@tangle-network/browser-agent-driver 0.29.0 → 0.31.0

package/dist/design/audit/ethics/loader.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Ethics rule loader — Layer 7.
+ *
+ * Loads `EthicsRule[]` from `rules/*.yaml`. Idempotent + cached: the in-memory
+ * cache keys on directory path so repeated calls (per-page audits) never re-IO.
+ *
+ * Each YAML file is a list of rule objects. The minimal parser supports the
+ * shape used in the RFC: `- key: value` items with nested objects and inline
+ * `[a, b]` lists. No external yaml dep — same approach as rubric/loader.ts.
+ */
+import type { EthicsRule, EthicsSeverity } from '../v2/types.js';
+/** Severity → rollup ceiling. critical-floor caps at 4; major-floor caps at 6. */
+export declare function rollupCapFor(severity: EthicsSeverity): number;
+/**
+ * Load every `*.yaml` rule file in `dir`. Cached by absolute path.
+ * Returns a stable order (sorted by filename + position within file).
+ */
+export declare function loadEthicsRules(dir?: string): EthicsRule[];
+/** Reset cache — test-only. */
+export declare function clearEthicsRuleCache(): void;
+//# sourceMappingURL=loader.d.ts.map

package/dist/design/audit/ethics/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/design/audit/ethics/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EACV,UAAU,EAEV,cAAc,EAGf,MAAM,gBAAgB,CAAA;AAOvB,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAA0B,GAAG,UAAU,EAAE,CAkB7E;AAED,+BAA+B;AAC/B,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/design/audit/ethics/loader.js

@@ -0,0 +1,207 @@
+/**
+ * Ethics rule loader — Layer 7.
+ *
+ * Loads `EthicsRule[]` from `rules/*.yaml`. Idempotent + cached: the in-memory
+ * cache keys on directory path so repeated calls (per-page audits) never re-IO.
+ *
+ * Each YAML file is a list of rule objects. The minimal parser supports the
+ * shape used in the RFC: `- key: value` items with nested objects and inline
+ * `[a, b]` lists. No external yaml dep — same approach as rubric/loader.ts.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const BUILTIN_RULES_DIR = path.join(__dirname, 'rules');
+const cache = new Map();
+/** Severity → rollup ceiling. critical-floor caps at 4; major-floor caps at 6. */
+export function rollupCapFor(severity) {
+    return severity === 'critical-floor' ? 4 : 6;
+}
+/**
+ * Load every `*.yaml` rule file in `dir`. Cached by absolute path.
+ * Returns a stable order (sorted by filename + position within file).
+ */
+export function loadEthicsRules(dir = BUILTIN_RULES_DIR) {
+    const abs = path.resolve(dir);
+    const cached = cache.get(abs);
+    if (cached)
+        return cached;
+    if (!fs.existsSync(abs)) {
+        cache.set(abs, []);
+        return [];
+    }
+    const rules = [];
+    const files = fs.readdirSync(abs).filter(f => f.endsWith('.yaml')).sort();
+    for (const f of files) {
+        const file = path.join(abs, f);
+        const raw = fs.readFileSync(file, 'utf-8');
+        const parsed = parseRuleList(raw, file);
+        for (const r of parsed)
+            rules.push(r);
+    }
+    cache.set(abs, rules);
+    return rules;
+}
+/** Reset cache — test-only. */
+export function clearEthicsRuleCache() {
+    cache.clear();
+}
+function parseRuleList(text, sourceFile) {
+    const items = splitTopLevelItems(text);
+    return items.map((block, idx) => parseRule(block, `${sourceFile}#${idx}`));
+}
+/** Split a YAML doc into top-level `- item` blocks (one block per rule). */
+function splitTopLevelItems(text) {
+    const lines = text.split('\n');
+    const items = [];
+    let current = null;
+    for (const line of lines) {
+        if (/^\s*#/.test(line) || line.trim() === '') {
+            if (current)
+                current.push(line);
+            continue;
+        }
+        if (line.startsWith('- ')) {
+            if (current)
+                items.push(current.join('\n'));
+            current = [line.slice(2)];
+        }
+        else if (current) {
+            // Indented continuation. Strip 2 leading spaces if present so nesting
+            // levels become consistent within the item.
+            current.push(line.startsWith('  ') ? line.slice(2) : line);
+        }
+    }
+    if (current)
+        items.push(current.join('\n'));
+    return items;
+}
+function parseRule(block, ref) {
+    const meta = parseYamlBlock(block);
+    const ruleId = stringField(meta, 'ruleId', ref);
+    const category = stringField(meta, 'category', ref);
+    const severity = stringField(meta, 'severity', ref);
+    if (severity !== 'critical-floor' && severity !== 'major-floor') {
+        throw new Error(`ethics rule ${ruleId} (${ref}): invalid severity ${severity}`);
+    }
+    const remediation = stringField(meta, 'remediation', ref);
+    const appliesWhen = meta.appliesWhen ?? {};
+    const detectorRaw = meta.detector ?? {};
+    const detector = parseDetector(detectorRaw, ruleId);
+    const citation = meta.citation != null ? String(meta.citation) : undefined;
+    return {
+        ruleId,
+        category,
+        severity,
+        appliesWhen,
+        detector,
+        remediation,
+        ...(citation ? { citation } : {}),
+    };
+}
+function parseDetector(d, ruleId) {
+    const kind = String(d.kind ?? '');
+    if (kind === 'pattern-absent' || kind === 'pattern-present') {
+        const pattern = String(d.pattern ?? '');
+        if (!pattern)
+            throw new Error(`ethics rule ${ruleId}: detector.pattern required for ${kind}`);
+        return { kind, pattern };
+    }
+    if (kind === 'llm-classifier') {
+        const llmCheck = String(d.llmCheck ?? '');
+        if (!llmCheck)
+            throw new Error(`ethics rule ${ruleId}: detector.llmCheck required for llm-classifier`);
+        return { kind, llmCheck };
+    }
+    throw new Error(`ethics rule ${ruleId}: unknown detector.kind ${kind}`);
+}
+function stringField(meta, key, ref) {
+    const v = meta[key];
+    if (v == null || String(v) === '') {
+        throw new Error(`ethics rule (${ref}): missing required field ${key}`);
+    }
+    return String(v);
+}
+/**
+ * YAML block parser supporting:
+ *   key: scalar
+ *   key: [a, b]
+ *   key: |  → folded multi-line block (preserves newlines)
+ *   key: > or just continuation lines indented under the key
+ *   key:
+ *     subkey: value
+ *     listKey: [a, b]
+ */
+function parseYamlBlock(text) {
+    const lines = text.split('\n');
+    const result = {};
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (!line.trim() || line.trim().startsWith('#')) {
+            i++;
+            continue;
+        }
+        const m = line.match(/^([a-zA-Z][\w-]*):\s*(.*)$/);
+        if (!m) {
+            i++;
+            continue;
+        }
+        const [, key, valueRaw] = m;
+        const value = valueRaw.trim();
+        if (value === '|' || value === '>') {
+            // Folded block: collect indented continuation lines.
+            const collected = [];
+            i++;
+            while (i < lines.length && (lines[i].startsWith('  ') || lines[i].trim() === '')) {
+                collected.push(lines[i].replace(/^ {2}/, ''));
+                i++;
+            }
+            result[key] = collected.join(value === '|' ? '\n' : ' ').trim();
+        }
+        else if (value === '') {
+            // Nested object — collect indented lines.
+            const nested = {};
+            i++;
+            while (i < lines.length && (lines[i].startsWith('  ') || lines[i].trim() === '')) {
+                if (!lines[i].trim()) {
+                    i++;
+                    continue;
+                }
+                const nm = lines[i].match(/^\s+([a-zA-Z][\w-]*):\s*(.*)$/);
+                if (nm) {
+                    nested[nm[1]] = parseScalarOrList(nm[2].trim());
+                }
+                i++;
+            }
+            result[key] = nested;
+        }
+        else {
+            result[key] = parseScalarOrList(value);
+            i++;
+        }
+    }
+    return result;
+}
+function parseScalarOrList(value) {
+    if (value.startsWith('[') && value.endsWith(']')) {
+        return value
+            .slice(1, -1)
+            .split(',')
+            .map(s => s.trim().replace(/^['"]|['"]$/g, ''))
+            .filter(Boolean);
+    }
+    // Strip surrounding quotes for plain scalars.
+    if ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"'))) {
+        return value.slice(1, -1);
+    }
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    if (/^-?\d+(\.\d+)?$/.test(value))
+        return Number(value);
+    return value;
+}
+//# sourceMappingURL=loader.js.map

package/dist/design/audit/ethics/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../../src/design/audit/ethics/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AASxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9D,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;AAEvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;AAE7C,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,OAAO,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,iBAAiB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAClB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,oBAAoB;IAClC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,UAAkB;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,GAAoB,IAAI,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3C,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,sEAAsE;YACtE,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAmB,CAAA;IACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAmB,CAAA;IACrE,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,KAAK,GAAG,uBAAuB,QAAQ,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,WAAW,GAAI,IAAI,CAAC,WAA2B,IAAI,EAAE,CAAA;IAC3D,MAAM,WAAW,GAAI,IAAI,CAAC,QAAoC,IAAI,EAAE,CAAA;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,OAAO;QACL,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAA0B,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,mCAAmC,IAAI,EAAE,CAAC,CAAA;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,iDAAiD,CAAC,CAAA;QACtG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,2BAA2B,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,GAAW,EAAE,GAAW;IAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,6BAA6B,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAClD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnC,qDAAqD;YACrD,MAAM,SAAS,GAAa,EAAE,CAAA;YAC9B,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACjF,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;gBAC7C,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACjE,CAAC;aAAM,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxB,0CAA0C;YAC1C,MAAM,MAAM,GAA4B,EAAE,CAAA;YAC1C,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAA;oBACH,SAAQ;gBACV,CAAC;gBACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBAC1D,IAAI,EAAE,EAAE,CAAC;oBACP,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;gBACjD,CAAC;gBACD,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAC,CAAA;IACpB,CAAC;IACD,8CAA8C;IAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACvD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/design/audit/ethics/rules/finance.yaml

@@ -0,0 +1,37 @@
+# Financial product ethics rules.
+# Anchored to CFPB Reg E / Reg Z, EU PSD2, and SEC Rule 10b-10 disclosures.
+
+- ruleId: finance:fees-disclosed-pre-commitment
+  category: finance
+  severity: critical-floor
+  appliesWhen:
+    type: [ecommerce]
+    domain: [fintech, finance, banking, payments]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this checkout page hide, defer, or fail to itemize any fees, taxes, FX, or charges that the user will pay, with the pay/commit button reachable before the totals are fully visible?
+  remediation: Surface every line item (fees, taxes, FX) above the pay button.
+  citation: CFPB 12 CFR 1026 Reg Z / FTC Junk Fees Rule
+
+- ruleId: finance:apr-or-effective-rate-shown
+  category: finance
+  severity: major-floor
+  appliesWhen:
+    domain: [fintech, finance, banking, payments, lending]
+  detector:
+    kind: pattern-absent
+    pattern: (APR|annual percentage rate|effective (interest )?rate|finance charge)
+  remediation: Display APR or effective interest rate alongside any credit, lending, or yield-bearing offer.
+  citation: TILA 15 USC 1638 / CFPB 12 CFR 1026.18
+
+- ruleId: finance:risk-disclosure-required
+  category: finance
+  severity: major-floor
+  appliesWhen:
+    domain: [fintech, finance, crypto, investing, trading]
+    audienceVulnerability: [high-stakes-financial]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this trading / investing / staking page allow the user to commit funds WITHOUT a clearly visible disclosure of principal-loss, volatility, or non-FDIC-insurance risk above the action button?
+  remediation: Show risk-of-loss and insurance-status disclosures above the action button on any investing, trading, or staking surface.
+  citation: SEC Rule 10b-10 / FINRA Rule 2210

package/dist/design/audit/ethics/rules/kids.yaml

@@ -0,0 +1,37 @@
+# Kids-targeted product ethics rules.
+# Anchored to COPPA + UK ICO Age Appropriate Design Code (AADC).
+
+- ruleId: kids:dark-patterns-prohibited
+  category: kids
+  severity: critical-floor
+  appliesWhen:
+    audience: [kids]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this page use any dark pattern (hidden costs, forced action, fake urgency, confirmshaming, manipulated visual hierarchy) targeting a minor user?
+  remediation: Remove all dark patterns. Use clear, age-appropriate, friction-symmetric flows.
+  citation: COPPA 16 CFR 312.5 / FTC Dark Patterns Report 2022
+
+- ruleId: kids:age-gate-required
+  category: kids
+  severity: critical-floor
+  appliesWhen:
+    audience: [kids]
+    audienceVulnerability: [minor-facing]
+  detector:
+    kind: pattern-absent
+    pattern: (age|date of birth|verify your age)
+  remediation: Implement an age gate before collecting any data or showing user-generated content.
+  citation: COPPA 16 CFR 312.5
+
+- ruleId: kids:data-minimization-default
+  category: kids
+  severity: major-floor
+  appliesWhen:
+    audience: [kids]
+    regulatoryContext: [coppa]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this page request data fields from a child that are NOT strictly necessary for the activity (e.g. unmarked optional fields, profile / social / friend-graph fields, location or contact data not required for the task)?
+  remediation: Default to data minimization for child users — collect only what is strictly necessary, mark every optional field, and disable profile/social fields by default.
+  citation: ICO AADC Standard 8 / COPPA 16 CFR 312.7

package/dist/design/audit/ethics/rules/legal.yaml

@@ -0,0 +1,35 @@
+# Legal / regulatory consent rules.
+# Anchored to GDPR, ePrivacy Directive, and CCPA/CPRA notice-at-collection.
+
+- ruleId: legal:gdpr-cookie-consent
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (cookie|consent|necessary|preferences)
+  remediation: Display GDPR-compliant cookie consent banner with granular controls.
+  citation: GDPR Art. 7 / ePrivacy Directive 2002/58/EC Art. 5(3)
+
+- ruleId: legal:privacy-policy-link-required
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (privacy policy|privacy notice|data protection)
+  remediation: Provide a clearly labeled privacy policy / notice link on every page that processes personal data.
+  citation: GDPR Art. 13-14
+
+- ruleId: legal:ccpa-do-not-sell-link
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (do not sell|do not share|opt.?out|your privacy choices)
+  remediation: Provide a "Do Not Sell or Share My Personal Information" / "Your Privacy Choices" link in the global footer.
+  citation: CCPA Cal. Civ. Code 1798.135 / CPRA 1798.121

package/dist/design/audit/ethics/rules/medical.yaml

@@ -0,0 +1,36 @@
+# Medical / clinical / pharmacy ethics rules.
+# Anchored to FDA labeling regs, ICH E2 pharmacovigilance, and ONC info-blocking.
+
+- ruleId: medical:dosage-warning-required
+  category: medical
+  severity: critical-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+  detector:
+    kind: pattern-absent
+    pattern: (dosage|warning|contraindication|adverse|side effect)
+  remediation: Display dosage warnings, contraindications, and adverse-effect summaries before any prescription action.
+  citation: FDA 21 CFR 201.57
+
+- ruleId: medical:adverse-event-reporting-path
+  category: medical
+  severity: major-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+  detector:
+    kind: pattern-absent
+    pattern: (report.{0,20}(side effect|adverse|reaction)|MedWatch|FDA 1088|pharmacovigilance)
+  remediation: Provide a visible adverse-event reporting path (MedWatch link or equivalent) on any prescribing or dispensing surface.
+  citation: FDA 21 CFR 314.80 / ICH E2D
+
+- ruleId: medical:patient-education-disclosure
+  category: medical
+  severity: major-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+    audienceVulnerability: [patient-facing]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this patient-facing page request a clinical action or health-data submission WITHOUT first presenting plain-language patient education (indications, risks, instructions for use)?
+  remediation: Surface plain-language patient education (indications, risks, instructions) ahead of any clinical action a patient can take.
+  citation: ONC 45 CFR 170.315(g)(9) Patient Education

package/dist/design/audit/evaluate.d.ts

@@ -23,7 +23,72 @@ export interface EvaluateInput {
     rubric: ComposedRubric;
     measurements: MeasurementBundle;
     screenshotPath?: string;
+    auditPasses?: AuditPassId[];
+    /**
+     * Evolve-aware overrides. When present, these supersede the hard-coded
+     * defaults below — used by the GEPA harness to A/B candidate prompts
+     * without forking the audit pipeline.
+     */
+    overrides?: AuditOverrides;
 }
+export type AuditPassId = 'standard' | 'product' | 'visual' | 'trust' | 'workflow' | 'content';
+export interface AuditPass {
+    id: AuditPassId;
+    title: string;
+    goal: string;
+    instructions: string;
+    /**
+     * Per-pass opening sentence for the system prompt. Different passes need
+     * different framings: a `trust` pass should NOT open with "your job is the
+     * subjective visual layer only" — that sets the model to ignore the very
+     * findings it's supposed to surface.
+     */
+    systemOpener: string;
+    /**
+     * Suggested categories the LLM is most likely to emit for this pass. Used
+     * inside the few-shot example so the example matches the pass's focus.
+     * The category enum itself is shared (see brain/index.ts:VALID_CATEGORIES).
+     */
+    primaryCategory: 'visual-bug' | 'layout' | 'spacing' | 'typography' | 'ux';
+}
+export interface AuditOverrides {
+    /** Override one or more pass definitions. Missing keys fall through to defaults. */
+    passDefinitions?: Partial<Record<AuditPassId, AuditPass>>;
+    /** Override the classification → audit-mode mapping. */
+    inferAuditMode?: (classification: PageClassification) => string;
+    /** Override the embedded few-shot finding. The example is the single most
+     *  influential prompt knob — see `DEFAULT_FEW_SHOT_EXAMPLES` for shape. */
+    fewShotExamples?: Partial<Record<AuditPassId, string>>;
+    /** Override the NO-BS rules block (one rule per array element). */
+    noBsRules?: string[];
+    /** Override the (min,mean) weights for `conservativeScore`. */
+    conservativeWeights?: {
+        min: number;
+        mean: number;
+    };
+    /** Override the deep-mode pass bundle per page type. Keyed by classification.type. */
+    deepPassesByPageType?: Partial<Record<PageClassification['type'] | 'default', AuditPassId[]>>;
+}
+export declare const DEFAULT_NO_BS_RULES: string[];
+export declare const DEFAULT_CONSERVATIVE_WEIGHTS: {
+    min: number;
+    mean: number;
+};
+export declare const DEFAULT_DEEP_PASSES_BY_TYPE: Record<PageClassification['type'] | 'default', AuditPassId[]>;
+export declare const PASS_DEFINITIONS: Record<AuditPassId, AuditPass>;
+/**
+ * Pass-specific few-shot examples. Each example uses a CONCRETE finding shape
+ * for that pass's focus — no fake CSS, no vague meta-findings. The example
+ * sets the *shape* of every output the model produces, so we keep them
+ * realistic and category-appropriate.
+ */
+export declare const DEFAULT_FEW_SHOT_EXAMPLES: Record<AuditPassId, string>;
+export declare function resolveAuditPasses(value?: string | number | AuditPassId[], options?: {
+    classification?: PageClassification;
+    overrides?: AuditOverrides;
+}): AuditPassId[];
+export declare function inferAuditMode(classification: PageClassification): string;
+export declare function buildEvalPrompt(input: EvaluateInput, pass: AuditPass): string;
 /**
  * Convert deterministic measurements into findings.
  *
@@ -46,4 +111,8 @@ export declare function measurementsToFindings(measurements: MeasurementBundle):
  * Returns a PageAuditResult with merged findings (deterministic + LLM visual).
  */
 export declare function evaluatePage(brain: Brain, input: EvaluateInput): Promise<PageAuditResult>;
+export declare function conservativeScore(scores: number[], weights?: {
+    min: number;
+    mean: number;
+}): number;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/design/audit/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/design/audit/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,EAAE,kBAAkB,CAAA;IAClC,MAAM,EAAE,cAAc,CAAA;IACtB,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAoID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAuGvF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,eAAe,CAAC,CAyF1B"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/design/audit/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,EAAE,kBAAkB,CAAA;IAClC,MAAM,EAAE,cAAc,CAAA;IACtB,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,WAAW,EAAE,CAAA;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;AAE9F,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,eAAe,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAAA;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IACzD,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,KAAK,MAAM,CAAA;IAC/D;+EAC2E;IAC3E,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACtD,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;CAC9F;AAED,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAOvC,CAAA;AAED,eAAO,MAAM,4BAA4B;;;CAA4B,CAAA;AAErE,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAYrG,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CA6D3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAyEjE,CAAA;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,EAAE,EACvC,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,CAAA;CAAE,GAC5E,WAAW,EAAE,CAgBf;AA8CD,wBAAgB,cAAc,CAAC,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAwBzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAqH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAuGvF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,eAAe,CAAC,CAmG1B;AA8ID,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,GAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAiC,GACpE,MAAM,CASR"}