates synthetic media (image/audio/video/text deepfakes)? — limited risk. */\n  generatesSyntheticMedia?: boolean\n}\n\nexport function classifyEuAiRisk(signals: UseCaseSignals): EuRiskClass {\n  if (signals.biometricPublic || signals.socialScoring || signals.subliminal) return 'unacceptable'\n  if (signals.annexIII) return 'high'\n  if (signals.chatbot || signals.generatesSyntheticMedia) return 'limited'\n  return 'minimal'\n}\n\nexport async function euAiActReport(\n  ctx: GovernanceContext,\n  signals: UseCaseSignals,\n): Promise<GovernanceReport> {\n  const riskClass = classifyEuAiRisk(signals)\n  const findings: GovernanceFinding[] = []\n\n  if (riskClass === 'unacceptable') {\n    findings.push({\n      id: 'EU-ART-5',\n      severity: 'critical',\n      control: 'EU-AI-ACT:Article-5',\n      summary: 'Use case matches a prohibited practice under Article 5.',\n      remediation: 'Discontinue or substantially redesign the use case.',\n    })\n  }\n\n  if (riskClass === 'high') {\n    // Article 9 — risk management\n    if (!ctx.redTeam) {\n      findings.push({\n        id: 'EU-ART-9',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-9',\n        summary:\n          'High-risk system lacks documented adversarial-testing evidence (Art. 9 risk mgmt).',\n        remediation: 'Run redTeamDataset() + attach the report.',\n      })\n    }\n    // Article 10 — data + data governance\n    if (ctx.datasets.length === 0) {\n      findings.push({\n        id: 'EU-ART-10',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-10',\n        summary: 'No training/eval datasets recorded with provenance (Art. 10).',\n      })\n    }\n    // Article 11 — technical documentation (traces + runs)\n    const runs = await ctx.traceStore.listRuns({\n      since: Date.parse(ctx.periodStart),\n      until: Date.parse(ctx.periodEnd),\n    })\n    if (runs.length === 0) {\n      findings.push({\n        id: 'EU-ART-11',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-11',\n        summary: 'No eval runs recorded (Art. 11 technical documentation).',\n      })\n    }\n    // Article 13 — transparency to users\n    if (!signals.chatbot && !signals.generatesSyntheticMedia) {\n      // High-risk but not a chatbot — transparency may still apply; flag informational\n    } else {\n      findings.push({\n        id: 'EU-ART-13',\n        severity: 'info',\n        control: 'EU-AI-ACT:Article-13',\n        summary:\n          'Chatbot/synthetic-media transparency obligations apply; verify user-facing disclosures.',\n      })\n    }\n    // Article 14 — human oversight\n    if (!ctx.owner?.email) {\n      findings.push({\n        id: 'EU-ART-14',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-14',\n        summary: 'No designated human overseer (Art. 14).',\n        remediation: 'Populate GovernanceContext.owner with the responsible individual.',\n      })\n    }\n    // Article 15 — accuracy + robustness\n    if (!ctx.outcomeStore) {\n      findings.push({\n        id: 'EU-ART-15',\n        severity: 'medium',\n        control: 'EU-AI-ACT:Article-15',\n        summary: 'No post-deployment outcome measurement; accuracy + robustness are un-attested.',\n        remediation: 'Attach an OutcomeStore + run correlationStudy() over the reporting period.',\n      })\n    }\n  }\n\n  if (riskClass === 'limited') {\n    findings.push({\n      id: 'EU-ART-52',\n      severity: 'info',\n      control: 'EU-AI-ACT:Article-52',\n      summary: 'Transparency obligations apply: disclose AI nature + synthetic content labeling.',\n      remediation: 'Ensure user-facing surfaces label AI-generated content.',\n    })\n  }\n\n  const payload = {\n    riskClass,\n    signals,\n    articlesReviewed:\n      riskClass === 'high'\n        ? ['5', '9', '10', '11', '13', '14', '15']\n        : riskClass === 'limited'\n          ? ['52']\n          : ['none'],\n  }\n\n  return {\n    framework: 'EU-AI-ACT',\n    version: 'Regulation-2024-1689',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n","/**\n * NIST AI RMF 1.0 — Govern / Map / Measure / Manage mapping.\n *\n * Each subcategory derives its status from concrete framework state:\n *   MEASURE 2.x: do we have a calibration regime? contamination controls?\n *   MEASURE 2.7: are red-team results available?\n *   MANAGE 1.x: are outcome metrics captured? correlation measured?\n *   GOVERN 1.x: dataset + prompt provenance recorded?\n *\n * We ship the mapping and the derivation rules; consumers supply the\n * GovernanceContext.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport async function nistAiRmfReport(ctx: GovernanceContext): Promise<GovernanceReport> {\n  const findings: GovernanceFinding[] = []\n\n  // GOVERN 1.1 — \"Accountable individual identified\"\n  if (!ctx.owner?.email) {\n    findings.push({\n      id: 'G-1.1',\n      severity: 'high',\n      control: 'NIST-AI-RMF:GOVERN-1.1',\n      summary: 'No responsible owner recorded for the AI system.',\n      remediation: 'Assign an accountable individual + email in GovernanceContext.owner.',\n    })\n  }\n\n  // GOVERN 1.3 — \"Inventory + lifecycle tracking\"\n  if (ctx.datasets.length === 0) {\n    findings.push({\n      id: 'G-1.3',\n      severity: 'high',\n      control: 'NIST-AI-RMF:GOVERN-1.3',\n      summary: 'No versioned datasets recorded for the evaluation period.',\n      remediation: 'Register each dataset with a Dataset manifest (content hash + provenance).',\n    })\n  } else {\n    // Validate content hashes are stable\n    for (const manifest of ctx.datasets) {\n      if (!manifest.contentHash || manifest.contentHash.length < 16) {\n        findings.push({\n          id: 'G-1.3-hash',\n          severity: 'medium',\n          control: 'NIST-AI-RMF:GOVERN-1.3',\n          summary: `Dataset \"${manifest.name}\" has weak or missing content hash.`,\n          evidence: `contentHash=\"${manifest.contentHash}\"`,\n          remediation:\n            'Call dataset.manifest() to compute SHA-256; commit the manifest alongside releases.',\n        })\n      }\n    }\n  }\n\n  // MEASURE 2.6 — \"Safety + adversarial testing\"\n  if (!ctx.redTeam) {\n    findings.push({\n      id: 'M-2.6',\n      severity: 'high',\n      control: 'NIST-AI-RMF:MEASURE-2.6',\n      summary: 'No red-team evaluation attached to the report period.',\n      remediation:\n        'Run redTeamDataset() against the system and attach the RedTeamReport to context.redTeam.',\n    })\n  } else if (ctx.redTeam.overallPassRate < 0.8) {\n    findings.push({\n      id: 'M-2.6-rate',\n      severity: 'high',\n      control: 'NIST-AI-RMF:MEASURE-2.6',\n      summary: `Red-team pass rate ${(ctx.redTeam.overallPassRate * 100).toFixed(1)}% below 80% threshold.`,\n      evidence: JSON.stringify(ctx.redTeam.passRateByCategory),\n      remediation: 'Harden the failing categories; rerun the battery.',\n    })\n  }\n\n  // MEASURE 2.1 — \"Test results against defined metrics\"\n  const runs = await ctx.traceStore.listRuns({\n    since: Date.parse(ctx.periodStart),\n    until: Date.parse(ctx.periodEnd),\n  })\n  if (runs.length === 0) {\n    findings.push({\n      id: 'M-2.1',\n      severity: 'critical',\n      control: 'NIST-AI-RMF:MEASURE-2.1',\n      summary: 'No eval runs recorded for the reporting period.',\n      remediation: 'Emit traces for every deployment-relevant evaluation.',\n    })\n  }\n\n  // MEASURE 2.11 — \"Calibration + validation regime\"\n  if (!ctx.judgeCalibration || ctx.judgeCalibration.length === 0) {\n    findings.push({\n      id: 'M-2.11',\n      severity: 'medium',\n      control: 'NIST-AI-RMF:MEASURE-2.11',\n      summary: 'No judge-vs-human calibration recorded.',\n      remediation:\n        'Build a human golden set; run calibrateJudge() before trusting LLM judge scores.',\n    })\n  } else {\n    const weak = ctx.judgeCalibration.filter((c) => Number.isFinite(c.pearson) && c.pearson < 0.6)\n    if (weak.length > 0) {\n      findings.push({\n        id: 'M-2.11-weak',\n        severity: 'medium',\n        control: 'NIST-AI-RMF:MEASURE-2.11',\n        summary: `${weak.length} judge(s) show weak agreement with humans (Pearson < 0.6).`,\n        remediation: 'Retrain or replace the underperforming judges.',\n      })\n    }\n  }\n\n  // MANAGE 1.1 — \"Outcomes tracked post-deployment\"\n  if (!ctx.outcomeStore) {\n    findings.push({\n      id: 'MN-1.1',\n      severity: 'medium',\n      control: 'NIST-AI-RMF:MANAGE-1.1',\n      summary: 'No deployment outcomes captured — meta-eval correlation cannot be computed.',\n      remediation: 'Attach an OutcomeStore and ingest production outcome metrics.',\n    })\n  } else {\n    const outcomes = await ctx.outcomeStore.list({\n      since: Date.parse(ctx.periodStart),\n      until: Date.parse(ctx.periodEnd),\n    })\n    if (outcomes.length === 0) {\n      findings.push({\n        id: 'MN-1.1-empty',\n        severity: 'medium',\n        control: 'NIST-AI-RMF:MANAGE-1.1',\n        summary: 'OutcomeStore present but no outcomes captured for the period.',\n      })\n    }\n  }\n\n  // Validate that dataset manifests carry strong SHA-256-shaped content hashes.\n  const hashChecks: Array<{ name: string; ok: boolean }> = []\n  for (const manifest of ctx.datasets) {\n    // We don't persist the scenarios here; the check is that the caller's\n    // manifest already carries a hash in the expected hex format.\n    hashChecks.push({ name: manifest.name, ok: /^[0-9a-f]{64}$/.test(manifest.contentHash) })\n  }\n\n  const payload = {\n    controlsEvaluated: [\n      'GOVERN-1.1',\n      'GOVERN-1.3',\n      'MEASURE-2.1',\n      'MEASURE-2.6',\n      'MEASURE-2.11',\n      'MANAGE-1.1',\n    ],\n    runCount: runs.length,\n    redTeamPassRate: ctx.redTeam?.overallPassRate ?? null,\n    datasetHashChecks: hashChecks,\n  }\n\n  return {\n    framework: 'NIST-AI-RMF',\n    version: '1.0.0',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n","/**\n * SOC 2 — Common Criteria 7 (system operations + change management)\n * audit trail derived from the trace corpus.\n *\n * This is NOT a formal SOC2 report — that requires an external\n * auditor. What we ship is the machine-readable *evidence* package\n * that an auditor consumes: run counts, deploy events, access log\n * summary, anomaly tracking, response-time SLOs.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport async function soc2Report(ctx: GovernanceContext): Promise<GovernanceReport> {\n  const findings: GovernanceFinding[] = []\n  const start = Date.parse(ctx.periodStart)\n  const end = Date.parse(ctx.periodEnd)\n  const runs = await ctx.traceStore.listRuns({ since: start, until: end })\n\n  // CC7.1 — \"Monitoring to detect anomalies\"\n  const failureRate =\n    runs.length > 0 ? runs.filter((r) => r.outcome?.pass === false).length / runs.length : null\n  if (failureRate !== null && failureRate > 0.2) {\n    findings.push({\n      id: 'CC7.1-fail-rate',\n      severity: 'medium',\n      control: 'SOC2:CC7.1',\n      summary: `System failure rate ${(failureRate * 100).toFixed(1)}% over the period exceeds 20%.`,\n      remediation: 'Investigate failure clusters (failureClusterView) + prioritize remediation.',\n    })\n  }\n  if (runs.length === 0) {\n    findings.push({\n      id: 'CC7.1-coverage',\n      severity: 'high',\n      control: 'SOC2:CC7.1',\n      summary: 'No telemetry runs recorded for the period — monitoring regime is incomplete.',\n    })\n  }\n\n  // CC7.2 — \"Anomaly investigation\"\n  const aborted = runs.filter((r) => r.status === 'aborted')\n  if (aborted.length > runs.length * 0.05 && aborted.length >= 3) {\n    findings.push({\n      id: 'CC7.2-abort',\n      severity: 'medium',\n      control: 'SOC2:CC7.2',\n      summary: `${aborted.length} run(s) aborted — investigate pattern.`,\n      remediation: 'Use the bisector + failureClusterView to localize the trigger.',\n    })\n  }\n\n  // CC7.3 — \"Response to incidents\" — require an event tag for resolved incidents\n  const incidentEvents = await ctx.traceStore.events({\n    kind: 'policy_violation',\n    since: start,\n    until: end,\n  })\n  const errorEvents = await ctx.traceStore.events({ kind: 'error', since: start, until: end })\n  const totalIncidents = incidentEvents.length + errorEvents.length\n  if (totalIncidents > 0) {\n    // No formal resolution tracking yet — flag medium by default\n    findings.push({\n      id: 'CC7.3-resolution',\n      severity: 'low',\n      control: 'SOC2:CC7.3',\n      summary: `${totalIncidents} incident-class event(s) recorded; resolution tracking is informal.`,\n      remediation:\n        'Emit a resolution event (kind=\"log\" with payload.resolves=<eventId>) per remediated incident.',\n    })\n  }\n\n  // CC7.4 — \"Configuration change tracking\"\n  const modelFingerprints = new Set(runs.map((r) => r.modelFingerprint).filter(Boolean) as string[])\n  const promptHashes = new Set(runs.map((r) => r.promptSha).filter(Boolean) as string[])\n  const codeSha = new Set(runs.map((r) => r.codeSha).filter(Boolean) as string[])\n  if (codeSha.size === 0) {\n    findings.push({\n      id: 'CC7.4-code',\n      severity: 'high',\n      control: 'SOC2:CC7.4',\n      summary: 'No codeSha recorded on runs — cannot attribute scores to a specific release.',\n      remediation: 'Populate Run.codeSha with the git SHA of the system at run time.',\n    })\n  }\n  if (promptHashes.size === 0) {\n    findings.push({\n      id: 'CC7.4-prompt',\n      severity: 'medium',\n      control: 'SOC2:CC7.4',\n      summary: 'No promptSha recorded — prompt changes are untracked.',\n    })\n  }\n\n  const payload = {\n    controls: ['CC7.1', 'CC7.2', 'CC7.3', 'CC7.4'],\n    runCount: runs.length,\n    failureRate,\n    abortedCount: aborted.length,\n    incidentEventCount: totalIncidents,\n    distinctReleases: {\n      codeShas: codeSha.size,\n      promptHashes: promptHashes.size,\n      modelFingerprints: modelFingerprints.size,\n    },\n  }\n\n  return {\n    framework: 'SOC2',\n    version: '2017-Common-Criteria',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n"],"mappings":";AAmEO,SAAS,eAAe,QAAkC;AAC/D,QAAM,WAA0D;AAAA,IAC9D,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,KAAK,OAAO,SAAS,kBAAa,OAAO,QAAQ,UAAU,EAAE;AACxE,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qBAAqB,OAAO,QAAQ,YAAY,IAAI;AAC/D,QAAM,KAAK,aAAa,OAAO,QAAQ,WAAW,WAAM,OAAO,QAAQ,SAAS,EAAE;AAClF,QAAM;AAAA,IACJ,YAAY,OAAO,QAAQ,MAAM,IAAI,IAAI,OAAO,QAAQ,MAAM,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK;AAAA,EACnG;AACA,QAAM,KAAK,gBAAgB,OAAO,WAAW,EAAE;AAC/C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qBAAgB,OAAO,QAAQ,OAAO,EAAE;AACnD,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,GAAG,OAAO,QAAQ,QAAQ,cAAc;AACnD,aAAW,CAAC,KAAK,CAAC,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAE3D;AACD,QAAI,IAAI,EAAG,OAAM,KAAK,KAAK,SAAS,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE;AAAA,EACzD;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,aAAa;AACxB,QAAM,KAAK,EAAE;AACb,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,KAAK,OAAO,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,WAAM,EAAE,OAAO,EAAE;AAC/D,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,EAAE,OAAO;AACpB,QAAI,EAAE,UAAU;AACd,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,iBAAiB,EAAE,QAAQ,EAAE;AAAA,IAC1C;AACA,QAAI,EAAE,aAAa;AACjB,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,oBAAoB,EAAE,WAAW,EAAE;AAAA,IAChD;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,UAAU,UAA4D;AACpF,QAAM,YAAsD;AAAA,IAC1D,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AACA,aAAW,KAAK,SAAU,WAAU,EAAE,QAAQ;AAC9C,QAAM,UACJ,UAAU,WAAW,UAAU,OAAO,IAClC,kBACA,UAAU,SAAS,UAAU,MAAM,IACjC,4BACA;AACR,SAAO,EAAE,UAAU,SAAS,QAAQ,WAAW,QAAQ;AACzD;;;AC1FO,SAAS,iBAAiB,SAAsC;AACrE,MAAI,QAAQ,mBAAmB,QAAQ,iBAAiB,QAAQ,WAAY,QAAO;AACnF,MAAI,QAAQ,SAAU,QAAO;AAC7B,MAAI,QAAQ,WAAW,QAAQ,wBAAyB,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,cACpB,KACA,SAC2B;AAC3B,QAAM,YAAY,iBAAiB,OAAO;AAC1C,QAAM,WAAgC,CAAC;AAEvC,MAAI,cAAc,gBAAgB;AAChC,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,MAAI,cAAc,QAAQ;AAExB,QAAI,CAAC,IAAI,SAAS;AAChB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SACE;AAAA,QACF,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,IAAI,WAAW,SAAS;AAAA,MACzC,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,MACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,IACjC,CAAC;AACD,QAAI,KAAK,WAAW,GAAG;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,yBAAyB;AAAA,IAE1D,OAAO;AACL,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,IAAI,OAAO,OAAO;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,IAAI,cAAc;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,cAAc,WAAW;AAC3B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,kBACE,cAAc,SACV,CAAC,KAAK,KAAK,MAAM,MAAM,MAAM,MAAM,IAAI,IACvC,cAAc,YACZ,CAAC,IAAI,IACL,CAAC,MAAM;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACvJA,eAAsB,gBAAgB,KAAmD;AACvF,QAAM,WAAgC,CAAC;AAGvC,MAAI,CAAC,IAAI,OAAO,OAAO;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,MAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH,OAAO;AAEL,eAAW,YAAY,IAAI,UAAU;AACnC,UAAI,CAAC,SAAS,eAAe,SAAS,YAAY,SAAS,IAAI;AAC7D,iBAAS,KAAK;AAAA,UACZ,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,SAAS;AAAA,UACT,SAAS,YAAY,SAAS,IAAI;AAAA,UAClC,UAAU,gBAAgB,SAAS,WAAW;AAAA,UAC9C,aACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,IAAI,SAAS;AAChB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH,WAAW,IAAI,QAAQ,kBAAkB,KAAK;AAC5C,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,uBAAuB,IAAI,QAAQ,kBAAkB,KAAK,QAAQ,CAAC,CAAC;AAAA,MAC7E,UAAU,KAAK,UAAU,IAAI,QAAQ,kBAAkB;AAAA,MACvD,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,QAAM,OAAO,MAAM,IAAI,WAAW,SAAS;AAAA,IACzC,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,IACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC,CAAC;AACD,MAAI,KAAK,WAAW,GAAG;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,IAAI,oBAAoB,IAAI,iBAAiB,WAAW,GAAG;AAC9D,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH,OAAO;AACL,UAAM,OAAO,IAAI,iBAAiB,OAAO,CAAC,MAAM,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,UAAU,GAAG;AAC7F,QAAI,KAAK,SAAS,GAAG;AACnB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS,GAAG,KAAK,MAAM;AAAA,QACvB,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,IAAI,cAAc;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH,OAAO;AACL,UAAM,WAAW,MAAM,IAAI,aAAa,KAAK;AAAA,MAC3C,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,MACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,IACjC,CAAC;AACD,QAAI,SAAS,WAAW,GAAG;AACzB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,aAAmD,CAAC;AAC1D,aAAW,YAAY,IAAI,UAAU;AAGnC,eAAW,KAAK,EAAE,MAAM,SAAS,MAAM,IAAI,iBAAiB,KAAK,SAAS,WAAW,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,UAAU;AAAA,IACd,mBAAmB;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU,KAAK;AAAA,IACf,iBAAiB,IAAI,SAAS,mBAAmB;AAAA,IACjD,mBAAmB;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACnKA,eAAsB,WAAW,KAAmD;AAClF,QAAM,WAAgC,CAAC;AACvC,QAAM,QAAQ,KAAK,MAAM,IAAI,WAAW;AACxC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS;AACpC,QAAM,OAAO,MAAM,IAAI,WAAW,SAAS,EAAE,OAAO,OAAO,OAAO,IAAI,CAAC;AAGvE,QAAM,cACJ,KAAK,SAAS,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,KAAK,EAAE,SAAS,KAAK,SAAS;AACzF,MAAI,gBAAgB,QAAQ,cAAc,KAAK;AAC7C,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,wBAAwB,cAAc,KAAK,QAAQ,CAAC,CAAC;AAAA,MAC9D,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,GAAG;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACzD,MAAI,QAAQ,SAAS,KAAK,SAAS,QAAQ,QAAQ,UAAU,GAAG;AAC9D,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,GAAG,QAAQ,MAAM;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,QAAM,iBAAiB,MAAM,IAAI,WAAW,OAAO;AAAA,IACjD,MAAM;AAAA,IACN,OAAO;AAAA,IACP,OAAO;AAAA,EACT,CAAC;AACD,QAAM,cAAc,MAAM,IAAI,WAAW,OAAO,EAAE,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,CAAC;AAC3F,QAAM,iBAAiB,eAAe,SAAS,YAAY;AAC3D,MAAI,iBAAiB,GAAG;AAEtB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,GAAG,cAAc;AAAA,MAC1B,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AAGA,QAAM,oBAAoB,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,OAAO,CAAa;AACjG,QAAM,eAAe,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,OAAO,CAAa;AACrF,QAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO,CAAa;AAC9E,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS,GAAG;AAC3B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,UAAU;AAAA,IACd,UAAU,CAAC,SAAS,SAAS,SAAS,OAAO;AAAA,IAC7C,UAAU,KAAK;AAAA,IACf;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,cAAc,aAAa;AAAA,MAC3B,mBAAmB,kBAAkB;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;","names":[]}

package/dist/chunk-KMPRBJK4.js

@@ -0,0 +1,74 @@
+import {
+  buildTrajectory
+} from "./chunk-RZTMDUO7.js";
+import {
+  isLlmSpan,
+  isToolSpan
+} from "./chunk-5BKGXME7.js";
+
+// src/prm/training-export.ts
+async function exportTrainingData(store, graded, options = {}) {
+  const window = options.contextWindow ?? 5;
+  const out = [];
+  for (const g of graded) {
+    const trajectory = await buildTrajectory(store, g.runId);
+    const spanById = new Map(trajectory.steps.map((s) => [s.span.spanId, s]));
+    for (const gs of g.steps) {
+      const node = spanById.get(gs.spanId);
+      if (!node) continue;
+      const idx = trajectory.steps.indexOf(node);
+      const priorSpans = trajectory.steps.slice(Math.max(0, idx - window), idx).map((s) => s.span);
+      out.push({
+        runId: g.runId,
+        spanId: gs.spanId,
+        rubricId: gs.rubricId,
+        score: gs.score,
+        context: {
+          priorTurns: priorSpans.map(spanToTurn).filter((t) => t !== null),
+          step: { kind: node.span.kind, text: spanToText(node.span) }
+        },
+        rationale: gs.rationale,
+        evidence: gs.evidence
+      });
+    }
+  }
+  return out;
+}
+function toNdjson(samples) {
+  return `${samples.map((s) => JSON.stringify(s)).join("\n")}
+`;
+}
+function spanToTurn(span) {
+  if (isLlmSpan(span)) {
+    const text = span.output ?? span.messages.map((m) => `${m.role}: ${m.content}`).join("\n");
+    return { role: "assistant", content: text };
+  }
+  if (isToolSpan(span)) {
+    return {
+      role: "tool",
+      content: `${span.toolName}(${safeStringify(span.args)}) \u2192 ${safeStringify(span.result)}`
+    };
+  }
+  return null;
+}
+function spanToText(span) {
+  if (isLlmSpan(span)) return span.output ?? "";
+  if (isToolSpan(span))
+    return `${span.toolName}(${safeStringify(span.args)}) \u2192 ${safeStringify(span.result)}`;
+  return span.name;
+}
+function safeStringify(v) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "string") return v;
+  try {
+    return JSON.stringify(v);
+  } catch {
+    return String(v);
+  }
+}
+
+export {
+  exportTrainingData,
+  toNdjson
+};
+//# sourceMappingURL=chunk-KMPRBJK4.js.map

package/dist/chunk-KMPRBJK4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prm/training-export.ts"],"sourcesContent":["/**\n * Export PRM-graded traces as training data for downstream reward-model\n * fine-tuning. Canonical format is NDJSON of\n * `{ trajectory_text, step_index, rubric, score }` so a small model can\n * learn to predict step rewards from step context.\n *\n * The framework doesn't train the model — we emit the data; callers\n * plug it into their preferred trainer (TRL, Unsloth, custom).\n */\n\nimport type { LlmSpan, Span } from '../trace/schema'\nimport { isLlmSpan, isToolSpan } from '../trace/schema'\nimport type { TraceStore } from '../trace/store'\nimport { buildTrajectory } from '../trajectory'\nimport type { PrmGradedTrace } from './rubric'\n\nexport interface PrmTrainingSample {\n  runId: string\n  spanId: string\n  rubricId: string\n  score: number\n  /** Serialized step context — step + surrounding conversation. */\n  context: {\n    priorTurns: Array<{ role: string; content: string }>\n    step: { kind: Span['kind']; text: string }\n  }\n  /** Optional evidence + rationale for auditability. */\n  rationale?: string\n  evidence?: string\n}\n\nexport async function exportTrainingData(\n  store: TraceStore,\n  graded: PrmGradedTrace[],\n  options: { contextWindow?: number } = {},\n): Promise<PrmTrainingSample[]> {\n  const window = options.contextWindow ?? 5\n  const out: PrmTrainingSample[] = []\n  for (const g of graded) {\n    const trajectory = await buildTrajectory(store, g.runId)\n    const spanById = new Map(trajectory.steps.map((s) => [s.span.spanId, s]))\n    for (const gs of g.steps) {\n      const node = spanById.get(gs.spanId)\n      if (!node) continue\n      const idx = trajectory.steps.indexOf(node)\n      const priorSpans = trajectory.steps.slice(Math.max(0, idx - window), idx).map((s) => s.span)\n      out.push({\n        runId: g.runId,\n        spanId: gs.spanId,\n        rubricId: gs.rubricId,\n        score: gs.score,\n        context: {\n          priorTurns: priorSpans\n            .map(spanToTurn)\n            .filter((t): t is { role: string; content: string } => t !== null),\n          step: { kind: node.span.kind, text: spanToText(node.span) },\n        },\n        rationale: gs.rationale,\n        evidence: gs.evidence,\n      })\n    }\n  }\n  return out\n}\n\n/** NDJSON serialization — write to file or stream directly to a trainer. */\nexport function toNdjson(samples: PrmTrainingSample[]): string {\n  return `${samples.map((s) => JSON.stringify(s)).join('\\n')}\\n`\n}\n\nfunction spanToTurn(span: Span): { role: string; content: string } | null {\n  if (isLlmSpan(span)) {\n    const text = span.output ?? span.messages.map((m) => `${m.role}: ${m.content}`).join('\\n')\n    return { role: 'assistant', content: text }\n  }\n  if (isToolSpan(span)) {\n    return {\n      role: 'tool',\n      content: `${span.toolName}(${safeStringify(span.args)}) → ${safeStringify(span.result)}`,\n    }\n  }\n  return null\n}\n\nfunction spanToText(span: Span): string {\n  if (isLlmSpan(span)) return (span as LlmSpan).output ?? ''\n  if (isToolSpan(span))\n    return `${span.toolName}(${safeStringify(span.args)}) → ${safeStringify(span.result)}`\n  return span.name\n}\n\nfunction safeStringify(v: unknown): string {\n  if (v === null || v === undefined) return ''\n  if (typeof v === 'string') return v\n  try {\n    return JSON.stringify(v)\n  } catch {\n    return String(v)\n  }\n}\n"],"mappings":";;;;;;;;;AA+BA,eAAsB,mBACpB,OACA,QACA,UAAsC,CAAC,GACT;AAC9B,QAAM,SAAS,QAAQ,iBAAiB;AACxC,QAAM,MAA2B,CAAC;AAClC,aAAW,KAAK,QAAQ;AACtB,UAAM,aAAa,MAAM,gBAAgB,OAAO,EAAE,KAAK;AACvD,UAAM,WAAW,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC;AACxE,eAAW,MAAM,EAAE,OAAO;AACxB,YAAM,OAAO,SAAS,IAAI,GAAG,MAAM;AACnC,UAAI,CAAC,KAAM;AACX,YAAM,MAAM,WAAW,MAAM,QAAQ,IAAI;AACzC,YAAM,aAAa,WAAW,MAAM,MAAM,KAAK,IAAI,GAAG,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC3F,UAAI,KAAK;AAAA,QACP,OAAO,EAAE;AAAA,QACT,QAAQ,GAAG;AAAA,QACX,UAAU,GAAG;AAAA,QACb,OAAO,GAAG;AAAA,QACV,SAAS;AAAA,UACP,YAAY,WACT,IAAI,UAAU,EACd,OAAO,CAAC,MAA8C,MAAM,IAAI;AAAA,UACnE,MAAM,EAAE,MAAM,KAAK,KAAK,MAAM,MAAM,WAAW,KAAK,IAAI,EAAE;AAAA,QAC5D;AAAA,QACA,WAAW,GAAG;AAAA,QACd,UAAU,GAAG;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,SAAS,SAAsC;AAC7D,SAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAC5D;AAEA,SAAS,WAAW,MAAsD;AACxE,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,OAAO,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AACzF,WAAO,EAAE,MAAM,aAAa,SAAS,KAAK;AAAA,EAC5C;AACA,MAAI,WAAW,IAAI,GAAG;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,GAAG,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,CAAC,YAAO,cAAc,KAAK,MAAM,CAAC;AAAA,IACxF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAAoB;AACtC,MAAI,UAAU,IAAI,EAAG,QAAQ,KAAiB,UAAU;AACxD,MAAI,WAAW,IAAI;AACjB,WAAO,GAAG,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,CAAC,YAAO,cAAc,KAAK,MAAM,CAAC;AACtF,SAAO,KAAK;AACd;AAEA,SAAS,cAAc,GAAoB;AACzC,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI;AACF,WAAO,KAAK,UAAU,CAAC;AAAA,EACzB,QAAQ;AACN,WAAO,OAAO,CAAC;AAAA,EACjB;AACF;","names":[]}

package/dist/{chunk-QUKKGHTZ.js → chunk-KTGTIOFD.js}

@@ -1,11 +1,14 @@
+import {
+  CaptureIntegrityError
+} from "./chunk-NG236HPC.js";
+
 // src/trace/integrity.ts
-var RunIntegrityError = class extends Error {
+var RunIntegrityError = class extends CaptureIntegrityError {
   constructor(report) {
     super(
       `Run ${report.runId} failed integrity check: ${report.issues.map((i) => i.code).join(", ")}`
     );
     this.report = report;
-    this.name = "RunIntegrityError";
   }
   report;
 };
@@ -118,4 +121,4 @@ export {
   assertRunCaptured,
   throwIfRunIncomplete
 };
-//# sourceMappingURL=chunk-QUKKGHTZ.js.map
+//# sourceMappingURL=chunk-KTGTIOFD.js.map

package/dist/chunk-KTGTIOFD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/trace/integrity.ts"],"sourcesContent":["/**\n * Run-completion integrity check — at end of run, verify the expected event\n * types were actually captured. The point is the launch-review failure mode:\n * a run *appears* successful but the raw provider events were never written,\n * so a downstream reviewer can't reconstruct what happened.\n *\n * Pattern:\n *\n *   const report = await assertRunCaptured(store, runId, {\n *     llmSpansMin: 1,\n *     judgeSpansMin: 1,\n *     rawSink: providerSink,                  // must have ≥ 1 event for this run\n *     requireRawCoverageOfLlmSpans: true,     // every llm span has matching raw events\n *   })\n *   if (!report.ok) throwIfRunIncomplete(report)  // or mark run failed and continue\n *\n * The function is read-only on the store and returns a structured report;\n * the caller chooses the failure mode (throw, mark run failed, log warning).\n * `throwIfRunIncomplete` is the convenient strict mode.\n */\n\nimport { CaptureIntegrityError } from '../errors'\nimport type { RawProviderSink } from './raw-provider-sink'\nimport type { TraceStore } from './store'\n\nexport interface RunIntegrityExpectations {\n  /** Minimum LLM span count. Default 0 (no requirement). */\n  llmSpansMin?: number\n  /** Minimum judge span count. Default 0. */\n  judgeSpansMin?: number\n  /** Minimum tool span count. Default 0. */\n  toolSpansMin?: number\n  /**\n   * Raw provider sink to consult for capture verification. When present,\n   * the check requires at least one raw event for the run.\n   */\n  rawSink?: RawProviderSink\n  /** Minimum raw provider event count. Default 0; ignored when `rawSink` absent. */\n  rawProviderEventsMin?: number\n  /**\n   * Every LLM span must have at least one matching raw `request` event\n   * (matched by spanId). Catches the common bug where the structured span\n   * was emitted but the raw HTTP capture was wired to a different sink.\n   */\n  requireRawCoverageOfLlmSpans?: boolean\n  /** Run outcome must be set (not null/undefined). Default false. */\n  requireOutcome?: boolean\n}\n\nexport type RunIntegrityIssueCode =\n  | 'no_run'\n  | 'missing_llm_spans'\n  | 'missing_judge_spans'\n  | 'missing_tool_spans'\n  | 'missing_raw_events'\n  | 'no_raw_sink'\n  | 'orphan_llm_span'\n  | 'missing_outcome'\n\nexport interface RunIntegrityIssue {\n  code: RunIntegrityIssueCode\n  message: string\n  detail?: Record<string, unknown>\n}\n\nexport interface RunIntegrityReport {\n  ok: boolean\n  runId: string\n  llmSpanCount: number\n  judgeSpanCount: number\n  toolSpanCount: number\n  rawProviderEventCount: number\n  /**\n   * Coverage of LLM spans by raw provider events keyed on spanId.\n   * `total` is the number of LLM spans; `covered` is the count with at\n   * least one matching `request` raw event.\n   */\n  rawSpanCoverage: { covered: number; total: number }\n  issues: RunIntegrityIssue[]\n}\n\nexport class RunIntegrityError extends CaptureIntegrityError {\n  constructor(public readonly report: RunIntegrityReport) {\n    super(\n      `Run ${report.runId} failed integrity check: ${report.issues.map((i) => i.code).join(', ')}`,\n    )\n  }\n}\n\nexport async function assertRunCaptured(\n  store: TraceStore,\n  runId: string,\n  expectations: RunIntegrityExpectations = {},\n): Promise<RunIntegrityReport> {\n  const issues: RunIntegrityIssue[] = []\n  const run = await store.getRun(runId)\n  if (!run) {\n    return {\n      ok: false,\n      runId,\n      llmSpanCount: 0,\n      judgeSpanCount: 0,\n      toolSpanCount: 0,\n      rawProviderEventCount: 0,\n      rawSpanCoverage: { covered: 0, total: 0 },\n      issues: [{ code: 'no_run', message: `Run ${runId} not found in store.` }],\n    }\n  }\n\n  const spans = await store.spans({ runId })\n  const llmSpans = spans.filter((s) => s.kind === 'llm')\n  const judgeSpans = spans.filter((s) => s.kind === 'judge')\n  const toolSpans = spans.filter((s) => s.kind === 'tool')\n\n  const llmMin = expectations.llmSpansMin ?? 0\n  const judgeMin = expectations.judgeSpansMin ?? 0\n  const toolMin = expectations.toolSpansMin ?? 0\n\n  if (llmSpans.length < llmMin) {\n    issues.push({\n      code: 'missing_llm_spans',\n      message: `Expected ≥ ${llmMin} LLM spans, found ${llmSpans.length}.`,\n      detail: { expected: llmMin, found: llmSpans.length },\n    })\n  }\n  if (judgeSpans.length < judgeMin) {\n    issues.push({\n      code: 'missing_judge_spans',\n      message: `Expected ≥ ${judgeMin} judge spans, found ${judgeSpans.length}.`,\n      detail: { expected: judgeMin, found: judgeSpans.length },\n    })\n  }\n  if (toolSpans.length < toolMin) {\n    issues.push({\n      code: 'missing_tool_spans',\n      message: `Expected ≥ ${toolMin} tool spans, found ${toolSpans.length}.`,\n      detail: { expected: toolMin, found: toolSpans.length },\n    })\n  }\n\n  let rawEventCount = 0\n  let coverage = { covered: 0, total: llmSpans.length }\n\n  if (expectations.rawSink) {\n    if (!expectations.rawSink.list) {\n      issues.push({\n        code: 'no_raw_sink',\n        message: 'Provided rawSink does not implement list(); cannot verify capture.',\n      })\n    } else {\n      const events = await expectations.rawSink.list({ runId })\n      rawEventCount = events.length\n      const rawMin = expectations.rawProviderEventsMin ?? 1\n      if (rawEventCount < rawMin) {\n        issues.push({\n          code: 'missing_raw_events',\n          message: `Expected ≥ ${rawMin} raw provider events, found ${rawEventCount}.`,\n          detail: { expected: rawMin, found: rawEventCount },\n        })\n      }\n      if (expectations.requireRawCoverageOfLlmSpans) {\n        const requestEventsBySpan = new Set(\n          events.filter((e) => e.direction === 'request' && e.spanId).map((e) => e.spanId!),\n        )\n        const orphaned = llmSpans.filter((s) => !requestEventsBySpan.has(s.spanId))\n        coverage = { covered: llmSpans.length - orphaned.length, total: llmSpans.length }\n        if (orphaned.length > 0) {\n          issues.push({\n            code: 'orphan_llm_span',\n            message: `${orphaned.length} LLM span(s) have no matching raw provider request event.`,\n            detail: { orphanedSpanIds: orphaned.map((s) => s.spanId) },\n          })\n        }\n      }\n    }\n  } else if (expectations.requireRawCoverageOfLlmSpans || expectations.rawProviderEventsMin) {\n    issues.push({\n      code: 'no_raw_sink',\n      message: 'Raw coverage required but no rawSink supplied to the integrity check.',\n    })\n  }\n\n  if (expectations.requireOutcome && (run.outcome === undefined || run.outcome === null)) {\n    issues.push({\n      code: 'missing_outcome',\n      message: `Run ${runId} has no outcome recorded.`,\n    })\n  }\n\n  return {\n    ok: issues.length === 0,\n    runId,\n    llmSpanCount: llmSpans.length,\n    judgeSpanCount: judgeSpans.length,\n    toolSpanCount: toolSpans.length,\n    rawProviderEventCount: rawEventCount,\n    rawSpanCoverage: coverage,\n    issues,\n  }\n}\n\n/** Strict mode: throws `RunIntegrityError` when the report isn't ok. */\nexport function throwIfRunIncomplete(report: RunIntegrityReport): void {\n  if (!report.ok) throw new RunIntegrityError(report)\n}\n"],"mappings":";;;;;AAiFO,IAAM,oBAAN,cAAgC,sBAAsB;AAAA,EAC3D,YAA4B,QAA4B;AACtD;AAAA,MACE,OAAO,OAAO,KAAK,4BAA4B,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,IAC5F;AAH0B;AAAA,EAI5B;AAAA,EAJ4B;AAK9B;AAEA,eAAsB,kBACpB,OACA,OACA,eAAyC,CAAC,GACb;AAC7B,QAAM,SAA8B,CAAC;AACrC,QAAM,MAAM,MAAM,MAAM,OAAO,KAAK;AACpC,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,iBAAiB,EAAE,SAAS,GAAG,OAAO,EAAE;AAAA,MACxC,QAAQ,CAAC,EAAE,MAAM,UAAU,SAAS,OAAO,KAAK,uBAAuB,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,MAAM,CAAC;AACzC,QAAM,WAAW,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK;AACrD,QAAM,aAAa,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AACzD,QAAM,YAAY,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAEvD,QAAM,SAAS,aAAa,eAAe;AAC3C,QAAM,WAAW,aAAa,iBAAiB;AAC/C,QAAM,UAAU,aAAa,gBAAgB;AAE7C,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,mBAAc,MAAM,qBAAqB,SAAS,MAAM;AAAA,MACjE,QAAQ,EAAE,UAAU,QAAQ,OAAO,SAAS,OAAO;AAAA,IACrD,CAAC;AAAA,EACH;AACA,MAAI,WAAW,SAAS,UAAU;AAChC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,mBAAc,QAAQ,uBAAuB,WAAW,MAAM;AAAA,MACvE,QAAQ,EAAE,UAAU,UAAU,OAAO,WAAW,OAAO;AAAA,IACzD,CAAC;AAAA,EACH;AACA,MAAI,UAAU,SAAS,SAAS;AAC9B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,mBAAc,OAAO,sBAAsB,UAAU,MAAM;AAAA,MACpE,QAAQ,EAAE,UAAU,SAAS,OAAO,UAAU,OAAO;AAAA,IACvD,CAAC;AAAA,EACH;AAEA,MAAI,gBAAgB;AACpB,MAAI,WAAW,EAAE,SAAS,GAAG,OAAO,SAAS,OAAO;AAEpD,MAAI,aAAa,SAAS;AACxB,QAAI,CAAC,aAAa,QAAQ,MAAM;AAC9B,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH,OAAO;AACL,YAAM,SAAS,MAAM,aAAa,QAAQ,KAAK,EAAE,MAAM,CAAC;AACxD,sBAAgB,OAAO;AACvB,YAAM,SAAS,aAAa,wBAAwB;AACpD,UAAI,gBAAgB,QAAQ;AAC1B,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,mBAAc,MAAM,+BAA+B,aAAa;AAAA,UACzE,QAAQ,EAAE,UAAU,QAAQ,OAAO,cAAc;AAAA,QACnD,CAAC;AAAA,MACH;AACA,UAAI,aAAa,8BAA8B;AAC7C,cAAM,sBAAsB,IAAI;AAAA,UAC9B,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAO;AAAA,QAClF;AACA,cAAM,WAAW,SAAS,OAAO,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,MAAM,CAAC;AAC1E,mBAAW,EAAE,SAAS,SAAS,SAAS,SAAS,QAAQ,OAAO,SAAS,OAAO;AAChF,YAAI,SAAS,SAAS,GAAG;AACvB,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,SAAS,GAAG,SAAS,MAAM;AAAA,YAC3B,QAAQ,EAAE,iBAAiB,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE;AAAA,UAC3D,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,aAAa,gCAAgC,aAAa,sBAAsB;AACzF,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,aAAa,mBAAmB,IAAI,YAAY,UAAa,IAAI,YAAY,OAAO;AACtF,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,OAAO,KAAK;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI,OAAO,WAAW;AAAA,IACtB;AAAA,IACA,cAAc,SAAS;AAAA,IACvB,gBAAgB,WAAW;AAAA,IAC3B,eAAe,UAAU;AAAA,IACzB,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,EACF;AACF;AAGO,SAAS,qBAAqB,QAAkC;AACrE,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,kBAAkB,MAAM;AACpD;","names":[]}